Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that requests made using a user's own API key are routed through Cursor's backend for final prompt construction, rather than being sent directly to the model provider.
This analysis describes what Cursor's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that API key users do not bypass Cursor's data processing infrastructure, meaning the data handling terms described in this document apply to API key-based requests including any applicable training use or logging provisions.
The updated policy clarifies that Cursor maintains zero data retention agreements with all AI model providers and customer data will not be used for training by Cursor. However, the policy now explicitly discloses that model providers may run risk classifiers to detect policy violations, and if your prompts or conversations trigger abuse detectors, your data may be stored for investigation and deleted according to the provider's retention policies. The policy removed the previous blanket statement that code would never be trained on by Cursor or third parties, replacing it with more specific disclosure of abuse detection practices. You can review OpenAI and Anthropic's documentation directly for details on their specific retention policies.
View change record →Under this clause, users who provide their own API keys should be aware that their requests are processed through Cursor's backend before being forwarded to the model provider, meaning Cursor's data handling terms apply to those requests regardless of the API key used.
Cross-platform context
See how other platforms handle API Key Routing Through Cursor Backend and similar clauses.
Compare across platforms →Monitoring
Cursor has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Even if you use your API key, your requests will still go through our backend! That's where we do our final prompt building.Excerpt from Cursor's Data Use & Privacy Overview
(1) REGULATORY LANDSCAPE: This provision is relevant to GDPR and CCPA data processing disclosures, as users employing third-party API keys may not have anticipated that their requests would be processed by Cursor's infrastructure. Accurate disclosure of this routing behavior is relevant under FTC Act transparency standards. (2) GOVERNANCE EXPOSURE: Medium. Enterprise users who assumed that using their own API keys would route requests directly to model providers, thereby excluding Cursor from data processing, should reassess their data governance documentation in light of this disclosure. (3) JURISDICTION FLAGS: EU and EEA organizations that have mapped data flows based on direct API provider relationships may need to update data processing records to include Cursor as an intermediary processor for API key-based requests. (4) CONTRACT AND VENDOR IMPLICATIONS: This provision may have implications for enterprise contracts that specify data processing boundaries or require that code data not be processed by intermediary vendors. Procurement teams should assess whether this routing disclosure aligns with enterprise data governance policies. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether internal data flow documentation accurately reflects Cursor's backend processing of API key requests, and assess whether updated data processing agreements or disclosures are required as a result.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes that API key users do not bypass Cursor's data processing infrastructure, meaning the data handling terms described in this document apply to API key-based requests including any applicable training use or logging provisions.
Under this clause, users who provide their own API keys should be aware that their requests are processed through Cursor's backend before being forwarded to the model provider, meaning Cursor's data handling terms apply to those requests regardless of the API key used.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cursor.