Graded B on resilience. In Vannus's assessment it has not disclosed which model it runs — resilient — owns model IP or routes across providers.
Autonomous AI software engineer from Cognition for code migrations, refactoring, PR review, bug fixing and documentation. Delivered as Devin Cloud, Devin Desktop, Devin CLI, a Devin Windows VM, and Devin Enterprise. The privacy policy names the entity as "Cognition AI, Inc" but publishes no registered address or country, so country of origin is recorded as not disclosed.
Not disclosed. Devin does not publish which model it runs, so this criterion is excluded and the grade rests on what we could verify. We say so rather than guess.
Not yet assessed. We publish a sovereignty position only where the vendor documents one — we do not infer it from a domain or a company name.
Vannus grades Devin against nine dimensions of trust — data sovereignty, training privacy, compliance posture, operational resilience, exit portability, and more. The heaviest criterion asks whether the tool builds its own AI or resells someone else's model; where the vendor discloses it, the grade cites the vendor's own documentation. No paid placements — scoring is walled off from affiliate revenue. See the methodology →