Security at Cognition

We want Devin to be a core contributor in your organization, and have prioritized security, data privacy and compliance to make it possible

Security

Secure Transmission and Encryption

All data transmission is encrypted in transit and at rest. Production software is also routinely monitored via logging, error handling and monitoring dashboards of live metrics. Unusual application states (ie. unusually high error rates, slowness, failures) trigger alerts which are quickly investigated by our team.

Access to our cloud environment in AWS is granted on an as-required basis based on business roles and only a small number of employees or contractors are granted direct access to production systems.

General Security Practices

All employees and contractors are required to use multi-factor authentication on all main work applications. All employees and contractors also receive annual training about security best practices, including good password management and how to identify social engineering and phishing scams.

Third-party audits and certification

Cognition obtained SOC 2 Type II certification and conducted Security Training in March 2024 for all employees at Cognition. As part of the SOC 2 audit, Cognition’s auditors reviewed all of Cognition’s security policies, procedures, internal and third party controls related to data security, privacy, processing integrity, confidentiality and availability.

For more details about our security please visit our Trust Center.

Vulnerability Disclosure Program

If you have identified a potential security issue, we encourage you to share your findings with us. Please send your vulnerability reports to our security team at [e-mail].

Privacy & Intellectual Property

How does Cognition use and process data run through and/or accessed by Devin?

Cognition processes data based on the application Customers use to interact with Devin. Devin can be accessed via web application, Github or Slack integration. For the web application, Cognition only processes data actively provided by the authorized user prompting Devin; for the Github and Slack integrations, the administrator installing the integration can review and manage all permissions granted to Devin.

Cognition uses Customer data to:

• Deliver, maintain and update services provided to the Customer per their configuration and type of Devin access (e.g. web application, Github integration or Slack integration) to make sure the software is up-to-date and operational.
• Troubleshoot, prevent and resolve issues such as product-related issues, software bugs or security incidents to maintain service functionality and reliability.

What data retention policy does Cognition maintain?

Cognition only retains data processed through Devin for the duration of the relationship with a given Customer, unless otherwise specified by the Customers.

Any Feedback Data and User Interaction Data are retained as long as needed and as determined by Cognition.

How is your data used to improve Devin?

By default, we do not use any of your data for model training purposes unless you explicitly opt-in in the Data Controls settings page. Devin can still learn to fit into your unique workflow via the Knowledge feature. When you share Knowledge, Devin can become more reliable at working on your specific projects over time.

If you are an Enterprise customer, we will never train on your data. Please refer to the terms in your agreement with Cognition for details.

What are the main IP considerations regarding the output produced by Devin?

The output — code, work product, or other — produced by Devin is considered the user’s intellectual property and can be used for the Customer’s commercial purposes, with the exception of using the output to train models that would attempt to reverse engineer and/or build a competing product to Devin.

Github Integration Considerations

When setting up the Github integration, users can select which repositories Devin can access, with permissions adjustable through Github’s App Settings during and post-installation.

For more details on the requested permissions and security considerations go to GitHub Integration Guide.

Slack Integration Considerations

In Slack, Devin doesn’t read, process or store any data in your Slack instance other than the information provided when @Devin is tagged, initially prompted and when any additional information provided within the Slack thread while the session is ongoing.

For more details on the requested permissions and security considerations go to Slack Integration Guide.

User Best Practices

Devin Limitations

While Devin’s performance is improving daily, it can still experience hallucinations, introduce bugs into code, or suggest insecure code or procedures. Like with any coding best practices, we recommend taking the appropriate precautions with the code written by Devin such as code reviews, enabling branch protections to ensure checks are enforced before Devin can merge any changes, and any practices currently adopted in your organization to review engineers’ work.

Secrets

You may need to provide Devin with credentials and keys such as passwords, API keys, cookies or other for authentication. In all cases we advise users to leverage our Secrets feature under the Settings page to share and store those credentials securely.

Share Feedback

We’re still learning and developing Devin to be a great AI software engineer, and our customers’ feedback is crucial for Devin’s development. We strongly encourage sharing feedback and feature requests directly with your Cognition account team or by emailing [e-mail], and reporting incidents by emailing [e-mail].