CURSOR

CURSOR publishes an ISO certificate on its trust center; you can request access through SOC2C.

Security isn't a single yes/no, but CURSOR is SOC 2 Type II compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

CURSOR hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@cursor.com or via a /security page.

CURSOR lists 17 subprocessors on its trust center, including Amazon Web Services, Fireworks, OpenAI, Anthropic, Google Gemini. Buyers use this for fourth-party risk review.

CURSOR hosts on AWS, GCP, Azure. Data residency details are on its trust center.

CURSOR's trust center is at https://trust.cursor.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

#### Compliance certifications and frameworks - SOC 2 Type II — ongoing compliance monitoring through documented internal controls - ISO 27001 — audit in progress with Schellman as our independent auditor - ISO 42001 — audit in progress with Schellman as our independent auditor for AI management system controls For our current compliance posture and certifications, see trust.cursor.com. #### Continuous security monitoring We use a defense-in-depth approach combining automated tooling, human review, and third-party assurance: - Centralized logging and security monitoring — system activity, performance, and operational telemetry are collected and monitored continuously - Vulnerability scanning — performed regularly using industry-standard tools across our infrastructure and codebase - Security agents — autonomous agents configured and deployed by our security team to continuously secure our codebase and products. See cursor.com/blog/security-agents - Code review — performed using BugBot, our internal AI-powered code review product, alongside additional SCA, SAST, and supply chain security tooling #### Customer-facing compliance and audit logs Enterprise customers have access to compliance and audit logging exposed directly through the product. See cursor.com/docs/enterprise/compliance-and-monitoring for details on available logs, retention, and integrations. #### Risk management and assurance - Vendor risk reviews — key vendors are reviewed periodically as part of our vendor security assessment program - Internal risk assessments — performed on a regular cadence to identify and treat emerging risks - Penetration testing — conducted by qualified third parties - Bug bounty program — ongoing engagement with the security research community to surface and remediate vulnerabilities

Enterprise customers have access to compliance and audit logging exposed directly through the product. See cursor.com/docs/enterprise/compliance-and-monitoring for details on available logs, retention, and integrations.

Yes. Cursor encrypts data using industry-standard cryptographic controls: - In transit — TLS 1.2 or higher - At rest — AES-256 encryption Enterprise customers can additionally configure Customer-Managed Encryption Keys (CMEK) for enhanced control over encryption key lifecycle and access. See cursor.com/docs/enterprise/privacy-and-data-governance#data-encryption for details.

Cursor is primarily a SaaS product. Core services (orchestration, model access, control plane) run in Cursor's AWS cloud. Customers can control how the editor and agent execution are deployed: 1\. Editor — Deploy and centrally policy-manage via MDM (Jamf, Intune, Kandji, Group Policy). Docs 2\. Cloud Agents — Run in Cursor's cloud on AWS by default, or self-host agent _workers_ in the customer's own infrastructure. Docs 3\. CLI — Headless use on customer infrastructure (servers, CI/CD, Kubernetes). Docs 4\. Integrations — e.g. GitHub, GitLab, Slack, Linear and MCP. Marketplace · MCP docs 5\. Bring Your Own Key (BYOK) — Customers can route model inference through their own provider API keys (e.g., OpenAI, Anthropic, Azure OpenAI) instead of using Cursor-managed model access.

Privacy Mode can be enabled during onboarding or in settings, and is enforced by default for all Teams and Enterprise plans. With Privacy Mode enabled: - Code and customer data are not used for training by Cursor or its sub-processors. - Cursor maintains Zero Data Retention (ZDR) agreements with sub-processors providing model inference, so prompts and completions are not retained on their side. With Privacy Mode disabled: - Cursor may collect telemetry and usage data, including prompts, editor actions, code snippets, and edits, to evaluate and improve AI features. For more information: cursor.com/privacy · Privacy Mode guarantee

Cursor customers own all the code generated by Cursor.

If you already have an account on the Apps, you may access, update, alter, or delete your basic user profile information by logging into your account and updating profile settings. Anysphere will retain your information for as long as your account is active or as needed to perform our contractual obligations, provide you services through the App, to comply with legal obligations, resolve disputes, preserve legal rights, or enforce our agreements. Retention periods will be determined taking into account the type of information that is collected and the purpose for which it is collected, bearing in mind the requirements applicable to the situation and the need to destroy outdated, unused information at the earliest reasonable opportunity. For instance, in respect of data held for the management of customers and potential customers, we consider the lead time necessary to develop and maintain our commercial relationships and how recent our interactions are with you. We may rectify, update or remove incomplete or inaccurate information, at any time and at our own discretion. For more information on our retention periods you can contact us by email with the subject line "Privacy Concern" at hi@cursor.com. Please note that due to the open source nature of our products, services, and community, we may retain limited personal information indefinitely in order to ensure transactional integrity and nonrepudiation. For example, if you provide your information in connection with a blog post, GitHub issue or comment, we may display that information even if you have deleted your account as we do not automatically delete community posts. see https://cursor.com/security#account-deletion