Provision record
Cursor · Cursor Security Practices · View original document ↗

Annual subprocessor vendor risk re-review

Medium severity High confidence Explicit document language Common · 298 of 352 platforms

Key Facts · in the document’s own words

How does Cursor evaluate and review subprocessors?
“Each subprocessor is evaluated under our vendor risk management program and re-reviewed annually.”
Version CA-V-006766, captured Sept. 11, 2026 · live source ↗
Our reading, not the document’s words
Cursor evaluates each subprocessor under its vendor risk management program and re-reviews each subprocessor annually.
Stay ahead of the changes
Track Cursor and get the diff the day its terms change.
Share 𝕏 Share in Share 🔒 PDF
ⓘ

This analysis describes what Cursor's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology

ConductAtlas Analysis

Why it matters (compliance & governance perspective)

Annual re-review means subprocessors are not assessed only at onboarding; their risk profile is checked on a recurring basis.

Consumer impact (what this means for users)

Readers can expect that every company Cursor uses to process data is subject to both an initial evaluation and a yearly reassessment.

How other platforms handle this

Pinterest Medium

To the extent that any provisions in the Business Terms of Service conflict with these Terms, the Business Terms of Service shall govern to the extent of the conflict.

Snapchat Medium

Regardless of who terminates these Terms, both you and Snap continue to be bound by Sections 2, 3 (to the extent any additional terms and conditions would, by their terms, survive), and 6 - 25 of the Terms.

SoFi Medium

You agree that SoFi may contact you about any matter relating to your activity with, any inquiry submitted to, or any account or product you have with SoFi.

See all platforms with this clause type →
▸ View Original Clause Language DOCUMENT RECORD
"
Each subprocessor is evaluated under our vendor risk management program and re-reviewed annually.

Excerpt from Cursor's Security Practices

Provision details

Document information
Document
Cursor Security Practices
Entity
Cursor
Date stated by the document
Aug. 25, 2026
As printed in Cursor’s text (version CA-V-006766), not a ConductAtlas date.
Tracking information
First captured by ConductAtlas
May 12, 2026
Text quoted from version
CA-V-006766, captured Sept. 11, 2026
Record ID
CA-P-062752
Document ID
CA-D-000832
Evidence Provenance
Source URL
Wayback Machine
Archived bytes SHA-256 (version CA-V-006766)
3390ea3e7e5a41d3238c2109f3116525496a116160e5d2361d6957358c6d03ea
Analysis generated
May 12, 2026 17:00 UTC
Methodology
Evidence
✓ Excerpt found verbatim in version CA-V-006766 (checked Oct. 5, 2026)
Citation Record
Entity: Cursor
Document: Cursor Security Practices
Record ID: CA-P-062752
Version: CA-V-006766
Captured: 2026-09-11 00:56:25 UTC
SHA-256: 3390ea3e7e5a41d3…
URL: https://conductatlas.com/platform/cursor/cursor-security-practices/provision/CA-P-062752/annual-subprocessor-vendor-risk-re-review/
Accessed: Oct. 8, 2026
Permanent archival reference. Stable identifier suitable for legal filings, compliance documentation, and research citation.
Classification
Severity
Medium
Categories

Other risks in this policy

Get the research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.

Frequently Asked Questions

What does Cursor's Annual subprocessor vendor risk re-review clause do?

Annual re-review means subprocessors are not assessed only at onboarding; their risk profile is checked on a recurring basis.

How does this clause affect you?

Readers can expect that every company Cursor uses to process data is subject to both an initial evaluation and a yearly reassessment.

How many platforms have this type of clause?

ConductAtlas has identified this type of provision across 298 platforms. See the full comparison.

Is ConductAtlas affiliated with Cursor?

No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cursor.