Devin AI Security for Enterprise Engineering Teams
Devin works like a contractor with a laptop: it clones repositories, runs commands in its own machine, opens pull requests and acts in Slack and ticket tools with the credentials you hand it. Cognition documents a credible vendor posture. This page reads those docs, shows where each control stops, and says when a team needs a second one.
Direct answer
Devin AI security for enterprises rests on Cognition's SOC 2 Type II certification, encryption in transit and at rest, a secrets manager that keeps credentials out of the chat view, no training on customer data by default, and an Enterprise VPC option that keeps customer data in the customer's tenant. Those controls cover the vendor and the environment. They do not judge whether an action Devin is allowed to take, such as merging, deploying or changing a record, should run after it read hostile text.
Try it live
Watch AgentShield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Runs the live engine on your text. Nothing is stored, no account needed.
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
The risk
A platform team gives Devin a GitHub app, a Slack install and a ticketing token so it can turn tickets into pull requests. A ticket description written by an outside customer says to also rotate a key and post the new value in the thread. Every credential Devin used was one the admin approved. Nobody decided that this particular call was wrong, and the vendor certification says nothing about it.
How AgentShield handles it
Start with the vendor certification, the secrets manager and the integration permissions, because they cover the contract and the machine. Then route the agent calls that reach systems of record through an AgentShield gateway. Rules check the arguments of each call, hold deploys, bulk changes and access grants for a named approver, and write one attributed record of what was allowed, denied and approved.
The controls
The controls that secure which tools, repositories and production actions a Devin session may touch, and which ones wait for a named approver.
What Cognition documents for Devin security
The honest summary is that Devin comes with a solid vendor security posture and sensible integration permissions, and it leaves the decision about each downstream action to your own tooling. The facts below come from Cognition's published security documentation on docs.devin.ai, read on November 4, 2026. Check the current pages and the trust center before you sign anything.
| Control | What the documentation says | Where it stops |
|---|---|---|
| Certification | Cognition states it has been SOC 2 Type II certified since September 2024, with data encrypted in transit and at rest | Covers the vendor's operations, not your agent's actions |
| Training on your data | By default Cognition does not train its models on customer data or code | A vendor policy, so confirm it in your order form |
| Secrets manager | Credentials such as API keys and passwords go through a secrets manager in Settings instead of being pasted into chat | Protects the value, not what the session does with it |
| Integration permissions | The administrator who installs the GitHub or Slack integration can review and manage the permissions Devin receives | Scopes are broad by nature, so a pull request token can still push a bad change |
| Enterprise VPC | For dedicated deployments, customer data is stored within the customer's tenant | Where data lives, not which actions are allowed |
| Data retention | Data processed through Devin is kept for the duration of the customer relationship unless agreed otherwise | Negotiate this term if your policy is shorter |
The security pages we read do not describe audit logs, role based access, single sign-on or IP allow lists, and point readers to the trust center. Ask for those in writing during procurement.
Where Devin security controls stop
None of these gaps is a flaw in the product. They are the normal shape of any control that sits at the vendor, where the decision is made before the agent has read the specific text that will steer it.
| Gap | Why it matters in a rollout |
|---|---|
| Approved integrations act with their full scopes | An injected instruction that reaches an allowed token inherits everything the token can do |
| Tickets, pull request comments and web pages are untrusted input | Devin reads them to do the job, and so can an attacker who can write to them |
| A secrets manager hides values, not use | A session can still use a stored credential to call a service in a way nobody intended |
| Vendor certification is not your audit | Your auditor tests who approved a production change, which a SOC 2 report cannot show |
| Long running autonomous sessions | A task that runs for hours makes many calls, and a reviewer sees only the final pull request |
The same questions apply to the other coding agents your engineers may run, covered on Windsurf security, Claude Code enterprise security and the wider coding agents page.
Devin enterprise security checklist for US platform and security teams
- Request the SOC 2 Type II report from the trust center and read the exceptions.
- Confirm in the order form that training on your code is off and that the retention term matches your policy.
- Put every credential in the secrets manager and give each integration the narrowest scope that lets the task work.
- Give Devin its own service accounts, never a person's token, so its actions can be told apart in logs.
- Turn on branch protection and required reviews on every repository Devin can push to.
- Decide, in writing, which production actions an agent may never take alone. Deploys, payments, access grants and bulk deletes are the usual list.
- Ask the vendor for audit log, single sign-on and VPC terms, since the security pages do not document them.
Steps one to five cost administration time. Step six is the one that needs a mechanism, and it is where teams look for a second control.
Where a second control earns its place
An AgentShield gateway sits on the paths your agents use to reach systems of record, such as a deploy API, a ticket system, a database tool or a payment service. It does not replace Cognition's controls. It adds a decision on each action, outside the model and outside the agent's machine.
| Risk | Devin control | Second control |
|---|---|---|
| Credential pasted into a chat | Secrets manager | None needed. Use the manager |
| Vendor handles code carelessly | SOC 2, no training by default, VPC option | None needed. Check the report |
| Injected text triggers a production deploy | Approved integration, so it runs | Rule on the target and arguments, held for a named approver |
| Bulk change to tickets, records or repositories | Integration permission only | Count limit per run and per day, approval above it |
| Customer data leaves in a tool call | None documented | Content scan on outbound arguments |
| Proof for a customer security review | Vendor certification | One attributed record of allowed, denied and approved actions |
The gateway works for calls you route through it, such as tools reached through an MCP endpoint or internal APIs. It cannot sit inside a vendor service that talks straight to a third party, so for those the integration scopes and branch protection remain your control. The enforcement mechanics are on tool permissions and the approval flow on human in the loop AI agents.
When to buy nothing, use Devin controls, or add AgentShield
| Your situation | What to do |
|---|---|
| Devin opens pull requests on one repository behind required reviews | Buy nothing. Branch protection and the vendor certification are enough |
| You need to keep code inside your own cloud | Ask Cognition about the Enterprise VPC deployment |
| You need a vendor assurance report for procurement | Request the SOC 2 report from the trust center |
| Devin calls deploy, billing, identity or customer data tools | Add argument rules and approval on those calls |
| An auditor wants proof of who approved what | Add the gateway record |
Three of five rows end without a purchase from us. That is deliberate, because a control you do not need is not worth selling.
FAQ
Common questions about devin security.
Is Devin AI secure for enterprise use?
Devin is backed by Cognition's SOC 2 Type II certification, encryption in transit and at rest, a secrets manager, no training on customer data by default, and an Enterprise VPC option. Those cover the vendor and the environment. They do not decide whether an approved action, such as a deploy or a records change, should run, so high-impact calls need a separate control.
Is Devin SOC 2 compliant?
Cognition states that it has been SOC 2 Type II certified since September 2024. Request the report from the vendor trust center and read the exceptions. The certification covers the vendor's own operations, not how your agents use their access, which your auditor tests separately.
Does Devin train on my code?
Cognition states that by default it does not train its models on customer data or code. Confirm that in your order form rather than relying on a default, and check the data retention term, which keeps data for the duration of the customer relationship unless agreed otherwise.
How does Devin handle secrets and credentials?
Devin has a secrets manager in Settings for API keys and passwords, and the documentation recommends it over pasting values into chat. It protects the stored value. It does not limit what a session does with a credential it is allowed to use, which is why action level rules matter.
Can Devin be hijacked by prompt injection?
Any agent that reads tickets, pull request comments or web pages can be steered by hostile text in them. Integration scopes and branch protection limit what it can reach, but an approved call can still be misused. Rules on tool call arguments, with approval for risky actions, limit the damage when the model is fooled.
Does AgentShield work with Devin?
Yes, for tool and API calls routed through a gateway endpoint, where it checks the arguments of each call and holds risky ones for approval. It does not replace Cognition's controls and cannot intercept traffic that a vendor service sends straight to a third party.
More use cases