Does Devin sign a BAA?
Not confirmed
Cognition's official Devin pages and trust center do not mention HIPAA or BAAs, so BAA availability is unknown. Cognition lists SOC 2 Type 2 and ISO 27001.
- Business associate
- Cognition
- Tool
- Devin
- Plans with a BAA
- Not stated
- Checked
Not confirmed
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Free / Pro / Max / Teams | Not confirmed | Not stated | The pricing page does not mention HIPAA or BAAs. Paid plans can opt out of training, which turns on zero data retention with model providers.[1],[2] |
| Enterprise (including dedicated / VPC deployments) | Not confirmed | Not stated | Enterprise offers custom terms, and dedicated deployments keep customer data in the customer's tenant. No page addresses BAAs.[1],[3],[4] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Cognition says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Devin autonomous agent, Devin Review, DeepWikiEnterprise (including dedicated / VPC deployments) | Not stated | No official statement on BAA coverage.[3],[4] |
AI coding tools that offer a BAA
- Claude CodeBAA on: Claude Console API key (Commercial org) with zero data retention, Claude Enterprise (HIPAA-ready)Some plans only
- CursorBAA on: EnterpriseSome plans only
- OpenAI CodexBAA on: ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace, OpenAI API (API key sign-in) with Modified RetentionSome plans only
All BAA-ready alternatives to Devin
Sources
- Devin Pricing
- Security at Cognition - Devin Docs
- Enterprise security - Devin Docs
- Cognition Trust Center
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.