Works with · Devin Review · Cognition
Does Devin Review count for SOC 2 or PCI DSS?
No. Devin Review posts severity- and CWE-tagged findings from a bot account. That is strong security evidence and PSCO uses it, but it is not an approval by a qualified person other than the author. PSCO adds the Officer.
How Devin Review reviews
Devin Review reads the pull request, posts findings tagged with severity and CWE identifiers, and suggests fixes.
What it cannot do
Devin Review cannot be the independent human approver an auditor is looking for. SOC 2 CC8.1, ISO 27001 A.5.3, PCI DSS 6.2.3.1 and SOX program-change controls all assume a qualified person other than the author approved the change and understood it. A bot account posting "Approve" is a review record, not an accountable person, and as of mid-2026 no auditor reports accepting it as standard practice.
How PSCO reads its output
Severity and CWE tags carry straight into the Officer’s packet, so the Officer sees Devin’s security findings mapped to the model’s forbidden patterns and sensitive paths.
Two-step setup
Keep Devin Review.
Keep Devin Review enabled.
Add PSCO.
Install the PSCO GitHub App, select the repos in scope, and require psco/approved and one approval from @psco-officers.
The shared-model tip
Point it at the same model the Officer uses.
Point Devin at the same rulebook the Officer uses. Reference psco.model.yaml from Devin’s knowledge or rules so its findings cite the same clauses. Keep the sensitive paths, required checks and forbidden patterns identical in both places so the robot and the human check the same rules, and so the Officer's packet shows the AI's findings next to the clause they map to.
frameworks: [soc2, iso27001] sensitive_paths: auth/**: deep infra/**: deep required_checks: [ci, tests, sast, secrets] forbidden: [hardcoded_secret, tls_verify_off]
Other reviewers
Claude Code · Codex · GitHub Copilot · Cursor Bugbot · CodeRabbit · Greptile · Graphite Diamond · Qodo · Macroscope · Ellipsis · Sourcery · Bito AI Code Review Agent · CodeAnt AI · repowise · Gemini Code Assist · Amazon Q Developer · Augment Code · Snyk · Semgrep · Dependabot · Renovate · All
Keep Devin Review. Add the human who signs.
Connect GitHub and PSCO detects the reviewers already on your repos. Your price comes from your real PR history.