Devin Cloud

Delegate coding work to cloud sessions that can push branches and open PRs. Configured automations add scheduled or event-driven work; they don't remove your responsibility for spending, permissions and review.

No product visual on file

Choose it when

You want reviewable branch/PR work, or configured automations that start new sessions or feed events into an existing one, with activity logs and optional failure email.

Skip it when

You need local-only processing, a blanket no-training/no-retention promise, or a service that guarantees recovery without an operator. This dossier covers Cloud, not CLI, Desktop or self-operated Outposts.

01 / Classification

Autonomy evidence

This is our classification, not a vendor badge. The record says what the product normally does. The gaps stay visible.

How we classify it

Tool use + multi-step plans, still human-gated per session.

Runs unattended

Yes — that capability is documented in this brief.

Trigger

Normal use is a user-delegated coding session. Unattended applies only to configured automations: schedule/event triggers start new sessions or message a selected persistent session. The user/organization operator must own trigger scope, spending, failure notifications and recovery.

State

Automations can message an existing long-running session to maintain context across events; activity history links invocations to sessions and errors. Optional preflight cursor/dedup state is separate from session state, not guaranteed memory or recovery.

Tools

Cloud sessions can change code, run work in their VM, push branches/open PRs with Full git access, and use permitted MCP integrations. Optional security profiles can restrict network/MCP/git access or remove the GitHub CLI token; this isn't universal human approval before writes.

Human control

Operators configure and disable automations, spending/invocation/queue controls and optional failure email. Mandatory security profiles set floors; recommended defaults permit opt-outs. Humans still own diff review, branch protection and recovery; boot/wake policy updates aren't immediate revocation on a running session.

02 / Operations

Control reality

Useful agents eventually touch something real. This is the operational picture we have, not a promise hidden in a sales page.

Where it runs

Cloud sessions run on Devin-managed VMs. This record does not transfer CLI permission modes, Desktop behavior or Cloud firewall enforcement to self-operated Outposts.

Data boundary

Cognition may train on data by default. Paid users can opt out; Teams requires an admin, and Enterprise training requires prior written consent. Provider ZDR after opt-out is not zero retention at Cognition: customer data is retained for the relationship unless specified otherwise, with feedback/interaction data retained as Cognition determines.

Identity & permissions

Use dedicated least-privilege service credentials. Global organization secrets are usable by all members; personal, repository and session scopes narrow availability. Security profiles independently control MCP, git and optional gh-token access; admin-only secret visibility isn't an exclusive-use boundary.

What it can write

Session workspace/code changes · Git branches and pull requests when Full git access is granted · Messages to trigger Slack channels in configured automations

Surfaces

Delegated Cloud coding sessions · Configured Cloud automations

Export / lock-in

Branches and PRs are concrete reviewable outputs when git writes are permitted; the security docs describe output as the user's IP, with a competing-model-training restriction. Full session/account export and portability are unassessed.

03 / Receipts

Evidence ledger

Here is what this brief is built on. “Documented” means we found a source. “Tested” means this desk actually ran it. Those are different things.

Evidence status

documented

Source set

8 primary sources

Evidence review

2026-10-20

Sources on file

Corrections

Not recorded yet. If we change a material claim, the correction belongs here.

04 / Change log

Related coverage

The brief tells you what the product is. Payloads track the changes that may alter the decision.

No linked change coverage on file yet.