Captured before automated identity checks (Oct 14, 2026): accurate as of its capture on Sep 11, 2026; our capture on Oct 15, 2026 found the same text, but its identity was not checked by them.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
“Critical incidents are communicated via email to affected users.”
“Cursor does not use or maintain any infrastructure in China. We do not use any companies headquartered in China as subprocessors, and to our knowledge none of our subprocessors do either.”
“When enabled, we will not train on your data.”
“We also implement technical controls and contractual requirements with our model providers to protect your data.”
“Each subprocessor is evaluated under our vendor risk management program and re-reviewed annually.”
“We commit to at-least-annual penetration testing by reputable third parties. An executive summary of the latest report is also available on request via our trust portal.”
This document describes how Cursor secures its systems and handles your data. The most user-facing features are Privacy Mode — which, when enabled, prevents Cursor from training on your data — and the ability to delete your account at any time from Settings. Cursor also commits to notifying you by email if a critical incident affects you.
This document establishes Cursor's security and data-handling practices, including conditional restrictions on training data use (Privacy Mode disables training on user data), subprocessor controls (no China-based infrastructure or subprocessors, annual vendor risk re-review, contractual and technical requirements imposed on model providers), and operational security commitments (least-privilege access, multi-factor authentication, cybersecurity tooling, continuous log monitoring, and at least annual third-party penetration testing). Cursor commits to acknowledging vulnerability reports within 5 business days and notifying affected users of critical incidents via email. Users retain a self-service right to delete their account at any time from the Settings dashboard, and Privacy Mode is available across all plan tiers including free.
For an individual user, the most direct impact is that enabling Privacy Mode prevents Cursor from using your data for model training. This option is available to every user, including those on the free tier, and can be enabled without upgrading. You can also delete your account at any time directly from the Settings dashboard without needing to contact support. If a critical incident affects you, Cursor will notify you via email.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
2 important changes detected
6 versions captured · Latest change detected by ConductAtlas: August 2026
“Critical incidents are communicated via email to affected users.”
“Cursor does not use or maintain any infrastructure in China. We do not use any companies headquartered in China as subprocessors, and to our knowledge none of our subprocessors do either.”
“When enabled, we will not train on your data.”
“We also implement technical controls and contractual requirements with our model providers to protect your data.”
“Each subprocessor is evaluated under our vendor risk management program and re-reviewed annually.”
“We commit to at-least-annual penetration testing by reputable third parties. An executive summary of the latest report is also available on request via our trust portal.”
“Infrastructure access is granted according to the principle of least privilege.”
“We enforce multi-factor authentication, deploy cybersecurity tools, and monitor system logs and activity.”
“Cursor respects model blocklists and will not send requests to models on a blocklist.”
“Privacy Mode is available to anyone (free or Pro).”
“You can delete your account at any time from the Settings dashboard -- see our account deletion guide for instructions.”
“We acknowledge vulnerability reports within 5 business days and address them as soon as we are able.”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
Cursor has updated this document before. Monitor includes alerts from a daily check, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle Critical incident notification to affected users via email and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 343 platforms.