Cursor Security Practices

This document describes how Cursor secures its systems and handles your data. The most user-facing features are Privacy Mode — which, when enabled, prevents Cursor from training on your data — and the ability to delete your account at any time from Settings. Cursor also commits to notifying you by email if a critical incident affects you.

This document establishes Cursor's security and data-handling practices, including conditional restrictions on training data use (Privacy Mode disables training on user data), subprocessor controls (no China-based infrastructure or subprocessors, annual vendor risk re-review, contractual and technical requirements imposed on model providers), and operational security commitments (least-privilege access, multi-factor authentication, cybersecurity tooling, continuous log monitoring, and at least annual third-party penetration testing). Cursor commits to acknowledging vulnerability reports within 5 business days and notifying affected users of critical incidents via email. Users retain a self-service right to delete their account at any time from the Settings dashboard, and Privacy Mode is available across all plan tiers including free.

For an individual user, the most direct impact is that enabling Privacy Mode prevents Cursor from using your data for model training. This option is available to every user, including those on the free tier, and can be enabled without upgrading. You can also delete your account at any time directly from the Settings dashboard without needing to contact support. If a critical incident affects you, Cursor will notify you via email.