Cursor Security Practices

This document is Cursor's Security page (last updated April 24, 2026), a disclosure document rather than a privacy policy or terms of service; it describes Cursor's operational security posture, data handling controls, and vulnerability disclosure process, without asserting contractual obligations on users or establishing a formal legal basis. The document states that a SOC 2 Type II attestation report is available on request, that annual third-party penetration testing is conducted, that Privacy Mode implements Zero Data Retention contractual terms with model providers to prevent code data from being stored or used for training, and that account deletion is available at any time from the Settings dashboard. Operationally notable is the explicit statement that Cursor does not use or maintain infrastructure in China and does not use China-headquartered subprocessors, and that Privacy Mode is enabled by default for team members and available to free and Pro users; these disclosures address supply chain and data sovereignty concerns that are increasingly material to enterprise procurement. The document engages questions relevant to GDPR, CCPA, and SOC 2 compliance frameworks through its disclosures on subprocessor management, data retention controls, and access governance, though the document itself does not assert compliance with any specific regulation. As a security disclosure page rather than a binding policy instrument, its compliance significance lies primarily in the representations it makes that procurement and legal teams may rely upon during vendor due diligence.