- Deployment
- hosted
- Hq Country
- United States
- Hq City
- San Francisco
- Ownership
- private
- Founded
- 2022
- Training Default
- never
- Residency Options
- United States (US-only data residency programme), EU + Iceland (inference only, on request)
- Gov Access Exposure
- us-cloud-act
- Eu Ai Act Role
- deployer
- Certs
- SOC 2 Type II
- DPA available
- yes
- Zero Retention Available
- Yes
- Retention Default
- With Privacy Mode enabled Cursor does not train on customer data and holds zero-data-retention agreements with every model provider, so inference inputs and outputs are not stored. Codebase embeddings and metadata (hashes, file names) are still stored in Cursor's database; cached file contents are temporary and encrypted with client-generated keys.
- Retention Exceptions
- Model providers, Cursor included, may run abuse classifiers; data that trips one can be stored for investigation under the provider's own retention policy. Models outside the ZDR agreements are labelled as such and need admin opt-in — Claude Fable 5 is one, and Anthropic stores its inputs and outputs for harm-prevention review, so Enterprise requests to it fail until an admin approves the retention policy for the whole team.
- Subprocessors
- Amazon Web Services, Fireworks AI, OpenAI, Anthropic, Google (Gemini / Vertex AI), Exa, Datadog, Databricks, Vercel, Microsoft Azure, Baseten, Cloudflare, Google Cloud Platform, Together AI, SpaceXAI (xAI), WorkOS
- Subprocessor Count
- 17
- Transfer Mechanism
- none-stated
- Eu Procurement Ready
- conditional
- Eu Procurement Reason
- Privacy Mode is on by default for Enterprise teams, can be enforced team-wide so members cannot disable it, and carries zero-data-retention agreements with every model provider — one of the cleanest no-training positions in the harvest, and available free of charge to anyone. What holds it at conditional is everything below the data-use layer: storage and processing stay in the United States (EU + Iceland covers inference only, on request), the public privacy policy names no Chapter V transfer mechanism, and SOC 2 Type II is the only certification.
- Training Claim Basis
- stated
- Training Confidence
- high
- Residency Claim Basis
- stated
- Residency Confidence
- high
- Retention Claim Basis
- stated
- Retention Confidence
- high
- Subprocessors Claim Basis
- stated
- Subprocessors Confidence
- high
- Residency Class
- eu-via-third-party
- Portability / Exit Path
- proprietary-only
- Subprocessor Jurisdiction
- non-eu
- Underlying model providers
- Anthropic, OpenAI, Google, xAI (SpaceXAI), Anysphere (Composer), Fireworks AI, Together AI, Baseten, Databricks
