Procurement leads, general counsels and security reviewers need clear answers before rolling out AI coding agents. The four core questions are: who pays if the generated code triggers an IP claim, where are prompts stored, what can administrators log, and what is the real cost for 500 seats.
GitHub Copilot Business and Enterprise provide uncapped indemnity for unmodified output. The Trust Center confirms coverage includes code directly from the agent, but any edit may move the output outside the promised scope, so counsel should review how modifications affect protection. Prompts entered in the IDE or CLI are not retained; prompts from other surfaces such as github.com, mobile or the web are kept for 28 days, while engagement data stays for two years. Enterprise audit logs record copilot events under action:copilot and agent activity under actor:Copilot for 180 days, though locally sent prompts are absent from the log. Admins can set model, preview‑feature and spending policies. At 500 seats the list price is $19 per seat monthly ($9,500 total) for Copilot Business; adding GitHub Enterprise Cloud for SAML SSO and data residency raises the cost to $40 per seat ($20,000 monthly).
AWS Kiro offers indemnity for copyright claims on its output, uncapped for those claims, provided the customer does not disable service filtering features or supply infringing inputs. Prompt data lives in the region where the Kiro profile is configured; admins can enable prompt logging that writes to an S3 bucket in the customer’s own account, giving full control over retention. Enterprise users benefit from no training on their data. For 500 seats Kiro Pro costs $20 per seat monthly ($10,000 total) with 1,000 AI credits per user; extra credits are $0.04 each.
Cursor’s Master Services Agreement defends claims that any Suggestion infringes third‑party IP, with indemnity carved out of the 12‑month fee cap. Protection drops if the claim stems from modified or combined code, or if safety filters are disabled. With Privacy Mode enabled, Cursor holds zero data retention agreements with model providers and does not train on user code; file contents are cached temporarily and encrypted with client‑generated keys. Admin controls such as SAML/OIDC SSO, team‑wide Privacy Mode and usage analytics are available on the Teams plan, while audit logs, SCIM and model access controls require the Enterprise tier (custom priced). At 500 seats Cursor Teams is $40 per seat monthly ($20,000 total) but lacks audit logs and SCIM.
Cognition’s Devin and Windsurf (now Devin Desktop) exclude Outputs from indemnity because the MSA defines Customer Data to include Outputs. Indemnity is capped at two times the prior 12‑month fees, and any rollout must negotiate this limitation in the order form. Prompt storage is not retained for training without written consent; enterprise deployments run the devbox in a single‑tenant VPC via AWS PrivateLink, while the reasoning layer remains in Cognition’s cloud. Admin features such as SAML/OIDC SSO, centralized controls and VPC deployment are Enterprise‑only; Teams plans are limited to 200 users, so 500 seats require a custom Enterprise quote.
In summary, GitHub Copilot gives the broadest uncapped indemnity but hinges on the “unmodified” clause; AWS Kiro mirrors AWS’s uncapped copyright indemnity with strict input filtering requirements; Cursor offers strong indemnity on Suggestions but limits it when code is altered; Cognition excludes generated code from standard indemnity and requires contractual fixes. Prompt residence varies from no retention (GitHub IDE) to customer‑controlled S3 buckets (AWS Kiro) to zero‑retention agreements (Cursor Privacy Mode) to dedicated VPC deployments (Cognition Enterprise). Audit logging is native in GitHub Enterprise Cloud and AWS Kiro, available only in Cursor Enterprise and Cognition Enterprise, and absent in Cursor Teams. Cost at 500 seats ranges from $9,500‑$20,000 monthly for Copilot depending on Enterprise Cloud, $10,000 for Kiro Pro, $20,000 for Cursor Teams, and a custom Enterprise price for Cognition.
#AI #Product #Procurement #Legal #Security #DevOps