- Deployment
- hosted
- Hq Country
- United States
- Hq City
- San Francisco
- Ownership
- private
- Founded
- 2022
- Training Default
- trains
- Residency Options
- United States (US-only data residency programme), EU + Iceland (inference only, on request)
- Gov Access Exposure
- us-cloud-act
- Eu Ai Act Role
- deployer
- Certs
- SOC 2 Type II
- DPA available
- yes
- Zero Retention Available
- Yes
- Retention Default
- With Privacy Mode off Cursor may store codebase data, prompts, editor actions and code snippets indefinitely to improve its AI features and train its models. Codebase indexing uploads code in chunks for embedding; plaintext ceases to exist after the request but embeddings and metadata (hashes, file names) are stored in Cursor's database either way.
- Retention Exceptions
- Cloud Agents are the only feature that requires Cursor to store code — encrypted repository copies held for the life of the agent run, then deleted; the feature is optional. Enterprise customers can supply Customer Managed Encryption Keys (CMEK) for embeddings and Cloud Agent data. Requests route through Cursor's backend even when the customer supplies their own model API key.
- Subprocessors
- Amazon Web Services, Fireworks AI, OpenAI, Anthropic, Google (Gemini / Vertex AI), Exa, Datadog, Databricks, Vercel, Microsoft Azure, Baseten, Cloudflare, Google Cloud Platform, Together AI, SpaceXAI (xAI), WorkOS
- Subprocessor Count
- 17
- Transfer Mechanism
- none-stated
- Eu Procurement Ready
- fail
- Eu Procurement Reason
- In default settings Cursor states plainly that it may use and store codebase data, prompts, editor actions and code snippets to improve its AI features and train its models. There is no EU data storage or processing option at any tier — only EU + Iceland inference, on request — and the public privacy policy names no Chapter V transfer mechanism for EEA data sent to Cursor's United States servers. The fix is one toggle away (see the Privacy Mode row), which is exactly why the default matters.
- Training Claim Basis
- stated
- Training Confidence
- high
- Residency Claim Basis
- stated
- Residency Confidence
- high
- Retention Claim Basis
- stated
- Retention Confidence
- high
- Subprocessors Claim Basis
- stated
- Subprocessors Confidence
- high
- Residency Class
- eu-via-third-party
- Portability / Exit Path
- proprietary-only
- Subprocessor Jurisdiction
- non-eu
- Underlying model providers
- Anthropic, OpenAI, Google, xAI (SpaceXAI), Anysphere (Composer), Fireworks AI, Together AI, Baseten, Databricks
