Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
“Cognition only retains data processed through Devin for the duration of the relationship with a given Customer, unless otherwise specified by the Customers.”
“By default, we may use your data for model training purposes to improve and enhance the Services.”
“The output — code, work product, or other — produced by Devin is considered the user's intellectual property and can be used for the Customer's commercial purposes...”
“If you are an Enterprise customer, we will never train on your data without your express prior written consent.”
“Any Feedback Data and User Interaction Data are retained as long as needed and as determined by Cognition.”
“...with the exception of using the output to train models that would attempt to reverse engineer and/or build a competing product to Devin.”
This document explains how Windsurf collects, uses, and keeps your data when you use the Devin product. By default, your data may be used to train Windsurf's models, but if you are on a paid plan you can turn this off at any time in Data Controls. Code and other output that Devin produces belongs to you and can be used for commercial purposes, though you cannot use it to build a competing product or reverse-engineer Devin.
This document establishes Windsurf's data handling, retention, and usage obligations with respect to its Devin product and associated services. By default, Windsurf may use customer data for model training to improve its services, though paid plan users may opt out at any time via Data Controls, which also triggers Zero Data Retention with Windsurf's model providers; Enterprise customers are fully protected by an absolute prohibition on model training absent express prior written consent. Windsurf retains Feedback Data and User Interaction Data for as long as it unilaterally determines necessary, while data processed through Devin is retained only for the duration of the customer relationship unless the customer specifies otherwise. Output produced by Devin is treated as the customer's intellectual property available for commercial use, subject to a carve-out prohibiting its use to reverse-engineer Devin or build a competing product. Windsurf applies a least-privilege access model to its AWS production environment and limits Devin's Slack data access to information explicitly shared within tagged interactions.
As an ordinary user, your data is used by default for model training to improve Windsurf's services. If you are on a paid plan, you can opt out of this at any time by going to the Data Controls settings page, which will stop your data from being used for training and enable Zero Data Retention with Windsurf's model providers. Windsurf retains Feedback Data and User Interaction Data for as long as it determines necessary, with no fixed maximum period. Devin's output belongs to you for commercial use, but you may not use it to reverse-engineer Devin or create a competing product.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
1 important change detected
9 versions captured · Latest change detected by ConductAtlas: July 2026
We withheld clauses we had published from this document. Each withholding is recorded in our correction log:
“Cognition only retains data processed through Devin for the duration of the relationship with a given Customer, unless otherwise specified by the Customers.”
“By default, we may use your data for model training purposes to improve and enhance the Services.”
“The output — code, work product, or other — produced by Devin is considered the user's intellectual property and can be used for the Customer's commercial purposes...”
“If you are an Enterprise customer, we will never train on your data without your express prior written consent.”
“Any Feedback Data and User Interaction Data are retained as long as needed and as determined by Cognition.”
“...with the exception of using the output to train models that would attempt to reverse engineer and/or build a competing product to Devin.”
“If you're on a paid plan, you can opt out at any time on the Data Controls settings page. After you opt out, your data will not be used for training and Zero Data Retention will be enabled with our …”
“Access to our cloud environment in AWS is granted on an as-required basis based on business roles and only a small number of employees or contractors are granted direct access to production systems.”
“enabling branch protections to ensure checks are enforced before Devin can merge any changes, and any practices currently adopted in your organization to review engineers' work.”
“In all cases we advise users to leverage our Secrets feature under the Settings page to share and store those credentials securely.”
“Troubleshoot, prevent and resolve issues such as product-related issues, software bugs or security incidents to maintain service functionality and reliability.”
“In Slack, Devin doesn't read, process or store any data in your Slack instance other than the information provided when @Devin is tagged, initially prompted and when any additional information is provided within the Slack thread...”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
Windsurf has updated this document before. Monitor includes same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle Data retained only for duration of customer relationship and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 352+ platforms.