Our earlier guide to Top AI Coding Agents and Development Platforms explained each agent’s capabilities and use cases. This article, however, is tailored for procurement managers, legal counsel and security teams.
Before approving any implementation, these stakeholders focus on four key queries: Who covers IP claims arising from AI-generated code? Where and how long are prompts retained? What administrative and audit controls exist? And what is the true cost for 500 users?
To answer these, we reviewed the latest contract documents for GitHub Copilot, AWS Kiro, Cursor, Devin and Windsurf as of September 26, 2026. This is a factual report, not legal advice; always have counsel vet your final agreement.
Consolidated Contracts: From Five Brands to Four Agreements
Although five product names appear above, they rest on four distinct legal frameworks. Cognition acquired Windsurf and on June 2, 2026 rebranded it as Devin Desktop. Now Devin and its legacy Windsurf editor share one pricing sheet and one Master Service Agreement.
Indemnity Provisions: The Unseen Matrix
This indemnity matrix often determines whether an enterprise can proceed. We quote each provider’s current contract language verbatim from their published terms.
| Vendor (plan) | Governing contract | Indemnity promise | Generated code covered? | Limit | Key conditions |
|---|---|---|---|---|---|
| GitHub Copilot (Business, Enterprise) | Copilot Product Terms or Microsoft Product Terms | “uncapped IP indemnification for unmodified outputs” (Copilot Trust Center) | Yes, for unmodified AI output | Uncapped | No requirement for Duplicate Detection filter since April 3, 2026; excludes Free, Pro, Pro+ and Max |
| AWS Kiro (Pro, Pro+, Pro Max, Power) | AWS Customer Agreement & AWS Service Terms | “Kiro offers indemnity for its output.” (Kiro Enterprise) | Yes, for copyright claims | Uncapped for copyright claims (AWS Bedrock FAQ) | Inputs must not infringe; service filters may not be disabled; Free tier excluded |
| Cursor (business) | Cursor MSA (updated August 13, 2026) | Defends claims “that the Service or any Suggestion infringes or misappropriates” | Yes, suggestions are explicitly covered | Subject to 12-month fee cap | Excludes claims from modified/combined code, disabled filters or known-risk content |
| Cognition: Devin & Devin Desktop (Enterprise) | Cognition MSA (updated June 8, 2026) | Defends claims of patent, copyright or trade secret infringement. Excludes Customer Data (“including Outputs”). | No | Supercap of 2× fees paid in prior 12 months | Order form overrides MSA; negotiate coverage of Outputs |
| Cognition (Pro, Max, Teams) | Platform Terms (updated June 30, 2026) | Indemnity “applies only to Customers on the Paid Service Tiers” | No | Greater of six months of fees or US$100 | Excludes Free tier; Outputs remain excluded |
Axis 1: Exposure to IP Claims
GitHub Copilot: Since Microsoft removed the Duplicate Detection filter requirement on April 3, 2026, no admin setting voids indemnity. Coverage applies only to “unmodified outputs,” so edited snippets may fall outside; legal review is advised.
AWS Kiro: Under AWS’s Service Terms section 50.10, Kiro indemnifies users for copyright claims on output. Coverage ceases if inputs infringe third-party rights or if filtering features are turned off.
Cursor: Cursor’s MSA offers the broadest promise, explicitly covering Suggestions and carving indemnity out of the standard fee cap. Exclusions still apply if suggestions are modified or filters disabled.
Cognition (Devin & Devin Desktop): Cognition excludes all Outputs as “Customer Data,” removing generated code from indemnity. Even edited code is excluded. Limits cap at twice the trailing 12-month fees.
Axis 2: Prompt Storage and Residency
GitHub Copilot: Completion and chat prompts in IDEs are not retained. Prompts sent via github.com, CLI or mobile APIs are kept for 28 days; user engagement logs for two years. Business and Enterprise data are never used to train models. Data residency for Enterprise Cloud customers allows pinning inference to the US or EU (+10% to AI credit cost).
AWS Kiro: Enterprise prompts remain in the region of your AWS profile. Inference is restricted to US or Europe geographies, except experimental models. Admins can enforce encryption with customer-managed KMS keys. Enterprise content is never used to improve the service.
Cursor: With Privacy Mode enabled, Cursor stores no user data with model providers and does not train on your code. Files are cached transiently, encrypted with client keys. No customer-selectable region is publicly available; all traffic routes through Cursor’s backend.
Cognition: The MSA prohibits training on Customer Data without written consent. A Customer Dedicated Deployment places the devbox in a single-tenant VPC via AWS PrivateLink; however, the agent’s reasoning still runs in Cognition’s cloud. On self-serve paid tiers, training occurs until the customer opts out; on Teams only admins can opt out.
Axis 3: Audit Logging & Administrative Controls
GitHub Copilot: The enterprise audit log captures Copilot calls (action:copilot) and agent actions (actor:Copilot) for 180 days. Local IDE prompts are omitted. Admins can enforce model allowlists, preview-feature settings and spending caps.
AWS Kiro: Integrates with IAM Identity Center, Okta or Entra ID for SSO. Admins may enable prompt logging and daily activity reports, delivered to an S3 bucket in your AWS account.
Cursor: Teams supports SAML/OIDC SSO, Privacy Mode at the team level and basic usage analytics. Full audit logs, SCIM provisioning, repository and model access controls, and an AI code tracking API require Cursor Enterprise.
Cognition: Teams includes an admin dashboard and analytics. Enterprise adds SAML/OIDC SSO, centralized controls, VPC deployment and audit log endpoints via the Enterprise API.
Axis 4: True Per-Seat Cost at 500 Seats
All list prices are monthly in USD, before taxes or usage overages. “True” cost assumes the minimum tier offering both indemnity and SSO.
| Option | Cost per seat | 500 seats/mo | 500 seats/yr | Included usage | Notes |
|---|---|---|---|---|---|
| GitHub Copilot Business | $19 | $9,500 | $114,000 | 1,900 pooled AI credits/seat | SSO & residency require GitHub Enterprise Cloud |
| Copilot Business + Enterprise Cloud | $40 | $20,000 | $240,000 | Same credit pool | If you don’t already subscribe to Enterprise Cloud |
| Copilot Enterprise + Enterprise Cloud | $60 | $30,000 | $360,000 | 3,900 pooled AI credits/seat | Adds code indexing & github.com integration |
| AWS Kiro Pro | $20 | $10,000 | $120,000 | 1,000 credits/user | Add-on credits $0.04; covers up to 500 self-serve seats |
| AWS Kiro Pro+ | $40 | $20,000 | $240,000 | 2,000 credits/user | Same indemnity as Pro |
| Cursor Teams | $40 | $20,000 | $240,000 | Plan-based allowance | No audit logs or SCIM on Teams; Enterprise is custom priced |
| Cognition Teams (Devin, Devin Desktop) | $40 + $80 team fee | n/a | n/a | Daily & weekly quotas | Capped at 200 seats; 500 seats require Enterprise quote |
Sources: GitHub Copilot billing docs, GitHub pricing, Kiro pricing, Cursor pricing, Devin pricing.
Since June 1, 2026, Copilot charges usage-based AI credits ($0.01/credit). Kiro overages cost $0.04/credit; enterprise overages are disabled by default. Plan for both seats and anticipated usage.
Feature Comparison
| Feature | GitHub Copilot | AWS Kiro | Cursor | Cognition |
|---|---|---|---|---|
| IP indemnity | Yes, unmodified outputs | Yes, copyright claims | Yes, Suggestions | No, Outputs excluded |
| Indemnity cap | Uncapped | Uncapped (copyright) | Outside fee cap | 2× prior 12-month fees (MSA) |
| Training on business data | No | No | No, with Privacy Mode | No on Enterprise; opt-out on paid tiers |
| Prompt retention | IDE: none; other surfaces: 28 days | Retained by profile region; logs to your S3 | Zero data retention agreements; temp cache | Devbox VPC; reasoning layer in Cognition cloud |
| Region choice | US or EU (+10% credits) | US, Europe, GovCloud | Not publicly offered | Dedicated single-tenant VPC (Enterprise) |
| SSO | SAML via Enterprise Cloud | IAM IC, Okta, Entra ID | SAML/OIDC on Teams | SAML/OIDC on Enterprise |
| Audit logs | Yes; prompts excluded | Prompt logs & reports to S3 | Enterprise only | Enterprise API endpoints |
| 500-seat price/mo | $9,500–$30,000 | $10,000 (Pro) | $20,000 (Teams) or custom | Custom |
Interactive Explainer
Use the embedded tool to run claim scenarios, trace prompt paths and calculate custom seat pricing.
RFP Checklist
- Request written confirmation: does indemnity extend to edited or agent-written code?
- For Cognition: strike the Customer Data exclusion and remove the 2× fee cap.
- For Copilot: clarify whether GitHub or Microsoft terms govern your purchase.
- Ensure region commitments are in the order form, not just console settings.
- Budget 12 months of AI usage based on your expected model mix, not seats alone.
Key Takeaways
- Copilot offers uncapped indemnity for unmodified outputs; no filter needed since April 2026.
- Kiro provides the most cost-effective 500-seat plan with indemnity, SSO and self-owned logs.
- Cursor’s MSA explicitly covers Suggestions and removes indemnity from the fee limit.
- Cognition’s standard terms exclude all Outputs from coverage; both Devin products are affected.
- At 500 seats, Cursor and Cognition require custom Enterprise pricing.
FAQ
- Is the duplicate detection filter still required for Copilot indemnity?
No. Microsoft’s mitigations page lists no mandatory filters as of April 3, 2026. - Does Windsurf remain a standalone product?
No. It was rebranded as Devin Desktop on June 2, 2026 and now shares Devin’s terms. - Which agent supports prompt residency in the EU?
Copilot via Enterprise Cloud data residency; Kiro by EU region; Cognition via a dedicated VPC deployment.
This analysis was first published on MarkTechPost.