Cursor
AI tools · cursor.com · last read 2026-10-12
Identity
| Legal entity | Anysphere, Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | cursor.com · 2026-10-08 |
Data location
No data-location observation recorded yet.
Subprocessor chain
20 third parties · 14 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services | US, EU, SG | Primary cloud hosting provider for Cursor's infrastructure |
| Anthropic | — | Provider of proprietary AI models via API |
| Azure | US | Some secondary infrastructure is hosted on Microsoft Azure |
| Baseten | US, CA | Inference infrastructure provider for hosting and serving AI models |
| Cloudflare | — | CDN, reverse proxy, network security, and Zero Trust tunneling provider |
| CoreWeave | US | Inference infrastructure provider for hosting and serving first party AI models. |
| Databricks | — | Data platform for storing and processing analytics data, and inference infrastructure for hosting and serving AI models |
| Datadog | US | Application logging and monitoring |
| Exa | US | Web search API provider for retrieving web content and search results |
| Fireworks | US, CA, EU, GB | Inference infrastructure provider for hosting and serving AI models |
| Google Cloud Platform | US | Cloud hosting provider |
| Google Gemini | — | Provider of proprietary AI models via Vertex API |
| Meta | — | Provider of proprietary AI models via API |
| Nebius | GB | Inference infrastructure provider for hosting and serving first party AI models |
| OpenAI | — | Provider of proprietary AI models via API |
| SpaceXAI | US | Provider of proprietary AI models via API |
| Together | US, CA, GB | Hosting of Cursor's custom models (zero data retention agreement) |
| TypeSafe AI | US | Provider of proprietary AI models via API |
| Vercel | US | Web hosting and compute services provider |
| WorkOS | US | Enterprise authentication and SSO/SCIM provider |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · cursor.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | other |
| Notice of new subprocessors | 30 business days' prior written notice, by posting updates at trust.cursor.com/subprocessors; in urgent circumstances, notice within 10 business days after the change |
| If you object to one | Customer may object on reasonable, documented grounds; Vendor uses commercially reasonable efforts to resolve; if unresolved within 30 days, Customer may terminate the affected portion of the Service, with a pro-rated refund of prepaid fees |
| Breach notification | without undue delay, and in any event within 48 hours |
| Audit | Information on request; audits/inspections by Customer or mandated auditor at Customer's expense (unless material violation found), max once per 12 months with 30 days' written notice and agreed scope; extra audit after breach or regulator request; Vendor may instead provide independent third-party assessment report |
| Audit | SOC 2 Type II certification copy obtainable via Trust Center; penetration test report on request via Trust Center |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| ISO/IEC 27001:2022 · ISO27001 | Available on request | — | cursor.com | 2026-10-08 |
| ISO/IEC 42001:2023 · ISO42001 | Available on request | — | cursor.com | 2026-10-08 |
| AIUC-1 | Available on request | — | cursor.com | 2026-10-08 |
| SOC 2 Type II · SOC2T2 | Available on request | — | cursor.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Anysphere, Inc.; Cursor
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Anysphere, Inc.; Cursor
- Data Privacy Framework List (US): checked 2026-10-12, no entry under Anysphere, Inc.; Cursor
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Anysphere, Inc.; Cursor
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Anysphere, Inc.; Cursor
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Anysphere, Inc.; Cursor
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: github.com (security.txt, no Expires field; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| subprocessors | JavaScript only | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.