Devin Review: What to Settle Before Delegating Tickets to a Cloud Agent

Settle training and retention first

On self-serve plans Cognition may use your data for model training by default. An admin on a paid plan can opt out in Data Controls, which also turns on zero data retention with model providers. On Teams only an admin can opt out. Enterprise data is not used for training without written consent, and Cognition has held SOC 2 Type II since September 2024.

Scope repository access

The GitHub app reaches all repositories or a selected list, and users who link their GitHub accounts can have pull requests open under their own name. Cognition recommends branch protection so required checks pass before Devin can merge. Admin security profiles can limit a session's network, MCP, and git access. For urgent runtime patches, Cognition publishes a free open-source Vulnerability Fixes plugin, first released for the Oct 21, 2026 PHP, Node.js, and GitLab advisories. Devin inventories affected repositories read-only, waits for approval, and opens one tested pull request per repository.

Put a ceiling on usage

Self-serve admins set auto-reload thresholds and default session spending limits under Usage & limits. Enterprise admins cap ACUs per organization and per user, and anyone can see a session's cost in Session Insights. Sessions sleep after 30 idle minutes and consume nothing while asleep.

Choose where sessions run

Enterprise Cloud runs each session on its own isolated machine in Cognition's multi-tenant cloud. A Customer Dedicated Deployment runs sessions in a single-tenant VPC reached over AWS PrivateLink, and Outposts executes commands on machines you operate while planning stays in Cognition's cloud.

Measure what sessions deliver

Answer.AI's month of testing, published January 8, 2025, ended with 3 successes in 20 tasks, and its team found no pattern to predict which tasks would work. Cognition reports that 67% of Devin's pull requests were merged in its 2025 review, up from 34% a year earlier. Cognition's estimator, launched June 4, 2026, scores each finished session for useful output and the hours an engineer would have spent on it. It counts a session whose pull requests went unmerged as not useful. Enterprise contracts carry Cognition's AI Productivity Guarantee: if that value falls short of spend near the end of the annual contract, Cognition issues credits up to US$10M.

Review what comes back

Devin Review sorts its findings into probable bugs in red, warnings in yellow, and FYI notes in gray. Cognition's own 2025 review says human review is still necessary, because code quality is not straightforwardly verifiable, so keep a named human reviewer on every repository.

Place Devin Desktop correctly

Windsurf became Devin Desktop on June 2, 2026, with the same editor, settings, and plan pricing. On Teams, Devin Desktop comes with a full seat. Flex seats draw only on shared credits and do not include it.