Editorial notice: vettedaiagents.com is an independent editorial directory. Not affiliated with, endorsed by, or sponsored by any vendor named on this site. Vetting is editorial, not compliance certification. Verify all claims directly with vendors before purchasing. Vetting last reviewed April 2026
VettedAIAgents
Compliance snapshot, reviewed July 2026

Is Devin (Cognition) SOC 2 compliant? Yes, plus ISO 27001:2022.

Cognition, the company behind the autonomous software engineer Devin, has held SOC 2 Type II since September 2024 and is ISO/IEC 27001:2022 certified. It states it does not train its models on customer code or data by default. The one gap against our seven-criterion bar is ISO 42001 (AI management), which Cognition does not yet hold, so it scores 6 of 7.

SOC 2 Type II
Yes (Sept 2024)
ISO 27001:2022
Yes
Trains on your code?
No, by default
ISO 42001 (AI)
Not yet

Source: trust.cognition.ai (SOC 2 Type II, ISO/IEC 27001:2022, CCPA) and cognition.com/legal/security. Editorial vetting, not a compliance certification; verify directly before purchase.

Data handling: training, retention and deployment

How Devin handles your code and data, in detail

Does Devin train its AI models on my code?

No, not by default. Cognition states it does not train its models on customer code or data. Customer code is processed ephemerally and is not retained, indexed, or used to improve the underlying models.

How long does Cognition retain my data?

Customer data is deleted within 90 days of contract termination, and audit logs are retained for at least one year. Data is retained only for the duration of the customer relationship unless otherwise specified in the contract.

Can Devin run inside my own cloud environment?

Yes, for Enterprise customers. Cognition offers a Customer Data Plane where processing happens inside the customer's own cloud service provider account, and Cognition cannot access data stored there, or alternatively a Cognition-controlled account. Its listed subprocessors include AWS, Microsoft Azure, OpenAI, Anthropic, and Datadog.

Sources: cognition.com/legal/security, trust.cognition.ai. Editorial vetting, not a compliance certification; verify directly before purchase.

C

Cognition (Devin)

6/7 criteria
Engineering
Vetting last reviewed July 2026

7-Criterion Scorecard

✓
Security Certifications
✓
Public Reference Customers
✓
Pricing Transparency
✓
Data Residency + Training Opt-Out
✓
Outcome Accountability
✓
Time in Market
✓
Team Composition
Gap: Missing ISO 42001 certification (SOC 2 Type II since Sept 2024 and ISO/IEC 27001:2022 both present via trust.cognition.ai; ISO 42001 not yet disclosed as of July 2026)
✓

Public Reference Customers

✓

Pricing Transparency

Public pricing: USD 20 to 200 per month (Pro to Max; Free tier and Teams/Enterprise available)

Model: Subscription tiers + usage-based ACU

devin.ai/pricing
✓

Data Residency and Training Opt-Out

Regions: US

Training opt-out: Yes, available

Retention: Does not train on customer code or data by default; data processed ephemerally and deleted within 90 days of termination; audit logs retained at least one year. Enterprise dedicated deployments keep data in the customer's own cloud tenant (Customer Data Plane).

cognition.com/legal/security
✓

Outcome Accountability

Model: Task-completion benchmarks

Published SWE-bench task completion benchmarks with methodology

cognition.ai
✓

Time in Market

Founded: 2023

Public launch: 2024-03

Customers (min triangulated): 100+

✓

Team Composition

Founders: Scott Wu, Steven Hao, Walden Yan

cognition.com/about

For detailed pricing and comparison data for Engineering vendors, see Agentic Runbook reference.

Vendor at a Glance
Cognition (Devin)
Score6 of 7
VerticalEngineering
Founded2023
PricingPublic
ISO 42001No
SOC 2Yes
ReviewedJuly 2026
Editorial vetting, not compliance certification. Verify before purchase.
← Back to full vendor matrixVetting criteriaMethodologySources