Cognition (Devin)
Cognition · Coding agent · US · cognition.com
services/cognition-devin.yamlVendor data-handling terms
Plan-specific terms decide whether code and sessions train models; enterprise agreements typically exclude it. The policy covers both Devin and Windsurf.
“To customize your experience with our Services and otherwise improve our Services including, depending on the terms that apply to your use of the Services, using User Content to train, fine tune and improve the models that power our Services.”
“We retain your personal information as needed to provide our Service to you, comply with legal obligations, or protect ours or others interests. / In line with these considerations, we delete information that is no longer needed for the above purposes or when you request deletion of your information.”
“To facilitate our operations, Cognition, our third-party partners, and service providers may transfer, store, and process your personal information throughout the world, including the EU, UK and the US.”
Domains and endpoints
observed means seen in Unseen deployments; vendor-documented means listed by the vendor. Vendors do not publish complete lists.
| Host | Role | Source |
|---|---|---|
| api.cognition.ai | api | observed |
| cognition-labs.com | app | observed |
| cognition.ai | app | observed |
| devin.ai | app | observed |
Assessment
Reasoning: Devin is an autonomous coding agent with repository and shell access, and Cognition also owns Windsurf. The privacy policy leaves training on user content to the plan terms, which means code from self-serve accounts may train models. Enterprise contracts change that, and the agent's access scope still needs limiting.
Flags: User content may train models depending on plan terms · Agent holds repository and execution access · Processing in multiple regions · Assessed 2026-09-16. The assessment is Unseen's; the terms above are the vendor's.
Changelog
- 2026-09-16Documented. Training, retention and transfer terms verified against the Cognition privacy policy.
- 2026-09-15Listed from the Unseen catalogue with observed domains.
Corrections
Pull request on GitHub, or the form below. Changes are reviewed and recorded in the changelog.