Our comprehensive guide to leading AI coding agents detailed each tool’s functions and ideal use cases. This article is crafted for procurement leads, general counsel, and security reviewers charged with enterprise rollouts.
Key questions to address before adoption:
- Who indemnifies generated code if an IP infringement claim arises?
- Where are prompts and inputs stored, and for how long?
- What audit logs and administrative controls are provided?
- What is the true cost for 500 seats?
We reviewed the current contract language for GitHub Copilot, AWS Kiro, Cursor, Devin, and Windsurf—cross-checking each vendor’s published terms as of September 26, 2026. This summary is informational, not legal advice. Please consult counsel on your final agreements.
Unified Terms for Devin Desktop & Windsurf
Cognition’s acquisition of Windsurf culminated in a June 2, 2026 rebranding to Devin Desktop (announcement). Both products now share a single pricing table and unified service terms.
IP Indemnity Matrix
The indemnity clause can stall enterprise adoption. Below is a vendor-by-vendor breakdown, based on each provider’s governing contract.
| Vendor (Plan) | Governing Contract | Coverage Summary | Generated Code? | Cap | Key Conditions |
|---|---|---|---|---|---|
| GitHub Copilot (Business, Enterprise) | Copilot Product Terms or Microsoft Product Terms | Uncapped indemnity for unmodified outputs (Trust Center FAQ) | Yes | Uncapped | Duplicate Detection filter optional since April 3, 2026; excludes Free, Pro, Pro+, Max |
| AWS Kiro (Pro, Pro+, Pro Max, Power) | AWS Customer Agreement & Service Terms | Indemnity for service output (Kiro Enterprise) | Yes (copyright) | Uncapped for copyright claims | No infringing inputs; filters must remain on; Free tier excluded |
| Cursor (Business) | Cursor MSA (Aug 13, 2026) | Defends claims that any Suggestion infringes third-party IP | Yes (Suggestions) | Outside 12-month fee cap | Excludes modified/combined code, disabled filters, known risks |
| Cognition: Devin & Devin Desktop (Enterprise) | Cognition MSA (Jun 8, 2026) | Defends patent, copyright, trade secret claims—excludes Customer Data defined as “Outputs” | No | 2× prior 12-month fees | Order form overrides MSA; negotiate to include Outputs |
| Cognition (Pro, Max, Teams) | Platform Terms (Jun 30, 2026) | Indemnity only on paid tiers; Customer Data exclusion applies | No | Greater of 6 months’ fees or US$100 | Free tier gets no indemnity |
Axis 1: Legal Exposure on Generated Code
GitHub Copilot: Coverage applies strictly to unmodified code outputs. Since April 3, 2026, no additional mitigations (e.g., Duplicate Detection) are mandatory. Modifications may affect indemnity—confirm with counsel.
AWS Kiro: Offers AWS’s uncapped copyright indemnity for outputs. Coverage requires non-infringing inputs and enabled filters. Automatically included for paid tiers.
Cursor: MSA explicitly covers “Suggestions” outside the fee cap. Exclusions apply if you modify code, disable filters, or knowingly introduce infringing content. Consumer terms reverse this.
Cognition (Devin, Windsurf): Defines Outputs as Customer Data, which is excluded from indemnity. Indemnity must be renegotiated in the order form and remains capped at twice the prior 12-month fees.
Axis 2: Prompt Storage & Data Residency
GitHub Copilot: IDE chat prompts are not retained. Prompts via github.com, mobile, CLI are stored 28 days; engagement metadata kept 2 years. No enterprise training. Data residency (US/EU) available via Enterprise Cloud (+10% credits).
AWS Kiro: Enterprise content is never used for model training. Data resides in your AWS region; inference stays within US or Europe (experimental models may differ). Supports customer-managed KMS encryption.
Cursor: Privacy Mode enforces zero data retention with model providers and no training. Files are client-side encrypted, temporary cache only. No public region-selection option; all traffic flows through Cursor backend.
Cognition: MSA forbids training on Customer Data absent written consent. Enterprise Dedicated Deployment runs the devbox in a single-tenant VPC via AWS PrivateLink; reasoning remains in Cognition’s cloud. Self-serve tiers train until opt-out; on Teams only admins can opt out.
Axis 3: Audit Logging & Admin Controls
GitHub Copilot: Enterprise audit logs record action:copilot and actor:Copilot events for 180 days (docs). Prompts from local IDE are excluded. Admin policies can govern models, preview features, and spending caps.
AWS Kiro: Integrates with IAM Identity Center, Okta, or Entra ID for SSO. Allows admin-enabled prompt logging and daily usage reports delivered to an S3 bucket in your account.
Cursor: Teams plan includes SAML/OIDC SSO, Privacy Mode, and basic usage analytics. Enterprise adds audit logs, SCIM, repository permissions, and an AI-code tracking API.
Cognition: Teams tier offers an admin dashboard and analytics. Enterprise adds SAML/OIDC SSO, centralized controls, VPC deployment, and audit endpoints via API.
Axis 4: Real 500-Seat Pricing
All rates are list prices in USD per month, before taxes and overages. The “true” seat cost reflects the minimum tier that provides IP indemnity and SSO.
| Option | Seat $/mo | 500 Seats $/mo | 500 Seats $/yr | Included Usage | Note |
|---|---|---|---|---|---|
| Copilot Business | $19 | $9,500 | $114,000 | 1,900 pooled AI credits | SSO & data residency require Enterprise Cloud |
| Business + Enterprise Cloud | $40* | $20,000 | $240,000 | Same credit pool | Real cost if Enterprise Cloud not already licensed |
| Copilot Enterprise + Enterprise Cloud | $60 | $30,000 | $360,000 | 3,900 pooled AI credits | Includes codebase indexing & GitHub integration |
| AWS Kiro Pro | $20 | $10,000 | $120,000 | 1,000 credits/user | Add-on credits $0.04; self-serve capped at 500 seats |
| AWS Kiro Pro+ | $40 | $20,000 | $240,000 | 2,000 credits/user | Same indemnity as Pro |
| Cursor Teams | $40 | $20,000 | $240,000 | Plan allowance | No audit logs/SCIM; Enterprise pricing custom |
| Cognition Teams | $40 + $80 team fee | — | — | Daily & weekly quotas | Capped at 200 users; 500 seats require custom Enterprise pricing |
* GitHub Enterprise Cloud from $21/user/mo (source). Copilot now uses credit-based billing (1 credit = $0.01); agent-heavy teams should model expected usage.
Feature Comparison: Copilot vs Kiro vs Cursor vs Cognition
| Feature | Copilot | Kiro | Cursor | Cognition |
|---|---|---|---|---|
| IP Indemnity | Yes, unmodified output | Yes, copyright claims | Yes, Suggestions | No, Outputs excluded |
| Cap | Uncapped | Uncapped | Outside fee cap | 2× prior 12-month fees |
| Training on Business Data | No | No (enterprise) | No (Privacy Mode) | No (Enterprise opt-out) |
| Prompt Retention | IDE: none; other: 28 days | Region-based; optional S3 logs | Temp encrypted cache | Dedicated VPC devbox |
| Region Choice | US/EU (+10% credits) | US, EU, GovCloud | Not public | Single-tenant VPC |
| SSO | SAML via Enterprise Cloud | IAM IC, Okta, Entra ID | SAML/OIDC on Teams | SAML/OIDC on Enterprise |
| Audit Logs | Yes (prompts excluded) | Yes (S3 reports) | Enterprise only | Enterprise API |
| 500-Seat Cost/mo | $9,500–$30,000 | $10,000 (Pro) | $20,000 or custom | Custom |
Interactive Explainer
Simulate contract scenarios, trace prompt flows, and model seat-based pricing with the interactive tool below.
RFP Checklist
- Request written confirmation that both edited and agent-written code remain within indemnity scope.
- For Cognition, remove the Customer Data exclusion for Outputs and lift the 2× fee supercap in your order form.
- Clarify whether Copilot is governed by GitHub or Microsoft Product Terms.
- Mandate region commitments in the order form, not just via admin settings.
- Budget 12 months of AI credit usage based on your projected model mix, not seat count alone.
Key Takeaways
- Copilot provides uncapped indemnity for unmodified outputs without filter mandates since April 3, 2026.
- AWS Kiro is the most cost-effective 500-seat option offering indemnity, SSO, and customer-owned logs.
- Cursor’s MSA explicitly covers “Suggestions” outside its fee cap.
- Cognition’s standard terms exclude Outputs from indemnity—order form negotiation is required.
- Only Copilot (with Enterprise Cloud) and Kiro deliver straightforward 500-seat pricing.
FAQ
- Does Copilot still require the duplicate detection filter?
No—Microsoft removed that requirement on April 3, 2026. - Is Windsurf still separate?
No—rebranded to Devin Desktop on June 2, 2026 under Devin’s pricing and terms. - Which agent supports EU prompt residency?
Copilot via Enterprise Cloud, Kiro within EU regions, Cognition via dedicated VPC.
The post AI Coding Agents for Enterprise: IP Indemnity, Data Residency and 500-Seat Cost Compared first appeared on MarkTechPost.
