AI coding agents in the enterprise: IP indemnification, data residency and the real cost at 500 seats

A comparative analysis published on September 26, 2026 examines the current contracts of four enterprise-focused AI coding agents —GitHub Copilot, AWS Kiro, Cursor and Cognition's Devin/Windsurf— from a perspective rarely covered in standard technical reviews: that of the procurement managers, legal departments and security teams who must approve these deployments. The article starts from four very specific questions that, according to the authors, any corporate reviewer asks before authorizing the use of these tools: who bears liability if the generated code triggers an intellectual property claim, where prompts are stored, what administrators can log through auditing, and how much it really costs to deploy the tool at a scale of 500 seats. All terms were verified directly on each vendor's official pages on the stated date, and the outlet itself clarifies that this is informational journalism, not legal advice, recommending that any final decision be checked with a legal department.

A first clarification is that, although five brands are compared, in practice there are four contractual sets: Cognition acquired Windsurf and, on June 2, 2026, renamed the Windsurf editor "Devin Desktop," so both products now share the same pricing table and the same set of legal terms.

The core of the article is what it calls "the indemnification table nobody publishes," that is, the contractual clause that in practice blocks many enterprise deployments if it is not resolved. According to this table, GitHub Copilot (Business and Enterprise plans), under the Copilot Product Specific Terms or the Microsoft Product Terms, offers "uncapped intellectual property indemnification for unmodified outputs," according to the Copilot Trust Center. Coverage is unlimited, but applies only to unmodified code; since April 3, 2026 it is no longer mandatory to enable the duplicate detection filter to keep that protection, although the Free, Pro, Pro+ and Max plans are excluded from coverage.

AWS Kiro (Pro, Pro+, Pro Max and Power plans), under the AWS Customer Agreement and the AWS Service Terms, states that "Kiro offers indemnification for its outputs," covering copyright claims over generated output, also uncapped according to the AWS Bedrock FAQ. This coverage requires that user inputs not themselves be infringing and that the service's filtering features not be disabled; the free tier is not covered.

Cursor, for enterprise customers, updated its Master Service Agreement (MSA) on August 13, 2026, in which it expressly defends claims that "the Service or any Suggestion infringes or misappropriates" third-party intellectual property, explicitly naming "Suggestions" (code suggestions) as covered. It is, according to the article, the broadest wording on paper, since the indemnification falls outside the twelve-months-of-fees liability cap. However, coverage is excluded if the claim stems from modified or combined code, if filters have been disabled, or if the customer knew the output was likely to infringe third-party rights.

Cognition, both for Devin and Devin Desktop on its Enterprise plan (under Cognition's MSA, updated June 8, 2026) and for its Pro, Max and Teams plans (under the Platform Terms, updated June 30, 2026), stands as the group's negative exception: it defends claims that the Services infringe patents, copyrights or trade secrets, but expressly excludes "Customer Data," a category defined in a way that includes "Outputs" (generated results). In practice, this means code generated by Devin or Devin Desktop is not covered by the standard indemnification. In addition, the Enterprise plan carries an extra cap ("supercap") of two times the fees paid in the previous twelve months, while in the self-service plans (Pro, Max, Teams) the cap is the greater of six months of fees or $100, and the free tier receives no indemnification at all. The article stresses that, in Cognition's contracts, an executed order form prevails over the general MSA, so this is the exact point where companies should negotiate to try to get generated outputs effectively covered and to lift that cap.

On legal exposure to generated code, the analysis stresses that Microsoft's April 3, 2026 change is more relevant than any recent product launch: before that date, a single administrator setting could void coverage; now, Microsoft's required mitigations page requires no additional mitigation for GitHub's offerings. The remaining limit is the word "unmodified," and since most code shipped to production is edited after being generated, the article recommends asking the legal department directly to what extent modifications take code outside the scope of coverage. In the case of AWS Kiro, the protection inherits AWS's generative AI indemnification, described as uncapped for copyright claims over outputs of the services listed in section 50.10 of the AWS terms, although it is lost if user inputs infringe rights or if filtering features are disabled; Kiro states this protection is included for paying subscribers. At Cursor, although the MSA explicitly names "Suggestions," the exclusions for unapproved modification or combination of code limit its real scope, and curiously the Terms of Service for individual consumers work the other way around: it is the user who indemnifies Anysphere (the company behind Cursor), not the reverse. Cognition, again, is flagged as the outlier: its definition of "Customer Data" that includes generated outputs places them outside the standard indemnification promise, and any deployment of Devin or Devin Desktop would need to fix this point specifically in the order form.

As for where prompts are stored, GitHub Copilot, on its Business and Enterprise plans, does not retain chat and autocomplete prompts sent from the IDE, according to its plans FAQ; however, prompts sent from other surfaces —github.com, mobile and the command line— are retained for 28 days, and user interaction data is kept for 2 years. GitHub does not train models on Business or Enterprise customer data. Companies using GitHub Enterprise Cloud with data residency can pin Copilot inference to the United States or the European Union, although that policy adds 10% to AI credit consumption and shortens the list of models available in each region. AWS Kiro, according to its data protection page, never uses enterprise content to improve the service; data is stored in the region configured in the Kiro profile, and inference stays within the United States or Europe geography, except for models labeled experimental; administrators can encrypt data with customer-managed KMS keys. Cursor, with "Privacy Mode" enabled, keeps no data retention with any model provider and does not train on customer code; file content is cached temporarily, encrypted with customer-generated keys, but its public pages do not offer a customer-selectable processing region, and every request still passes through Cursor's backend. Cognition's MSA prohibits training models on Customer Data without written consent; its "Customer Dedicated" deployment runs Devin's working environment ("devbox") in a single-tenant VPC connected via AWS PrivateLink, although the agent's reasoning layer still runs in Cognition's cloud. On paid self-service plans, Cognition may train on Customer Data until the customer explicitly opts out; on the Teams plan, only an administrator can enable that opt-out.

Regarding audit logging and administrative controls, GitHub Copilot records Copilot events in the enterprise audit log under the "action:copilot" label, and agent activity appears under "actor:Copilot" for 180 days, according to GitHub's agent audit reference; the vendor itself clarifies that prompts sent locally do not appear in that log. Administrators can also set model, preview-feature and spending policies. AWS Kiro handles single sign-on (SSO) through IAM Identity Center, Okta or Entra ID; administrators can enable prompt logging and receive daily user activity reports, stored in an S3 bucket within the customer's own AWS account, thus retaining control of those logs. Cursor Teams includes SSO via SAML or OIDC, team-level Privacy Mode and usage analytics, but audit logs, SCIM, repository and model access controls, and an API for tracking AI-generated code require the Enterprise plan. Cognition offers an admin dashboard with analytics on its Teams plan, while SSO via SAML or OIDC, centralized administrative controls and VPC deployment are reserved for the Enterprise plan, whose API additionally exposes audit log endpoints.

On costs at a scale of 500 seats, the article details monthly list prices in dollars, before usage overages and taxes, noting in each case the cheapest tier that actually includes indemnification and SSO. GitHub Copilot Business costs $19 per seat per month ($9,500 monthly and $114,000 annually for 500 seats), with 1,900 AI credits per seat in a shared pool, although SAML SSO and data residency also require purchasing GitHub Enterprise Cloud. Adding Copilot Business and GitHub Enterprise Cloud, the cost rises to $40 per seat ($20,000 monthly, $240,000 annually), which the article flags as the real cost if the company does not already pay for Enterprise Cloud. Copilot Enterprise together with GitHub Enterprise Cloud reaches $60 per seat ($30,000 monthly, $360,000 annually), with 3,900 credits per seat and added codebase indexing and github.com integration features. AWS Kiro Pro costs $20 per seat ($10,000 monthly, $120,000 annually), with 1,000 credits per user and additional credits at $0.04 each; its self-service tiers cover teams of up to 500 people. Kiro Pro+ doubles that price to $40 per seat ($20,000 monthly, $240,000 annually) with 2,000 credits per user, keeping the same indemnification as the Pro plan. Cursor Teams costs $40 per seat ($20,000 monthly, $240,000 annually), but lacks audit logs and SCIM, so at that scale the real option would be the Enterprise plan, with custom pricing. Cognition Teams costs $40 per seat plus a flat team fee of $80, but that plan is limited to a maximum of 200 users, so it is not available for 500 seats: at that scale, the only route is the Enterprise plan with custom pricing. The article adds that, beyond the per-seat price, there are two additional cost "meters": GitHub moved Copilot to a usage-based AI credit model on June 1, 2026 (1 credit equals $0.01), and Kiro bills additional credits at $0.04 each, with enterprise overages disabled by default; the recommendation is that teams with heavy agent usage model their actual consumption, not just the number of seats.

As conclusions ("Key Takeaways"), the article sums up that Copilot offers uncapped indemnification for unmodified outputs, no longer requiring the detection filter since April 2026; that Kiro is the cheapest route at 500 seats combining indemnification, SSO and customer-controlled prompt logs; that Cursor's MSA explicitly names "Suggestions" and takes indemnification outside the fee cap; that Cognition's standard terms exclude generated outputs from indemnification, for both Devin and Windsurf; and that, at 500 seats, both Cursor and Cognition require moving to custom enterprise pricing. The text recommends that any request for proposal (RFP) to these vendors demand in writing whether code edited or written by agents remains within the scope of the indemnification, that in Cognition's case the "Outputs" exclusion be explicitly renegotiated and an attempt made to remove the two-times-fees cap, that in Copilot's case it be clarified whether the applicable contract is GitHub's or Microsoft's, that data processing region commitments be set in the order form itself and not just on a settings screen, and that the real cost be calculated over twelve months of actual agent usage, not just on the per-seat price.

Finally, the FAQ section clarifies that it is no longer necessary to enable the duplicate detection filter to keep Copilot's indemnification, that Windsurf no longer exists as a standalone product after being renamed Devin Desktop by Cognition on June 2, 2026, and that on EU data residency, Copilot offers European-region inference through GitHub Enterprise Cloud, Kiro processes enterprise inference within its European geography, and Cognition offers a dedicated VPC for the agent's working environment.