Devin (Cognition AI) AI Vendor Risk Profile
Autonomous AI software engineer capable of executing end-to-end coding tasks, from research to deployment. Operates in a sandboxed environment with shell, editor, and browser access.
Visit Devin (Cognition AI) website
Risk overview
Risk score: 34/100
Risk tier: Moderate
Safety rating: 66/100 (higher is better)
Lower risk scores indicate lower assessed risk.
Last verified: Oct 1, 2025 Stale — re-verification queued
Risk dimensions
| Dimension | Risk score |
|---|---|
| Data Handling | 28/100 |
| IP Exposure | 31/100 |
| Jurisdiction | 13/100 |
| Security | 40/100 |
| Regulatory Compliance | 60/100 |
| Transparency | 60/100 |
| Business Stability | 41/100 |
| Dependency Chain | 29/100 |
| Agent Governance | Not assessed |
Analyst summary
Rating: Acceptable
Cognition AI (maker of Devin and, post-July-2025, Windsurf) is one of the most aggressively scaling AI coding companies, with a $10.2B Founders Fund-led round in September 2025 and reports of $25B-valuation talks in early 2026. Compliance posture is appropriate for a young vendor: SOC 2 Type II since September 2024, ISO 27001:2022, dedicated-tenant deployment for Enterprise, and contractual no-training. HIPAA BAA and FedRAMP are not part of the program.
Bottom line: Solid for commercial code workloads with approved LLM data paths; track Windsurf integration and the funding trajectory carefully.
Strengths
- SOC 2 Type II certified since September 2024 plus ISO/IEC 27001:2022
- Enterprise SaaS uses dedicated customer tenants; no training on customer code or data by default
- Subprocessor list (AWS, Azure, OpenAI, Anthropic, Datadog) disclosed via the Cognition trust portal
- Marquee enterprise customers include Goldman Sachs, Citi, Dell, Cisco, Ramp, Palantir
Concerns
- No HIPAA BAA, GDPR DPA program, or FedRAMP authorization disclosed on the public trust portal
- Trust documentation is NDA-gated — customers must sign before reviewing the SOC 2 report and DPA
- Acquired Windsurf in July 2025 in a turbulent transaction that included Google's reverse-acquihire of Windsurf's founders weeks earlier; integration risk is real
- Aggressive valuation trajectory ($4B → $10.2B → reported $25B talks) implies execution and dilution pressure
Best for
- Engineering organizations with approved cloud LLM use that want a leading autonomous-coding agent
- Teams already adopting Windsurf IDE who want first-party Devin integration
- Enterprises comfortable with NDA-gated trust documentation and a sub-2-year-old SOC 2 program
Avoid if
- You need a HIPAA BAA from your AI coding vendor
- You require FedRAMP-authorized AI coding tools
- Your procurement requires multi-year operational track record before granting code-access privileges
Citations
- Data Handling — Trains On User Data
- Security Compliance — Soc2 Type2
- Vendors — Valuation
- Vendors — Data Processing Addendum
- Vendors — Windsurf Acquisition