Enterprise AI Coding Agents Show Split on IP Indemnity and Data Residency
A MarkTechPost review of GitHub Copilot, AWS Kiro, Cursor, Devin and Windsurf finds differences in IP indemnity, prompt retention and data residency that procurement and legal teams must address before enterprise rollouts.
The report says the five brands are really four contracts because Cognition acquired Windsurf. On June 2, 2026, Cognition renamed the Windsurf editor Devin Desktop. Devin and Windsurf now sit on one pricing table and one set of terms.
On IP indemnity, GitHub Copilot Business and Enterprise offer 'uncapped IP indemnification for unmodified outputs' under the Copilot Product Specific Terms or Microsoft Product Terms, according to the Copilot Trust Center. The trust center says this covers unmodified code from the Copilot coding agent. A duplicate detection filter is no longer required as of April 3, 2026, but free, Pro, Pro+ and Max plans are excluded.
AWS Kiro offers indemnity for its output under the AWS Customer Agreement and AWS Service Terms, the report says. Kiro Enterprise states that the protection covers copyright claims on output and is uncapped for copyright claims per the AWS Bedrock FAQ. The conditions include no infringing inputs and not disabling service filtering features; the free tier is not covered.
Cursor's business terms, in a master service agreement updated August 13, 2026, defend claims 'that the Service or any Suggestion infringes or misappropriates' third-party IP, with Suggestions named explicitly. Indemnity is carved out of the 12-month fee cap. Exclusions apply if modified or combined code causes the claim, if filters are disabled, or if the customer knew the output likely infringed.
Cognition's enterprise terms for Devin and Devin Desktop, updated June 8, 2026, defend claims that the services infringe patents, copyrights or trade secrets but exclude Customer Data 'including Outputs.' The report says generated code therefore falls inside excluded Customer Data, meaning outputs are not covered. Indemnity is capped at two times fees paid in the prior 12 months. An executed order form controls over the MSA, so the report says this must be negotiated there.
Cognition's Pro, Max and Teams plans use Platform Terms updated June 30, 2026. Indemnity 'applies only to Customers on the Paid Service Tiers,' and the same Customer Data exclusion applies. The cap is the greater of six months of fees or US$100. Free-tier users receive no indemnity.
The report says Microsoft's April 3, 2026, change to Copilot indemnity terms matters more than any feature launch. Before the change, one admin setting could void coverage; Microsoft's required-mitigations page now lists no additional mitigations for GitHub offerings. The remaining limit is the word 'unmodified,' and the report says most shipped code gets edited, so counsel must assess how far edits move code outside scope.
AWS Kiro inherits AWS's generative AI indemnity, which AWS describes as uncapped for copyright claims on output from services listed in Section 50.10. Coverage drops if inputs infringe or if filtering features are disabled. Kiro says paid subscribers ship with the protection included.
Cursor's MSA is the broadest on paper, the report says, because it names Suggestions and removes indemnity from the fee cap. Exclusions still apply when a claim relates to a modification or unapproved combination. The consumer terms of service run the other way: users indemnify Anysphere.
Cognition is described as the outlier. Its MSA defines Customer Data to include Outputs, then excludes Customer Data from indemnity. Generated code sits outside the standard promise, and indemnity is capped at two times trailing 12-month fees. The report says any Devin or Devin Desktop rollout needs this fixed in the order form.
On data residency and prompt storage, GitHub Copilot Business and Enterprise plans do not retain IDE chat and completion prompts, according to the plans FAQ. Prompts from other surfaces such as github.com, mobile and CLI are retained for 28 days. User engagement data is kept for two years. GitHub does not train on Business or Enterprise data. Enterprises on GitHub Enterprise Cloud with data residency can pin Copilot inference to the United States or the European Union; the policy adds 10% to AI credit consumption, and each region exposes a narrower model list.
AWS Kiro's data protection page says enterprise content is never used for service improvement. It is stored in the region where the Kiro profile is configured. Inference stays inside the US or Europe geography, except for models tagged experimental. Administrators can encrypt data with customer-managed KMS keys.