Is Devin safe with your data?

Training opt-out is paywalled

Customer Data may be used for model training and to improve the Services, and the opt-out is available only to subscribers on a paid Service Tier. On the Teams tier only an administrator can exercise it, so individual users cannot opt out for themselves.

Zero retention is conditional, not default

Zero Data Retention is defined as data never saved to disk and deleted once the Output is generated, but it switches on only after a paid-tier opt-out. The default retention rule is to keep information "as needed" with no stated number of days, and no deletion timeline follows account closure.

No named security controls or certification

Security is described only as "commercially reasonable technical, administrative, and organizational measures." No encryption standard, access-control model, or audit certification is named, and breach notice is promised only "as necessary to comply with applicable privacy laws.

Ownership granted, broad licence retained

Customers own their data and Outputs are assigned to them, yet the same terms take a worldwide, sublicensable, transferable licence over Customer Data. The stated age gate also conflicts: the privacy policy says 18 while the terms say 13.