Snapshot 694
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Keeping your source code and developer environment secure is important to us. This page outlines how we approach security for Cursor. Please submit potential vulnerabilities via email to security-reports@cursor.com. For any other security-related questions, contact us at security@cursor.com. Certifications and third-party assessments Cursor holds AIUC-1, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 certifications, along with a SOC 2 Type II attestation. Certificates and reports are available on request at trust.cursor.com. We commit to at-least-annual penetration testing by reputable third parties. An executive summary of the latest report is also available on request via our trust portal. Infrastructure security Our list of subprocessors is published on our trust portal. Each subprocessor is evaluated under our vendor risk management program and re-reviewed annually. Cursor respects model blocklists and will not send requests to models on a blocklist. Cursor does not use or maintain any infrastructure in China. We do not use any companies headquartered in China as subprocessors, and to our knowledge none of our subprocessors do either. Infrastructure access is granted according to the principle of least privilege. We enforce multi-factor authentication, deploy cybersecurity tools, and monitor system logs and activity. Client and agent security We assess upstream security patches based on risk and impact and, where warranted, merge and release immediately. Our app makes requests to Cursor backend domains to deliver API, update, and marketplace functionality. If you're behind a corporate proxy, please allowlist these domains. Best practices for using Cursor agents securely are documented in our developer docs: Agent and developer security: Agent security LLM safety and controls Cloud Agent network security Hooks Security considerations for MCP Data Encryption and CMEK Security and Privacy Hardening Enterprise administration: Enterprise security features Privacy and data governance Compliance logging MDM deployment SSO and SCIM Securing our own codebase We use our own products to help secure our codebase, including BugBot and Cloud Agent automations. See our security agents blog post for more information. Privacy Mode Privacy Mode can be enabled in settings or by a team or enterprise admin. Privacy Mode is available to anyone (free or Pro). New team members inherit the team's Privacy Mode settings. When enabled, we will not train on your data. We also implement technical controls and contractual requirements with our model providers to protect your data. Learn more about how your data is used. Account deletion You can delete your account at any time from the Settings dashboard -- see our account deletion guide for instructions. For additional assistance with account deletion, contact customer support at hi@cursor.com. Vulnerability disclosures If you believe you have found a vulnerability in Cursor, please submit a report to security-reports@cursor.com. We acknowledge vulnerability reports within 5 business days and address them as soon as we are able. Critical incidents are communicated via email to affected users.