Five Names, Four Contract Frameworks
MarkTechPost prepared this comparison for procurement leaders, general counsel, and security reviewers. It examines GitHub Copilot, AWS Kiro, Cursor, Devin, and Windsurf through questions that matter after deployment: who bears responsibility for an intellectual property claim, where prompts are stored, what administrators can log, and what a large seat count actually costs. The material says the relevant terms were checked against vendors' public pages on September 26, 2026, and explicitly states that the article is not legal advice.
The first correction is about the number of contracting parties. Cognition acquired Windsurf and renamed the Windsurf editor Devin Desktop on June 2, 2026. Devin and Windsurf should therefore not be assessed as two independent vendors. They now sit on one pricing table and under one main contractual framework, which means a single negotiation position with Cognition may affect both deployment paths.
Indemnity Does Not Mean Every Generated Line Is Covered
GitHub Copilot and AWS Kiro provide the clearest protections in the supplied material. Copilot's product terms promise uncapped intellectual property indemnity for unmodified outputs, and its Trust Center says this includes unmodified code from the Copilot coding agent. AWS states that Kiro offers indemnity for its output, while the material describes the AWS Bedrock FAQ as providing uncapped protection for copyright claims involving output. Cursor's business agreement explicitly names Suggestions and removes indemnity from the usual twelve-month fee cap.
All three promises are conditional. For Copilot, the critical phrase is unmodified, even though enterprise software is normally refactored, combined, and rewritten before release. Kiro's protection depends on non-infringing inputs and on keeping service filtering features enabled. Cursor excludes claims tied to modified or combined code, as well as situations where the customer knew the code was likely infringing. The contractual protection therefore applies to a defined generation path, not automatically to the enterprise's final codebase.
Cognition's Risk Comes from a Clear Exclusion
Cognition presents the sharpest contrast in this comparison because its exclusion is explicit. The MSA for Devin and Devin Desktop promises a defense against claims that the services infringe patents, copyrights, or trade secrets. The same agreement defines Customer Data to include Outputs and then excludes Customer Data from indemnity. Under the supplied reading of the contract, generated code therefore falls outside the standard indemnity promise rather than sitting in a merely ambiguous area.
That is not the only limitation. The enterprise MSA caps liability at twice the fees paid during the preceding twelve months. The platform terms for Pro, Max, and Teams say indemnity applies only to paid service tiers, likewise exclude outputs classified as Customer Data, and cap the protection at the greater of six months of fees or $100. The material emphasizes that an executed order form controls over the MSA. The practical negotiation point is therefore not to wait for standard terms to change, but to state the treatment of outputs, indemnity, and liability limits directly in the order form.
The Real Control Point Is the Deployment Process
These clauses connect legal exposure directly to engineering workflow. Copilot's protection turns on whether output remains unmodified. Kiro requires non-infringing inputs and continued use of filtering. Cursor excludes modifications and unapproved combinations. If an enterprise confirms only that a vendor offers IP indemnity but does not record how code moved from generation to merge, it may be unable to show that the contractual conditions were satisfied when a claim arises.
Security review should therefore ask not only what the model generated, but which controls were enabled, what inputs entered the service, how many transformations the output went through, and whether the final commit can still be traced to the original suggestion. The material also notes that Microsoft removed the required Duplicate Detection filter for Copilot on April 3, 2026, and its current required-mitigations page lists no additional mitigations for GitHub offerings. That change removes one deployment prerequisite, but it does not remove the central unmodified-output limitation.
A Cost Table Cannot Replace a Risk Decision
The source material identifies prompt storage, administrator audit logs, and the true cost of 500 seats as comparison axes, but the supplied excerpt ends before those details appear. The available evidence therefore does not support a reliable comparison of storage regions, logging capabilities, or total 500-seat pricing, nor should the headline's cost comparison be treated as numerically established here. For a technology leader, that evidence gap is itself a procurement warning: without the full contract, data-processing terms, and quote, total cost remains a surface price.
The decision can be made in two layers. First, treat Devin and Devin Desktop as one Cognition negotiation and require the order form to state whether outputs receive indemnity. Second, turn the conditions attached to Copilot, Kiro, and Cursor into deployment controls covering filtering, input provenance, code modification, and code combination. Only after those boundaries are confirmed should prompt residency, audit logging, seat pricing, and renewal terms be evaluated in one table. That is a comparison of manageable risk, not merely a comparison of monthly prices.