Bolt.new vs. Cursor: data protection per plan
Bolt.new (4 plans) and Cursor (5 plans) side by side: DPA, training on inputs, hosting and data retention per plan, based on the providers’ public documents. Without rating.
Last updated: (latest review date of the tools shown)
At a glance
Each value is listed with the plans it applies to. Pick a tier to see only plans of that tier; if plans are chosen in the plan comparison below, the table shows exactly those.
All plans: each value is listed with the plans it applies to.
| Feature | Bolt.new | Cursor |
|---|---|---|
| Provider based in | StackBlitz, Inc., 1160 Battery Street, Suite 30W, San Francisco, CA 94111, USA | Anysphere, Inc., 2261 Market Street STE 86466, San Francisco, CA 94114, USA |
| Plans recorded | 4 | 5 |
| Hosting | US only: all 4 plans | mixed: all 5 plans |
| Training on inputs | opt-out available: Free, Prono: Teams, Enterprise | opt-out available: all 5 plans |
| DPA | not documented: all 4 plans | not documented: Free, Plus, Premium / Super / Ultra, Teamsyes: Enterprise |
| As of | 18 Oct 2026 | 18 Oct 2026 |
Plans compared
Comparing: Bolt.new Teams vs. Cursor Teams
| Feature | Bolt.newTeams | CursorTeams |
|---|---|---|
| not publicly documented | not publicly documented | |
| Details: DPA available | not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found) | not publicly documented (the public DPA refers to a Master Services Agreement with Anysphere; according to the Terms of Service an MSA applies only if the organisation has concluded one; the Privacy Policy mentions a processor role only generally 'For commercial uses of the Service') |
| differs by plan | no | opt-out available |
| Details: Training on inputs | Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general. | Data Use (as of 2026-09-03): with Privacy Mode enabled, Customer Data is not used by Cursor for training; Cursor has zero data retention agreements with all model providers, and the providers do not store or train on the data. Exception: risk classifiers; where abuse detection is triggered, data may be stored for investigation. Non-ZDR models are labelled or require admin approval. Without Privacy Mode, Cursor may store codebase data, prompts, editor actions and code snippets and use them to train its own models. Teams: team-wide privacy settings; new members inherit the team setting; admins can enforce Privacy Mode. |
| differs by plan | US only | mixed |
| Details: Data residency | Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented. | Privacy Policy (as of 2026-10-11): processing on servers in various jurisdictions, including the US; data of EEA users may be transferred to the US. Sub-processor list (Trust Center): 'Our infrastructure is primarily hosted on AWS US region with some latency critical services in Europe and Singapore.' Docs: data residency only for Enterprise; US-only (inference, processing, storage incl. backups in the US, 10% uplift); EU/UK inference only on request, further EU coverage in development. |
| list available | list available | |
| Details: List published |
|
|
| differs by plan | Privacy policy section 11: storage as… | With Privacy Mode: ZDR with model… |
| Details: Data retention | Privacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented. | With Privacy Mode: ZDR with model providers; file contents are encrypted to reduce latency and cached only for the duration of the request. Cloud Agents: according to the documentation, repository contents are stored only during the agent run and deleted afterwards. Without Privacy Mode: inference providers may temporarily store inputs/outputs, which are deleted afterwards. Personal data in general: only as long as necessary (Privacy Policy); specific retention periods not publicly documented. |
| differs by plan | 30 USD/user/mo… (further prices in the details) | from 30 USD/user/mo |
| Details: Price | 30 USD per month per member with monthly payment or 27 USD per month per member with annual payment (pricing page; net/gross not stated) | from USD 30 per user per month (pricing page: "$30+/user/month", excl. taxes); seat types can be combined. |
| yes | yes | |
| Details: AI features included | yes (features of Pro plus centralised billing, team management, admin controls) | yes (as Premium, plus team marketplace, centralised billing, team-wide privacy settings, custom chat data retention, SAML/OIDC SSO; usage 4x to 50x Plus depending on seat tier) |
| 5 sources | 6 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- Bolt.new Teamsnot publicly documented
- Cursor Teamsnot publicly documented
- Bolt.new Teams
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
Cursor Teamsnot publicly documented (the public DPA refers to a Master Services Agreement with Anysphere; according to the Terms of Service an MSA applies only if the organisation has concluded one; the Privacy Policy mentions a processor role only generally 'For commercial uses of the Service')
Training
- differs by plan
- Bolt.new Teamsno
- Cursor Teamsopt-out available
- Bolt.new Teams
Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general.
Cursor TeamsData Use (as of 2026-09-03): with Privacy Mode enabled, Customer Data is not used by Cursor for training; Cursor has zero data retention agreements with all model providers, and the providers do not store or train on the data. Exception: risk classifiers; where abuse detection is triggered, data may be stored for investigation. Non-ZDR models are labelled or require admin approval. Without Privacy Mode, Cursor may store codebase data, prompts, editor actions and code snippets and use them to train its own models. Teams: team-wide privacy settings; new members inherit the team setting; admins can enforce Privacy Mode.
Hosting
- differs by plan
- Bolt.new TeamsUS only
- Cursor Teamsmixed
- Bolt.new Teams
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.
Cursor TeamsPrivacy Policy (as of 2026-10-11): processing on servers in various jurisdictions, including the US; data of EEA users may be transferred to the US. Sub-processor list (Trust Center): 'Our infrastructure is primarily hosted on AWS US region with some latency critical services in Europe and Singapore.' Docs: data residency only for Enterprise; US-only (inference, processing, storage incl. backups in the US, 10% uplift); EU/UK inference only on request, further EU coverage in development.
Sub-processors
- Bolt.new Teamslist available
- Cursor Teamslist available
- Bolt.new Teams
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
Cursor Teams- Amazon Web Services (primary cloud hosting; US, EU, Singapore)
- Further infrastructure: Microsoft Azure (secondary, US), Google Cloud Platform (US), Vercel (web hosting, US), Cloudflare (CDN/network security, worldwide)
- Model providers: OpenAI, Anthropic, Google Gemini (Vertex API), Meta (each worldwide), SpaceXAI (US), TypeSafe AI (US)
- Inference infrastructure: Fireworks (US, Canada, EU, UK), Baseten (US, Canada), Together (own models, with a ZDR agreement according to the list; US, Canada, UK), Nebius (UK), CoreWeave (US), Databricks (analytics database and inference, worldwide)
- Exa (web search, US), Datadog (logging/monitoring, US), WorkOS (SSO/SCIM, US)
Retention
- differs by plan
- Bolt.new TeamsPrivacy policy section 11: storage as…
- Cursor TeamsWith Privacy Mode: ZDR with model…
- Bolt.new TeamsPrivacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented.Cursor TeamsWith Privacy Mode: ZDR with model providers; file contents are encrypted to reduce latency and cached only for the duration of the request. Cloud Agents: according to the documentation, repository contents are stored only during the agent run and deleted afterwards. Without Privacy Mode: inference providers may temporarily store inputs/outputs, which are deleted afterwards. Personal data in general: only as long as necessary (Privacy Policy); specific retention periods not publicly documented.
Price
- differs by plan
- Bolt.new Teams30 USD/user/mo… (further prices in the details)
- Cursor Teamsfrom 30 USD/user/mo
- Bolt.new Teams
30 USD per month per member with monthly payment or 27 USD per month per member with annual payment (pricing page; net/gross not stated)
Cursor Teamsfrom USD 30 per user per month (pricing page: "$30+/user/month", excl. taxes); seat types can be combined.
- Bolt.new Teamsyes
- Cursor Teamsyes
- Bolt.new Teams
yes (features of Pro plus centralised billing, team management, admin controls)
Cursor Teamsyes (as Premium, plus team marketplace, centralised billing, team-wide privacy settings, custom chat data retention, SAML/OIDC SSO; usage 4x to 50x Plus depending on seat tier)
Evidence
- Bolt.new Teams5 sources
- Cursor Teams6 sources
- Bolt.new Teams
- PricingPricing page, retrieved 18 Oct 2026
- StackBlitz Privacy Policy (as of 2026-09-22)Privacy notice, retrieved 14 Oct 2026
- StackBlitz Terms of Service (as of 2026-09-22)Terms and conditions, retrieved 14 Oct 2026
- Bolt.new Customer Assurance Profile (Trust Center)Trust Center, retrieved 18 Oct 2026
- Bolt SecuritySecurity page, retrieved 14 Oct 2026
Cursor Teams- PricingPricing page, retrieved 18 Oct 2026
- Security (as of 2026-08-25)Trust Center, retrieved 18 Oct 2026
- Data Use & Privacy Overview (as of 2026-09-03)Privacy notice, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-10-11)Privacy notice, retrieved 18 Oct 2026
- Docs: Privacy and data governanceDocumentation, retrieved 18 Oct 2026
- Trust Center: Subprocessors (Vanta, 20 entries)Sub-processor list, retrieved 18 Oct 2026
| Feature | Bolt.new | Cursor |
|---|---|---|
| differs by tool | not publicly documentedall 4 plans |
|
| Details: DPA available |
|
|
| differs by tool |
| opt-out availableall 5 plans |
| Details: Training on inputs |
|
|
| differs by tool | US onlyall 4 plans | mixedall 5 plans |
| Details: Data residency |
|
|
| list availableall 4 plans | list availableall 5 plans | |
| Details: List published |
|
|
| differs by tool | Privacy policy section 11: storage as…all 4 plans | With Privacy Mode: ZDR with model…all 5 plans |
| Details: Data retention |
|
|
| differs by tool |
|
|
| Details: Price |
|
|
| yesall 4 plans | yesall 5 plans | |
| Details: AI features included |
|
|
| 7 sources | 8 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- differs by tool
- Bolt.newnot publicly documentedall 4 plans
- Cursor
- not publicly documentedFree (free of charge), Plus, Premium / Super / Ultra (Individual), Teams
- yesEnterprise
- Bolt.new
- Free
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
- Pro
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
- Teams
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
- Enterprise
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
Cursor- Free (free of charge)
not publicly documented (the public DPA refers to a Master Services Agreement with Anysphere; according to the Terms of Service an MSA applies only if the organisation has concluded one; the Privacy Policy mentions a processor role only generally 'For commercial uses of the Service')
- Plus
not publicly documented (the public DPA refers to a Master Services Agreement with Anysphere; according to the Terms of Service an MSA applies only if the organisation has concluded one; the Privacy Policy mentions a processor role only generally 'For commercial uses of the Service')
- Premium / Super / Ultra (Individual)
not publicly documented (the public DPA refers to a Master Services Agreement with Anysphere; according to the Terms of Service an MSA applies only if the organisation has concluded one; the Privacy Policy mentions a processor role only generally 'For commercial uses of the Service')
- Teams
not publicly documented (the public DPA refers to a Master Services Agreement with Anysphere; according to the Terms of Service an MSA applies only if the organisation has concluded one; the Privacy Policy mentions a processor role only generally 'For commercial uses of the Service')
- Enterprise
yes (public DPA, applies together with the Master Services Agreement; EU SCCs Module Two and UK Addendum)
Provider’s DPA
- Free
Training
- differs by tool
- Bolt.new
- opt-out availableFree, Pro
- noTeams, Enterprise
- Cursoropt-out availableall 5 plans
- Bolt.new
- Free
Privacy policy (as of 2026-09-22) section 5.C: Bolt may use inputs, outputs, interaction data and project files arising from Bolt AI features from 2026-10-07 onwards for training/fine-tuning its own models and may license de-identified datasets to third parties for remuneration, unless the user objects (opt-out free of charge, regardless of plan, in the account settings or by email; implemented within 15 days). Accounts in the EEA, the United Kingdom and Switzerland are exempt; accounts whose location cannot be determined are treated like EEA accounts. When 'Bolt Forge' is activated (Terms 3.6), the opt-out does not apply as long as Forge is active.
- Pro
Privacy policy (as of 2026-09-22) section 5.C: Bolt may use inputs, outputs, interaction data and project files arising from Bolt AI features from 2026-10-07 onwards for training/fine-tuning its own models and may license de-identified datasets to third parties for remuneration, unless the user objects (opt-out free of charge, regardless of plan, in the account settings or by email; implemented within 15 days). Accounts in the EEA, the United Kingdom and Switzerland are exempt; accounts whose location cannot be determined are treated like EEA accounts. When 'Bolt Forge' is activated (Terms 3.6), the opt-out does not apply as long as Forge is active. Help Center 'Bolt Forge': when Forge is used, prompts, code, project files, configuration, tool calls and edit histories are stored in de-identified form and used by Bolt's partners to train open-source models (consent before first use of Forge); sessions from the EEA, UK and Switzerland are exempt; switching to another agent only stops future collection, data already collected is removed only on request to privacy@stackblitz.com.
- Teams
Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general.
- Enterprise
Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general.
Cursor- Free (free of charge)
Data Use (as of 2026-09-03): with Privacy Mode enabled, Customer Data is not used by Cursor for training; Cursor has zero data retention agreements with all model providers, and the providers do not store or train on the data. Exception: risk classifiers; where abuse detection is triggered, data may be stored for investigation. Non-ZDR models are labelled or require admin approval. Without Privacy Mode, Cursor may store codebase data, prompts, editor actions and code snippets and use them to train its own models. According to the Security page, Privacy Mode is also available for Free and can be enabled in the settings; default setting for individual accounts not publicly documented.
- Plus
Data Use (as of 2026-09-03): with Privacy Mode enabled, Customer Data is not used by Cursor for training; Cursor has zero data retention agreements with all model providers, and the providers do not store or train on the data. Exception: risk classifiers; where abuse detection is triggered, data may be stored for investigation. Non-ZDR models are labelled or require admin approval. Without Privacy Mode, Cursor may store codebase data, prompts, editor actions and code snippets and use them to train its own models. According to the Security page, Privacy Mode is available for Free and Pro and can be enabled in the settings; default setting for individual accounts not publicly documented.
- Premium / Super / Ultra (Individual)
Data Use (as of 2026-09-03): with Privacy Mode enabled, Customer Data is not used by Cursor for training; Cursor has zero data retention agreements with all model providers, and the providers do not store or train on the data. Exception: risk classifiers; where abuse detection is triggered, data may be stored for investigation. Non-ZDR models are labelled or require admin approval. Without Privacy Mode, Cursor may store codebase data, prompts, editor actions and code snippets and use them to train its own models. According to the Security page, Privacy Mode is available for Free and Pro and can be enabled in the settings; default setting for individual accounts not publicly documented.
- Teams
Data Use (as of 2026-09-03): with Privacy Mode enabled, Customer Data is not used by Cursor for training; Cursor has zero data retention agreements with all model providers, and the providers do not store or train on the data. Exception: risk classifiers; where abuse detection is triggered, data may be stored for investigation. Non-ZDR models are labelled or require admin approval. Without Privacy Mode, Cursor may store codebase data, prompts, editor actions and code snippets and use them to train its own models. Teams: team-wide privacy settings; new members inherit the team setting; admins can enforce Privacy Mode.
- Enterprise
Data Use (as of 2026-09-03): with Privacy Mode enabled, Customer Data is not used by Cursor for training; Cursor has zero data retention agreements with all model providers, and the providers do not store or train on the data. Exception: risk classifiers; where abuse detection is triggered, data may be stored for investigation. Non-ZDR models are labelled or require admin approval. Without Privacy Mode, Cursor may store codebase data, prompts, editor actions and code snippets and use them to train its own models. Enterprise: according to the documentation, Privacy Mode is enabled by default and enforceable; requests to models with provider-side storage (according to the documentation, Claude Fable 5 and 5.1) fail until an admin approves the retention policy.
- Free
Hosting
- differs by tool
- Bolt.newUS onlyall 4 plans
- Cursormixedall 5 plans
- Bolt.new
- Free
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.
- Pro
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.
- Teams
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.
- Enterprise
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented. For Enterprise, the pricing page mentions 'Data governance & retention policies'; location options are not described.
Cursor- Free (free of charge)
Privacy Policy (as of 2026-10-11): processing on servers in various jurisdictions, including the US; data of EEA users may be transferred to the US. Sub-processor list (Trust Center): 'Our infrastructure is primarily hosted on AWS US region with some latency critical services in Europe and Singapore.' Docs: data residency only for Enterprise; US-only (inference, processing, storage incl. backups in the US, 10% uplift); EU/UK inference only on request, further EU coverage in development.
- Plus
Privacy Policy (as of 2026-10-11): processing on servers in various jurisdictions, including the US; data of EEA users may be transferred to the US. Sub-processor list (Trust Center): 'Our infrastructure is primarily hosted on AWS US region with some latency critical services in Europe and Singapore.' Docs: data residency only for Enterprise; US-only (inference, processing, storage incl. backups in the US, 10% uplift); EU/UK inference only on request, further EU coverage in development.
- Premium / Super / Ultra (Individual)
Privacy Policy (as of 2026-10-11): processing on servers in various jurisdictions, including the US; data of EEA users may be transferred to the US. Sub-processor list (Trust Center): 'Our infrastructure is primarily hosted on AWS US region with some latency critical services in Europe and Singapore.' Docs: data residency only for Enterprise; US-only (inference, processing, storage incl. backups in the US, 10% uplift); EU/UK inference only on request, further EU coverage in development.
- Teams
Privacy Policy (as of 2026-10-11): processing on servers in various jurisdictions, including the US; data of EEA users may be transferred to the US. Sub-processor list (Trust Center): 'Our infrastructure is primarily hosted on AWS US region with some latency critical services in Europe and Singapore.' Docs: data residency only for Enterprise; US-only (inference, processing, storage incl. backups in the US, 10% uplift); EU/UK inference only on request, further EU coverage in development.
- Enterprise
Privacy Policy (as of 2026-10-11): processing on servers in various jurisdictions, including the US; data of EEA users may be transferred to the US. Sub-processor list (Trust Center): 'Our infrastructure is primarily hosted on AWS US region with some latency critical services in Europe and Singapore.' Docs: data residency only for Enterprise; US-only (inference, processing, storage incl. backups in the US, 10% uplift); EU/UK inference only on request, further EU coverage in development.
- Free
Sub-processors
- Bolt.newlist availableall 4 plans
- Cursorlist availableall 5 plans
- Bolt.new
- Free
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
- Pro
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
- Teams
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
- Enterprise
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
Cursor- Free (free of charge)
- Amazon Web Services (primary cloud hosting; US, EU, Singapore)
- Further infrastructure: Microsoft Azure (secondary, US), Google Cloud Platform (US), Vercel (web hosting, US), Cloudflare (CDN/network security, worldwide)
- Model providers: OpenAI, Anthropic, Google Gemini (Vertex API), Meta (each worldwide), SpaceXAI (US), TypeSafe AI (US)
- Inference infrastructure: Fireworks (US, Canada, EU, UK), Baseten (US, Canada), Together (own models, with a ZDR agreement according to the list; US, Canada, UK), Nebius (UK), CoreWeave (US), Databricks (analytics database and inference, worldwide)
- Exa (web search, US), Datadog (logging/monitoring, US), WorkOS (SSO/SCIM, US)
- Plus
- Amazon Web Services (primary cloud hosting; US, EU, Singapore)
- Further infrastructure: Microsoft Azure (secondary, US), Google Cloud Platform (US), Vercel (web hosting, US), Cloudflare (CDN/network security, worldwide)
- Model providers: OpenAI, Anthropic, Google Gemini (Vertex API), Meta (each worldwide), SpaceXAI (US), TypeSafe AI (US)
- Inference infrastructure: Fireworks (US, Canada, EU, UK), Baseten (US, Canada), Together (own models, with a ZDR agreement according to the list; US, Canada, UK), Nebius (UK), CoreWeave (US), Databricks (analytics database and inference, worldwide)
- Exa (web search, US), Datadog (logging/monitoring, US), WorkOS (SSO/SCIM, US)
- Premium / Super / Ultra (Individual)
- Amazon Web Services (primary cloud hosting; US, EU, Singapore)
- Further infrastructure: Microsoft Azure (secondary, US), Google Cloud Platform (US), Vercel (web hosting, US), Cloudflare (CDN/network security, worldwide)
- Model providers: OpenAI, Anthropic, Google Gemini (Vertex API), Meta (each worldwide), SpaceXAI (US), TypeSafe AI (US)
- Inference infrastructure: Fireworks (US, Canada, EU, UK), Baseten (US, Canada), Together (own models, with a ZDR agreement according to the list; US, Canada, UK), Nebius (UK), CoreWeave (US), Databricks (analytics database and inference, worldwide)
- Exa (web search, US), Datadog (logging/monitoring, US), WorkOS (SSO/SCIM, US)
- Teams
- Amazon Web Services (primary cloud hosting; US, EU, Singapore)
- Further infrastructure: Microsoft Azure (secondary, US), Google Cloud Platform (US), Vercel (web hosting, US), Cloudflare (CDN/network security, worldwide)
- Model providers: OpenAI, Anthropic, Google Gemini (Vertex API), Meta (each worldwide), SpaceXAI (US), TypeSafe AI (US)
- Inference infrastructure: Fireworks (US, Canada, EU, UK), Baseten (US, Canada), Together (own models, with a ZDR agreement according to the list; US, Canada, UK), Nebius (UK), CoreWeave (US), Databricks (analytics database and inference, worldwide)
- Exa (web search, US), Datadog (logging/monitoring, US), WorkOS (SSO/SCIM, US)
- Enterprise
- Amazon Web Services (primary cloud hosting; US, EU, Singapore)
- Further infrastructure: Microsoft Azure (secondary, US), Google Cloud Platform (US), Vercel (web hosting, US), Cloudflare (CDN/network security, worldwide)
- Model providers: OpenAI, Anthropic, Google Gemini (Vertex API), Meta (each worldwide), SpaceXAI (US), TypeSafe AI (US)
- Inference infrastructure: Fireworks (US, Canada, EU, UK), Baseten (US, Canada), Together (own models, with a ZDR agreement according to the list; US, Canada, UK), Nebius (UK), CoreWeave (US), Databricks (analytics database and inference, worldwide)
- Exa (web search, US), Datadog (logging/monitoring, US), WorkOS (SSO/SCIM, US)
- Free
Retention
- differs by tool
- Bolt.newPrivacy policy section 11: storage as…all 4 plans
- CursorWith Privacy Mode: ZDR with model…all 5 plans
- Bolt.new
- FreePrivacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented.
- ProPrivacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented.
- TeamsPrivacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented.
- EnterprisePrivacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented. Enterprise: retention policies configurable according to the pricing page (details not publicly documented).
Cursor- Free (free of charge)With Privacy Mode: ZDR with model providers; file contents are encrypted to reduce latency and cached only for the duration of the request. Cloud Agents: according to the documentation, repository contents are stored only during the agent run and deleted afterwards. Without Privacy Mode: inference providers may temporarily store inputs/outputs, which are deleted afterwards. Personal data in general: only as long as necessary (Privacy Policy); specific retention periods not publicly documented.
- PlusWith Privacy Mode: ZDR with model providers; file contents are encrypted to reduce latency and cached only for the duration of the request. Cloud Agents: according to the documentation, repository contents are stored only during the agent run and deleted afterwards. Without Privacy Mode: inference providers may temporarily store inputs/outputs, which are deleted afterwards. Personal data in general: only as long as necessary (Privacy Policy); specific retention periods not publicly documented.
- Premium / Super / Ultra (Individual)With Privacy Mode: ZDR with model providers; file contents are encrypted to reduce latency and cached only for the duration of the request. Cloud Agents: according to the documentation, repository contents are stored only during the agent run and deleted afterwards. Without Privacy Mode: inference providers may temporarily store inputs/outputs, which are deleted afterwards. Personal data in general: only as long as necessary (Privacy Policy); specific retention periods not publicly documented.
- TeamsWith Privacy Mode: ZDR with model providers; file contents are encrypted to reduce latency and cached only for the duration of the request. Cloud Agents: according to the documentation, repository contents are stored only during the agent run and deleted afterwards. Without Privacy Mode: inference providers may temporarily store inputs/outputs, which are deleted afterwards. Personal data in general: only as long as necessary (Privacy Policy); specific retention periods not publicly documented.
- EnterpriseWith Privacy Mode: ZDR with model providers; file contents are encrypted to reduce latency and cached only for the duration of the request. Cloud Agents: according to the documentation, repository contents are stored only during the agent run and deleted afterwards. Without Privacy Mode: inference providers may temporarily store inputs/outputs, which are deleted afterwards. Personal data in general: only as long as necessary (Privacy Policy); specific retention periods not publicly documented.
Price
- differs by tool
- Bolt.new
- 0 USDFree
- 25 USD/mo… (further prices in the details)Pro
- 30 USD/user/mo… (further prices in the details)Teams
- customEnterprise
- Cursor
- 0 USD/moFree (free of charge)
- 8 USD/moPlus
- several tiersPremium / Super / Ultra (Individual)
- from 30 USD/user/moTeams
- customEnterprise
- Bolt.new
- Free
0 USD (pricing page; net/gross not stated)
- Pro
25 USD per month with monthly payment or 18 USD per month with annual payment (pricing page; net/gross not stated)
- Teams
30 USD per month per member with monthly payment or 27 USD per month per member with annual payment (pricing page; net/gross not stated)
- Enterprise
Individual (pricing page: 'Custom')
Cursor- Free (free of charge)
USD 0 per month (pricing page; prices excl. taxes such as VAT)
- Plus
USD 8 per month (pricing page, excl. taxes). According to the pricing page FAQ, subscriptions are sold via X Subscription Corp.
- Premium / Super / Ultra (Individual)
Premium USD 30, Super USD 100, Ultra USD 200 per month (pricing page, excl. taxes); third-party models are billed separately based on usage. According to the FAQ, sold via X Subscription Corp.
- Teams
from USD 30 per user per month (pricing page: "$30+/user/month", excl. taxes); seat types can be combined.
- Enterprise
Custom (pricing page: 'Custom'); invoice/PO billing available
- Free
- Bolt.newyesall 4 plans
- Cursoryesall 5 plans
- Bolt.new
- Free
yes (AI app builder; 300,000 tokens per day, 1 million tokens per month)
- Pro
yes (no daily limit, from 10M tokens per month, unused tokens roll over); according to the Help Center, Bolt Forge (agent using open-source models) was included at no extra cost during the research preview from 2026-09-14 to 2026-10-14, after which Pro no longer has Forge access
- Teams
yes (features of Pro plus centralised billing, team management, admin controls)
- Enterprise
yes (features of Pro plus SSO, audit logs, compliance support, data governance and retention policies)
Cursor- Free (free of charge)
yes (limited AI usage, limited Agent and chat requests; Grok Chat/Imagine/Build limited)
- Plus
yes (shared AI usage pool; according to the pricing page, Grok models only; Grok Chat, Voice, Imagine, Build, Grok API access; plus X features)
- Premium / Super / Ultra (Individual)
yes (Premium 4x, Super 15x, Ultra 50x usage compared with Plus; Cloud Agents and automations, Bugbot, third-party models at API list price, Grok Bot, video generation; plus X features)
- Teams
yes (as Premium, plus team marketplace, centralised billing, team-wide privacy settings, custom chat data retention, SAML/OIDC SSO; usage 4x to 50x Plus depending on seat tier)
- Enterprise
yes (as Teams, plus pooled usage, invoice/PO, SCIM, access, network and model controls, audit logs, Priority Support; optional US data residency)
- Free
Evidence
- Bolt.new7 sources
- Cursor8 sources
- Bolt.new
- PricingPricing page, retrieved 18 Oct 2026
- StackBlitz Privacy Policy (as of 2026-09-22)Privacy notice, retrieved 14 Oct 2026
- StackBlitz Terms of Service (as of 2026-09-22)Terms and conditions, retrieved 14 Oct 2026
- Bolt.new Customer Assurance Profile (Trust Center)Trust Center, retrieved 18 Oct 2026
- Bolt SecuritySecurity page, retrieved 14 Oct 2026
- Help Center: Bolt ForgeHelp Center, retrieved 18 Oct 2026
- What is Bolt Forge? (Bolt blog)Provider blog, retrieved 18 Oct 2026
Cursor- PricingPricing page, retrieved 18 Oct 2026
- Security (as of 2026-08-25)Trust Center, retrieved 18 Oct 2026
- Data Use & Privacy Overview (as of 2026-09-03)Privacy notice, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-10-11)Privacy notice, retrieved 18 Oct 2026
- Data Processing Addendum (as of 2025-11-05)DPA, retrieved 18 Oct 2026
- Docs: Privacy and data governanceDocumentation, retrieved 18 Oct 2026
- Trust Center: Subprocessors (Vanta, 20 entries)Sub-processor list, retrieved 18 Oct 2026
- SpaceXAI Bundled Subscription Terms (X Subscription Corp)Terms and conditions, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
No guarantee of accuracy, not legal advice. Each entry is valid as of the date shown. Open points are listed on the detail pages.
More comparisons
Bolt.new compared with
Individual pages: Bolt.new, Cursor. All tools in the category: Software development.