How many subprocessors does Cursor use?

Cursor lists 17 subprocessors on its published list, including Amazon Web Services, Fireworks, OpenAI, Anthropic, and Google Gemini and 12 more.

Where does Cursor process customer data?

The subprocessors named by Cursor are located in US, Worldwide, Canada, EU, UK, and Asia (UAE) and 1 other locations, as stated on its list.

Does Cursor use customer data to train AI models?

According to its terms of service, Cursor uses customer data to train AI models unless customers opt out: “ANYSPHERE WILL NOT USE CONTENT TO TRAIN, OR ALLOW ANY THIRD PARTY TO TRAIN, ANY AI MODELS, UNLESS YOU'VE EXPLICITLY AGREED TO THE USE OF CONTENT FOR TRAINING.”

How quickly does Cursor report a personal data breach to customers?

According to its DPA, Cursor reports a personal data breach to customers within 48 hours: “Vendor shall without undue delay, and in any event within forty-eight (48) hours, notify Customer in writing of any breach of security”

How much notice does Cursor give before adding a subprocessor?

Cursor's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “it shall provide Customer with thirty (30) business days' prior written notice by posting updates at trust.cursor.com/subprocessors”

How does Cursor transfer personal data outside the EU?

Cursor's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “the standard contractual clauses for the transfer of Personal Data to third countries set out in Commission Decision 2021/914 of 4 June 2021, specifically including Module 2 (Controller to Processor)”

When was Cursor's subprocessor list last checked?

ClauseTrail last checked Cursor's subprocessor list on September 28, 2026. Lists are re-checked daily.

How do I find out when Cursor adds or removes a subprocessor?

ClauseTrail monitors Cursor's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Cursor Subprocessors List (September 2026): Changes and History

Cursor names 17 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 28, 2026 Official source ↗

Cursor subprocessors (September 2026)

#	Subprocessor	Purpose	Location
1	Amazon Web Services	Primary cloud hosting provider for Cursor's infrastructure. Our infrastructure is primarily hosted on AWS US region with some latency critical services in Europe and Singapore.	US, EU, Singapore
2	Fireworks	Inference infrastructure provider for hosting and serving AI models.	US, Canada, Asia (UAE), EU, UK
3	OpenAI	Provider of proprietary AI models via API. See the OpenAI subprocessor list.	Worldwide
4	Anthropic	Provider of proprietary AI models via API. See the Anthropic subprocessor list.	Worldwide
5	Google Gemini	Provider of proprietary AI models via Vertex API. See Gemini model hosting locations here.	Worldwide
6	Exa	Web search API provider for retrieving web content and search results.	US
7	Datadog	Application logging and monitoring.	US
8	Databricks	Data platform provider for storing and processing analytics data, and inference infrastructure provider for hosting and serving AI models. See Databricks model hosting locations.	Worldwide
9	Vercel	Web hosting and compute services provider.	US
10	Azure	Some secondary infrastructure is hosted on Microsoft Azure.	US
11	Baseten	Inference infrastructure provider for hosting and serving AI models.	US, Canada
12	Cloudflare	CDN, reverse proxy, network security, and Zero Trust tunneling provider. See Cloudflare.	Worldwide
13	Google Cloud Platform	Cloud hosting provider	US
14	Together	Our custom models are hosted with Together. We have a zero data retention agreement with Together.	US, Canada, UK
15	SpaceXAI	Provider of proprietary AI models via API.	US
16	WorkOS	Enterprise authentication and SSO/SCIM provider. See WorkOS.	US
17	Meta	Provider of proprietary AI models via API. See here for more information.	Worldwide

Get an email when Cursor changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Cursor free

AI and customer data at Cursor

What Cursor's own documents say, with the sentence each answer comes from.

Trains AI models on customer data: Yes, unless you opt out

“ANYSPHERE WILL NOT USE CONTENT TO TRAIN, OR ALLOW ANY THIRD PARTY TO TRAIN, ANY AI MODELS, UNLESS YOU'VE EXPLICITLY AGREED TO THE USE OF CONTENT FOR TRAINING.”
Terms of service, cursor.com ↗
Sends customer data to AI model providers: Not stated in the documents we track.
How to opt out: Customers must explicitly opt in via in-service preferences before their Inputs or Suggestions can be used for model training.

“You can find instructions in the Service for how to manage your preferences regarding the use of Inputs and Suggestions for training.”
Terms of service, cursor.com ↗

Key DPA terms at Cursor

What Cursor's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Within 48 hours

“Vendor shall without undue delay, and in any event within forty-eight (48) hours, notify Customer in writing of any breach of security”
DPA, cursor.com ↗
Notice of a new subprocessor: 30 days ahead

“it shall provide Customer with thirty (30) business days' prior written notice by posting updates at trust.cursor.com/subprocessors”
DPA, cursor.com ↗
Transfers outside the EU: Standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions

“the standard contractual clauses for the transfer of Personal Data to third countries set out in Commission Decision 2021/914 of 4 June 2021, specifically including Module 2 (Controller to Processor)”

“Vendor may rely on an adequacy decision, the EU-US Data Privacy Framework, derogations for specific situations under Privacy Laws, or any other lawful mechanism for data transfers”

“Vendor may rely on an adequacy decision, the EU-US Data Privacy Framework, derogations for specific situations under Privacy Laws, or any other lawful mechanism for data transfers”
DPA, cursor.com ↗
Customer data after the contract ends: Deleted within 30 days of the contract ending

“Vendor shall delete or return all Personal Data to Customer as requested at the end of the provision of the Service, within thirty (30) days of such request”
DPA, cursor.com ↗
Audit rights: Once a year

“Customer shall be permitted to conduct such an assessment no more than once every twelve (12) months, upon thirty (30) days' advance written notice to Vendor”
DPA, cursor.com ↗

Documents we track for Cursor

AI terms: checked September 28, 2026 cursor.com ↗
DPA: checked September 28, 2026 cursor.com ↗
Privacy policy: checked September 28, 2026 cursor.com ↗
Subprocessor list: checked September 28, 2026 trust.cursor.com ↗
Terms of service: checked September 28, 2026 cursor.com ↗
Trust page: checked September 28, 2026 cursor.com ↗

Change history

Tracking since September 28, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Cursor subprocessors FAQ

How many subprocessors does Cursor use?: Cursor lists 17 subprocessors on its published list, including Amazon Web Services, Fireworks, OpenAI, Anthropic, and Google Gemini and 12 more.
Where does Cursor process customer data?: The subprocessors named by Cursor are located in US, Worldwide, Canada, EU, UK, and Asia (UAE) and 1 other locations, as stated on its list.
Does Cursor use customer data to train AI models?: According to its terms of service, Cursor uses customer data to train AI models unless customers opt out: “ANYSPHERE WILL NOT USE CONTENT TO TRAIN, OR ALLOW ANY THIRD PARTY TO TRAIN, ANY AI MODELS, UNLESS YOU'VE EXPLICITLY AGREED TO THE USE OF CONTENT FOR TRAINING.”
How quickly does Cursor report a personal data breach to customers?: According to its DPA, Cursor reports a personal data breach to customers within 48 hours: “Vendor shall without undue delay, and in any event within forty-eight (48) hours, notify Customer in writing of any breach of security”
How much notice does Cursor give before adding a subprocessor?: Cursor's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “it shall provide Customer with thirty (30) business days' prior written notice by posting updates at trust.cursor.com/subprocessors”
How does Cursor transfer personal data outside the EU?: Cursor's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “the standard contractual clauses for the transfer of Personal Data to third countries set out in Commission Decision 2021/914 of 4 June 2021, specifically including Module 2 (Controller to Processor)”
When was Cursor's subprocessor list last checked?: ClauseTrail last checked Cursor's subprocessor list on September 28, 2026. Lists are re-checked daily.
How do I find out when Cursor adds or removes a subprocessor?: ClauseTrail monitors Cursor's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.