Is Devin safe for work?
Medium risk · 25Cognition · Coding · facts (medium-confidence)
Devin is medium-risk for default at-work use (25/100): it trains on your data unless you opt out, and holds SOC 2 Type II.
25
Medium risk
Watch out: Devin holds SOC 2 Type II and ISO 27001:2022 with a downloadable DPA and dated all-US subprocessor list. But non-Enterprise customers are opted into model training by default and must turn it off, and there is no EU residency or confirmed BAA.
Data and compliance facts
- Trains on consumer-tier data
- Opt-out
- Trains on business-tier data
- No
- Training opt-out available
- Yes
- SOC 2 Type II
- Yes
- ISO 27001
- Yes
- ISO 42001 (AI management)
- Unverified
- GDPR Data Processing Addendum
- Yes
- HIPAA BAA
- Unverified
- EU data residency
- No
- SSO / SAML
- Yes
- Data retention
- Zero Data Retention available once training opt-out is elected; post-termination deletion window stated inconsistently across Cognition's pages (30 vs 90 days).
- Safer tier
- Enterprise (no-training-without-consent guarantee plus tenant-isolated or VPC deployment)
Why it scores 25 out of 100
- +16Trains on your data. Training is on by default on the consumer tier; you must find and set the opt-out.
- +9EU data residency. Whether data can be kept in the EU.