Devin

The docs describe no export of a Devin agent and no importer or runtime outside Cognition's service. Skills can be read through the API and uploaded plugins downloaded as .zip files, but no restore target the provider does not operate exists. Outposts runs only tool execution locally; the agent loop stays in Devin's cloud.

• Devin Outposts overview
• Knowledge (skills API)
• Devin API index

There is no export bundle. Session history, schedules, automations, secrets, repository indexes and environment snapshots all stay with the provider. Only some pieces (skills, plugin zips, session messages) can be fetched one at a time through the UI or API.

• Devin API index
• Devin plugins and the Customize page

The agent needs a Cognition account and a running Cognition service to start or act. Inference and planning run in Devin's cloud even with Outposts. The ToS grants only a non-transferable right to access the Services 'during the Term'.

• Platform Terms of Service §2.1, §7.2
• Devin Outposts overview

The owner can pick only from a model catalogue that Cognition curates and serves (Anthropic, OpenAI, Google, Cognition and some hosted open models). No custom endpoint or local open-weight model is documented, so model choice depends on the provider. Linking a ChatGPT plan changes billing only.

• Devin CLI Models
• Your First Session (agent selector)
• Use your ChatGPT plan in Devin

Cognition may suspend or terminate at any time, including 'for any other reason'. On termination it 'may at our option delete any Customer Data'. No post-termination export window or shutdown plan is published, and state is held in the cloud rather than by the owner.

• Platform Terms of Service §2.4, §7.2

Main agent state (sessions and worklogs, memory, schedules, automations) can be read only through Cognition's web app or API, and Cognition holds the encryption keys (AWS KMS). Skills are readable SKILL.md text, but that covers only part of the state.

• Data Processing Addendum, Annex II
• Knowledge

Two shortfalls. (1) The docs describe no way to view Devin's base system prompt or the fully assembled context. (2) The default 'Devin' agent's model identity is not stated, and short model names resolve to 'the latest version'.

• Your First Session (agent selector)
• Devin CLI Models

Retention is open-ended. Personal data is kept 'as needed'. 'Feedback Data and User Interaction Data are retained as long as needed and as determined by Cognition'. Cognition owns Usage Data outright. None of this is visible item by item.

• Security at Cognition (data retention)
• Privacy Policy §5
• Platform Terms of Service §3.3.2

No paid placement was found. First-party defaults (the default Devin agent, the recommended Fusion mode, promoted SWE-2 and the official marketplace) are visible and can be replaced. No binding commitment against steering exists, so absence rests on non-binding evidence only.

• Devin pricing
• Devin plugins and the Customize page

Sessions keep a worklog of shell commands and tool steps. Audit logs, which cover admin, settings and provider-side events, need enterprise permissions, so a Pro owner has no record of provider or staff actions. No alert is documented for when recording fails, and hooks are 'best effort'. That is two shortfalls.

• List Organization Audit Logs (enterprise permission)
• Devin API v3 permissions overview
• Devin plugins (Hooks)

No integrity data (hash chaining, signatures or an owner-held checkpoint) is documented for session worklogs or audit logs. The record holder can change the record without trace.

• Devin API index
• Security at Cognition

The worklog is produced by the hosted platform, outside the agent's VM. But by default the agent has the built-in Devin MCP with write access to session management (child sessions, schedules, knowledge). Making it read-only needs a non-default security profile, and no document says the agent cannot archive or suppress its own record.

• Security Profiles (Devin MCP access)
• Advanced Capabilities

Required components (the hosted agent service and the Outposts control plane) are closed source. The ToS forbids copying, modifying or reverse engineering the Services.

• Platform Terms of Service §2.3, §3.1

The agent acts through provider-issued identities: the Cognition account and Devin's GitHub App / Slack app. Cognition can revoke or reissue these. No identity root is held by the owner.

• Devin GitHub integration
• Secrets & Site Cookies

Plugins (skills, rules, hooks, MCPs) have version history with diffs, and every save can be restored. The docs describe no change history or restore for other state: knowledge, secrets, settings, model or runtime version. Settings audit logs are enterprise-only.

• Devin plugins and the Customize page
• Release notes 2026 (plugin version history)

The owner can add and edit skills, rules, playbooks, AGENTS.md and plugins. Devin's base system prompt and built-in agent behaviour cannot be replaced.

• Devin Skills
• Creating Playbooks
• AGENTS.md files for Devin

Knowledge (now migrating to Skills) is itemised and can be edited, disabled and deleted. The repository index Devin reuses across sessions is not itemised or editable; the only option is removing a repository from indexing.

• Knowledge
• Devin API index (remove repository from indexing)

The owner can connect custom MCP servers and plugins, from any repository or by upload, without provider review. No documented setting removes built-in tools (shell, browser, editor, Devin MCP) in cloud sessions.

• Devin MCP servers and marketplace
• Devin plugins and the Customize page

The owner can opt out of optional security profiles. Provider-imposed protections cannot be changed: automated safety and abuse classifiers (ToS §3.3.3) and the provider-managed session VM. Because no exit route exists, these do not fall under the hosted-policy carve-out.

• Platform Terms of Service §3.3.3
• Security Profiles

The Services are 'subject to modification and change, in Cognition's sole discretion'. Model aliases resolve to the latest version, and new agent behaviours roll out server-side (release notes). There is no pinning of the cloud runtime, agent or model.

• Platform Terms of Service §2.5
• Devin CLI Models
• Release notes 2026

Security profiles offer per-domain network allowlists, per-server MCP allowlists, git read-only/full access and session spending limits. Two shortfalls remain. (1) Tool scope is coarse: built-in shell and browser cannot be scoped, and MCP is per server, not per tool. (2) By default the agent has write access to its own configuration through the Devin MCP, and no document shows that self-edits cannot widen its limits.

• Security Profiles
• Self-serve plans (session spending limits)

Only a fixed set of actions can be gated: network-destination requests, plugin/MCP/skill changes and installs, and the git read-only level. Cloud hooks are 'best effort', so the owner cannot gate arbitrary action classes.

• Security Profiles
• Devin plugins (Hooks)

Individual sessions can be stopped or terminated, and terminating with archive sleeps descendant sessions. Schedules and automations have to be paused separately, and there is no documented single global stop.

• Terminate Session API
• Scheduled Sessions
• Automations

'By default, we may use your data for model training.' Opting out is available only on paid tiers. Data-term changes apply through continued use after 30 days' notice, and flagged content may be kept for safety review.

• Platform Terms of Service §3.3, §12.4
• Security at Cognition (data use)

Secrets can be listed, viewed by admins and deleted one by one. The ChatGPT link and GitHub App grants can be revoked. No document says the provider keeps no copy after revocation, or limits provider use of credentials to owner-directed actions, so a pass is withheld (G12).

• Secrets & Site Cookies
• Use your ChatGPT plan in Devin

No one-step, owner-initiated account deletion is documented. Erasure goes by request to privacy@cognition.ai, with no stated completion limit or confirmation. The DPA gives 30 days for subprocessor deletion after termination.

• Privacy Policy §8
• Data Processing Addendum §11