Cursor vs Windsurf: which signs a HIPAA BAA?
Only Cursor offers a BAA. Anysphere (Cursor) signs one for Cursor only on Enterprise. We couldn't confirm a BAA for Windsurf from Cognition (Windsurf, formerly Codeium)'s own pages.
- Business associate
- Anysphere (Cursor)
- Tool
- Cursor
- Plans with a BAA
- Enterprise
- Checked
- Business associate
- Cognition (Windsurf, formerly Codeium)
- Tool
- Windsurf (formerly Codeium)
- Plans with a BAA
- Not stated
- Checked
Side by side
| CursorAnysphere (Cursor) | WindsurfCognition (Windsurf, formerly Codeium) | |
|---|---|---|
| BAA | Some plans only | Not confirmed |
| Plans with a BAA | Enterprise | Not stated |
| How to get it | Through sales | — |
| AI features outside the BAA partly covered excluded |
| None listed |
| Sources | 2 sources | 5 sources |
| Last checked | Oct 11, 2026 | Oct 11, 2026 |
Every plan
Cursor
- EnterpriseRequires a signed Enterprise agreement and BAA before any PHI is submitted. Privacy Mode must be enabled and locked organization-wide, and users may send PHI only through Eligible Services. The HIPAA Implementation and Configuration Guide forms part of the BAA and is available on request from the Trust Center.Signs a BAA
- TeamsTeams customers are told to contact sales about moving to Enterprise before they request a BAA.No BAA
- Hobby / Pro / individual plansThe BAA page names only Enterprise and does not mention individual plans.Not confirmed
Windsurf
- Free / Pro / TeamsThe pricing page does not mention HIPAA, BAAs or zero data retention for any plan.Not confirmed
- EnterpriseEnterprise is sales-led ('Let's talk'). No current official page says whether a BAA is available. Cognition's trust center lists SOC 2 Type 2, ISO/IEC 27001:2022 and CCPA, but not HIPAA.Not confirmed
- Windsurf for Government (FedRAMP)The government page claims FedRAMP High, DoW IL4-IL6 and ITAR, but does not mention HIPAA or BAAs.Not confirmed
If you handle patient data
Use Cursor on a plan listed above, and sign the BAA before anyone enters protected health information. Don't put PHI into Windsurf unless Cognition (Windsurf, formerly Codeium) gives you a BAA in writing. Other Windsurf alternatives that sign a BAA
More comparisons
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.