You are prohibited from submitting health records, payment card data, or financial account data to Cursor. If you do, you are in breach of the Terms and bear all resulting liability.
This clause shifts all responsibility for regulated data onto the user — if you or your organization submits HIPAA, PCI, or GLBA-regulated data to Cursor (even accidentally), Anysphere bears no liability and you are in material breach of these Terms, potentially triggering regulatory enforcement against you.
Cross-platform context
See how other platforms handle Prohibition on Regulated Data Submission and similar clauses.
Compare across platforms →Developers working in healthcare, fintech, or financial services who inadvertently paste regulated data into Cursor's AI prompts face significant regulatory liability with no contractual protection from Anysphere.
1. REGULATORY FRAMEWORK: This provision directly implicates HIPAA (45 CFR Parts 160 and 164 — Privacy and Security Rules), PCI DSS (Payment Card Industry Data Security Standard v4.0), and GLBA (15 U.S.C. §6801 — Safeguards Rule, 16 CFR Part 314). The prohibition operates as a contractual disclaimer shifting regulatory liability to the user. HHS OCR enforces HIPAA with fines up to $1.9M per violation category per year. The FTC enforces the GLBA Safeguards Rule. PCI DSS is enforced by card brands and acquiring banks. 2.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.