Taiga vs. Factory vs. Cognition

Factory wrote, in the post announcing its partner network on 19 August 2026, that "even with frontier models, writing code is about 20% of the software development lifecycle." Cognition wrote, in Devin's annual performance review in November 2025, that "human review is still necessary, because code quality is not straightforwardly verifiable." We would sign both sentences.

All three of us hand the merge decision to your Git host. Factory's compliance documentation says to "enable branch protection to require PR reviews before merging Droid-assisted changes." Devin's GitHub integration page recommends "enabling branch protection rules on your main branch to ensure all required checks pass before Devin can merge changes." Our own walkthrough says "required repository checks and reviews are never bypassed."

All three of us also give you what is built. Cognition's terms say the customer "owns all right, title, and interest, including all intellectual property rights, in and to Customer Data, including Outputs, to the fullest extent permitted by applicable law." Factory's pricing page answers "Who owns the code generated by Factory?" with "You do." Our master terms say "all right, title and interest in the Delivered Software is the Customer's from delivery."

None of the three takes over your on-call duty, either. Factory's Release stage, in Private Preview, will "execute approved release steps or hand off to the deployment system," and its Incident Response begins when "an alert bot posts a top-level message in the configured Slack channel." Devin's PagerDuty integration, added on 11 September, lets it "act as an oncall responder that triages PagerDuty incidents and posts its investigation as incident notes." At Taiga, your pipeline executes the deployment, and our product page says the monitoring signals "do not imply complete infrastructure observability, incident response or autonomous production remediation."

The disagreement is about who carries the other 80 percent, and under which law.

Cognition's homepage calls Devin "the first autonomous software engineer," one that "plans, writes, tests, and ships production code on its own, working inside your codebase and the tools your team already uses." On devin.ai, Devin "won't stop until the PR is ready to merge." Cognition's enterprise terms put the review on the customer: "It is Customer's responsibility to evaluate whether Output is appropriate for its use case (including where human review is appropriate) before any use or sharing of any Output." Cognizant's press release of 23 September 2026 shows that arrangement in production. A seven-person Cognizant team used Devin to rebuild Odyssey Logistics' legacy forms as cloud-native applications. "Every change was reviewed and signed off by a Cognizant technical lead or architect before merging," the release says, and it reports a 37 percent net cost saving.

Factory's homepage heading is "Build your software factory," and the post that defined Factory 2.0 on 15 June 2026 says who does the building: "This system will be built by engineers, and in turn will build their software." Partners are the second route. They will "embed with customer teams to design, deploy, and run the software factory." The factory around the Droids is yours to assemble, inside your tools, under an autonomy ceiling your organization sets between Off and High. In Factory's documentation the Software Factory overview, Triage, Release and Incident Response carry a Private Preview tag, which Factory defines as "limited or invite-only access that is already running in production." Automations became generally available on 30 September.

Taiga's service description, version 1.0 of 6 September 2026, defines a Build: "Each Build delivers the implementation package: code, infrastructure definitions, CI/CD configuration and the audit trail for that Build, with the human contributions recorded against it." Before the first Build on a new project, eight documents have to exist: specification, user flows, architecture, technology decisions, data flow, threat model, DPIA and risk register[8]. After that, each change is an initiative that Taiga plans and builds "using its documents, policies and repository context," and our product page adds: "Plans can wait for approval, or build on their own." Our shared-responsibility page keeps the review where the other two keep it: "Reviewing generated output is yours, and it is the responsibility easiest to let slide."

The size gap from the opening raises the question DORA asks in Article 28(8): what happens if the provider fails. Our master terms answer it by hosting mode. In customer-hosted mode, where you use your own repositories and your own cloud account, "there is nothing to escrow: the Customer loses the Platform, not the product." In Taiga-hosted mode, "source and deployment configuration are mirrored to the Customer continuously through the term." Leaving while we still exist is covered as well: export is self-service in machine-readable formats, the tenant audit trail and the Discovery documents are on the export list, and there is no switching charge.

The other follow-up questions go against us. We hold no certificate. ISO 27001 is "In progress. Not held. The management system is running; the certificate is not ours yet and you will not see the logo here until it is." SOC 2 Type II is planned[12], and no third-party penetration test has been carried out yet. Cognition has held SOC 2 Type II since September 2024 and lists ISO/IEC 27001:2022, Factory lists SOC 2 Type II, ISO 27001 and ISO 42001, and both test externally at least once a year.

"SAML and SCIM provisioning are not built yet," and both competitors ship them. Our platform connects to GitHub.com and GitHub Enterprise only, while Devin also works with GitLab, Bitbucket and Azure DevOps, and Factory with GitLab. "Every agent runs an Anthropic Claude model reached exclusively through Amazon Bedrock," with "no second provider," where Factory routes across several providers and your own endpoints. And the platform needs the internet: "The platform is a managed EU SaaS, so no, and we will not pretend otherwise." Factory ships an airgapped build.

Our two Amazon Bedrock Guardrails profiles are built and versioned but switched off in every environment while support cases with AWS are open[16]. The correction went up on our trust updates page on 5 August 2026, with what covers the gap until they return: "retrieval is scoped to your tenant, agents run least-privilege and are invoked only by the API, and agent output is validated at the API layer." No newer entry has replaced it.

If you have a platform team that wants to assemble its own factory inside the tools it already runs, possibly with no outbound internet at all, Factory sells that, including an airgapped build we do not offer. If you want an autonomous engineer on the team, with your reviewers or an integrator carrying the review, or your code lives on Bitbucket or Azure DevOps, Cognition sells that. Both of them also pass a vendor-risk gate that asks for a certificate, SAML or SCIM before onboarding; we do not yet.

Taiga is for the regulated EU enterprise that would rather not staff a platform team to build its own factory, and whose purchase turns on the auditor's questions.

Compare the internal work of assembling and operating a factory with the published Taiga service plans. The evidence hub shows what our research and public reference implementation establish, with their limitations.

Ask all three of us the three questions from the top of this page on the first call, and do not let any vendor pick the change, us included.