If you use Cursor's codebase indexing feature, your code is uploaded in chunks to Cursor's servers; the plaintext code is deleted after each request, but embeddings and metadata including file names and hashes may be stored indefinitely.
This analysis describes what Cursor's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that codebase indexing results in persistent storage of embeddings and metadata (including file names and hashes) even though plaintext code is not retained, which may have implications for users with confidential codebases.
Interpretive note: The document does not specify a retention period for stored embeddings and codebase metadata, creating ambiguity about how long this data is held.
The document states that using codebase indexing results in the storage of embeddings and metadata including file hashes and file names in Cursor's database, even though plaintext code is not retained after the request; users with proprietary or confidential codebases should assess the sensitivity of this metadata.
Cross-platform context
See how other platforms handle Codebase Indexing and Embedding Storage and similar clauses.
Compare across platforms →Monitoring
Cursor has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"If you choose to index your codebase, Cursor will upload your codebase in small chunks to our server to compute embeddings, but all plaintext code for computing embeddings ceases to exist after the life of the request. The embeddings and metadata about your codebase (hashes, file names) may be stored in our database.— Excerpt from Cursor's Cursor Data Use & Privacy Overview
(1) REGULATORY LANDSCAPE: Persistent storage of embeddings and file metadata may constitute processing of personal or commercially sensitive data depending on the codebase content and applicable jurisdiction. GDPR data minimization and storage limitation principles apply to the retention of embeddings and metadata. CCPA disclosure requirements apply to this storage practice. The document does not specify a retention period for stored embeddings and metadata. (2) GOVERNANCE EXPOSURE: Medium. While plaintext code is not retained after the request lifecycle, the persistent storage of embeddings and file-level metadata (names, hashes) may enable reconstruction of structural information about a codebase, which is commercially sensitive for many organizations. The document does not address deletion of stored embeddings upon account closure or user request. (3) JURISDICTION FLAGS: EU/EEA users may raise GDPR storage limitation concerns given the absence of a defined retention period for embeddings and metadata. Organizations in regulated industries should assess whether file names or structural metadata constitute confidential information under applicable regulatory frameworks. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise contracts should address the retention and deletion of codebase embeddings and metadata, particularly upon contract termination. Procurement teams should confirm whether deletion of stored embeddings is available upon request and what timeline applies. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should assess whether embeddings and file metadata from organizational codebases are covered by existing DPAs, and confirm whether a deletion mechanism exists for this stored data. The absence of a stated retention period for embeddings and metadata should be clarified with Cursor.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes that codebase indexing results in persistent storage of embeddings and metadata (including file names and hashes) even though plaintext code is not retained, which may have implications for users with confidential codebases.
The document states that using codebase indexing results in the storage of embeddings and metadata including file hashes and file names in Cursor's database, even though plaintext code is not retained after the request; users with proprietary or confidential codebases should assess the sensitivity of this metadata.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cursor.