# Cursor – Anysphere ## Kurzbeschreibung **"Built to make you extraordinarily productive, Cursor is the best way to code with AI."** **Cursor** is an AI-powered development environment for software development with agents, autocomplete, CLI, cloud agents, and code review features. Officially, Cursor is positioned as a tool that enables developers to delegate tasks to agents, write code faster, and work in parallel across multiple environments. More recent releases add, among other things, an agent-centric interface, parallel multitasking with subagents, canvases, and automations. ## Claim Built to make you extraordinarily productive, Cursor is the best way to code with AI ## Geeignet für - API Integration - Automation / Workflows - Productivity & Planning - Programming / Software Development - Websites / Landing Pages ## Kernfunktionen - App Development - AI Agents - Programming ## Preismodell - **free:** Free use without a credit card, limited agent requests and limited tab completion. - **subscription:** **Pro** Extended agent limits, access to frontier models, MCPs, Skills, Hooks, and Cloud Agents. **Pro+** Everything in Pro plus significantly more usage for OpenAI, Claude, and Gemini models. **Ultra** Everything in Pro plus very high usage and priority access to new features. **Teams** Everything in Pro plus shared chats, Commands and Rules, centralized billing, usage analytics, org-wide Privacy Mode, RBAC, and SAML/OIDC SSO. - **other:** **Enterprise** Pooled Usage, Invoice/PO Billing, SCIM, AI Code Tracking API, Audit Logs, granular admin/model controls, Priority Support, and Account Management. **Bugbot **Separate code review/bug detection offering with Pro, Teams, and Enterprise options. ## DSGVO und Datenschutz **Gesamteinschätzung:** Conditional **On-premises / local hosting: partially** There is a documented option for "self-hosted cloud agents" on your own infrastructure. However, this does not cover the complete on-premises solution, because according to the description, the Cursor Agent Harness handles inference and planning via Cursor Cloud, and only tool execution takes place on the user’s own machine. **Private Cloud / Data Center: Partially** The website states that agent workloads can run on your own infrastructure or in your own cloud environment. This is a private cloud path for part of the product, but not a complete private deployment of the entire solution. **EU SaaS / Managed: Indirect / Not Available** The website does not specify an EU-SaaS service operated by the provider with explicit EU/EEA data residency. Instead, the Privacy Policy mentions processing in various jurisdictions, including the U.S., and transfers for EEA users outside the EEA/UK. **Hybrid: covered** The self-hosted cloud agents are explicitly documented as a hybrid model: workers, code, and tool execution run on the customer’s own infrastructure, while inference and planning are handled via Cursor Cloud. **T&Cs / DPA: Covered** A Data Processing Addendum is published on the website at /terms/dpa. It describes subprocessors, notifications in the event of changes, and protection obligations. **No Training: Partially** A clear opt-out/no-training path is provided via “Privacy Mode”: Customer data is then not used for training by Cursor, and ZDR agreements with providers apply. However, the website also notes that when “Privacy Mode” is disabled, data may be used for improvement and training, and that abuse/risk checks may temporarily store data. **Open Source / Transparency Path: Indirect / Not Available** A true open-source, open-model, or self-hostable end-to-end path is not specified on the website. While there is transparency regarding security, the DPA, and subprocessors, as well as an infrastructure path for self-hosted agents, there is no clear open-source documentation for the entire product. **Data Processing** The documented standard processing is provided as a cloud service by Cursor/Anysphere, with processing taking place in various jurisdictions. Even when using a custom API key, requests continue to run through the Cursor backend, according to the Data Use page. When “Privacy Mode” is enabled, the website states that customer data will not be used for training and that providers adhere to zero data retention; however, the company reserves the right to conduct abuse and risk assessments. For Cloud Agents, there is a hybrid self-hosted option where code, tool execution, and build artifacts can remain in your own environment, while planning and inference run via the Cursor cloud. **Conclusion** According to the website documentation, Cursor cannot be clearly classified as a standard SaaS service with EU residency for EU/EEA users. Positive aspects include the DPA, the disclosure regarding subprocessors, SOC 2 Type II certification, and a documented “no-training” path via “Privacy Mode.” At the same time, there is no clearly designated EU/EEA data center, no binding EU data residency requirement, and no complete on-premises/self-hosting path for the entire product. Therefore, its use under the GDPR is at best **conditionally** acceptable, particularly with the DPA and “Privacy Mode”; for particularly sensitive EU/EEA requirements, the documentation remains incomplete. **Sources** - [https://cursor.com/en-US/privacy](https://cursor.com/en-US/privacy) - [https://cursor.com/data-use](https://cursor.com/data-use) - [https://cursor.com/en-US/security](https://cursor.com/en-US/security) - [https://cursor.com/terms/dpa](https://cursor.com/terms/dpa) - [https://cursor.com/blog/self-hosted-cloud-agents](https://cursor.com/blog/self-hosted-cloud-agents) For users in the EU/EEA, use that is **conditionally** GDPR-compliant is documented, but not as a simple standard SaaS offering with EU data residency. Positive aspects include a published privacy policy, a Data Processing Addendum, a published list of subprocessors on the Trust Portal, documented data subject rights, and a clear “no training/zero data retention” path via “Privacy Mode.” On the negative side, according to the privacy policy, Anysphere processes personal data on servers in various jurisdictions, *including the U.S.*, and data for EEA users may be transferred to U.S. servers or other countries outside the EEA/UK. The website does not specify an explicit EU data residency or an EU/EEA data center for the main SaaS environment. The best-documented way to achieve greater GDPR compliance is therefore to use “Privacy Mode” in conjunction with a DPA; for Cloud Agents, there is also a self-hosted infrastructure option, but it does not replace the entire Cursor Cloud, as inference and planning continue to run via the Cursor Cloud. **Positive** Privacy policy available; DPA/AVV available; subprocessors are listed at trust.cursor.com/subprocessors; data subject rights for users are described; 'Privacy Mode' is documented, including 'zero data retention' by providers and a statement that customer data will not be used by Cursor for training; SOC 2 Type II is mentioned on the security page; for Cloud Agents, there is a self-hosted option on the user’s own infrastructure. **Negative** The website does not specify guaranteed EU/EEA data residency for the standard SaaS offering. According to the Privacy Policy, processing takes place on servers in various jurisdictions, including the U.S.; for EEA users, data may be transferred to U.S. servers or other countries outside the EEA/UK. A specific server location in the EU/EEA, a dedicated EU data center, or ISO 27001 certification are not specified on the website. The self-hosted agent option is only a partial solution because planning and inference still run through Cursor Cloud. **Server Location** The website does not specify a specific EU/EEA server location. The Privacy Policy only states that personal data is processed on servers in various jurisdictions, including the U.S., and that for users in the EEA, data may be transferred to U.S. servers or other countries outside the EEA/UK. No EU data residency is specified on the website. ## Hosting und Daten - **On-Prem / lokales Hosting:** teilweise / indirekt - **Private Cloud / Rechenzentrum:** teilweise / indirekt - **EU SaaS / Managed:** unknown - **Hybrid:** abgedeckt - **AVV / DPA:** abgedeckt - **Kein Training auf Kundendaten:** teilweise / indirekt - **Open-Source / Transparenz-Pfad:** unknown ## Standort **Land:** USA **Taxonomie:** USA Anysphere, Inc., 2261 Market Street STE 86466, San Francisco, CA 94114, USA. ## Vorteile - Very strong focus on agentic software development rather than just chat in the editor. - Parallelization: agents can work locally, in worktrees, in the cloud, and via remote SSH. - Specialized tab model for very fast autocompletion. - Pro includes frontier models, MCPs, Skills, Hooks, and Cloud Agents. - SOC 2 Type II and publicly documented security/privacy materials. ## Nachteile - No publicly documented on-prem/self-hosted model for the complete service; the AI functions run via Cursor infrastructure and model providers. - Primary servers are located in the USA; therefore, data protection for EU organizations is not “automatically” unproblematic. - When Privacy Mode is disabled, Cursor may use code/prompt/editor data to improve AI functions and for model training. - Even when using your own API key, requests still continue to run through the Cursor backend according to Cursor. - The Free plan is functionally limited; additional usage may be billed on a usage-based basis. ## Quellen - Offizielle Website: https://cursor.com/ ## Letzter Datenstand 2026-04-25 ## Originalseite https://kifox.ai/en/ki-tools/cursor-anysphere-en/