{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d790713e-033e-5c21-a5bb-7ceee361c5af",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-04T00:00:00Z"
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "https://jesseahawkins.com/vendors/cursor/aibom/component",
      "name": "Cursor: Cursor, by Anysphere",
      "properties": [
        {
          "name": "com.jesseahawkins:fact:ai_subprocessors",
          "value": "Listed on its trust portal; none headquartered in China"
        },
        {
          "name": "com.jesseahawkins:evidence:ai_subprocessors",
          "value": "snapshot:sha256:66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134"
        },
        {
          "name": "com.jesseahawkins:recorded-at:ai_subprocessors",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:ai_subprocessors",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:responsive-to:ai_subprocessors",
          "value": "dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1"
        },
        {
          "name": "com.jesseahawkins:fact:certifications",
          "value": "SOC 2 Type II; ISO 27001, ISO 42001 and AIUC-1"
        },
        {
          "name": "com.jesseahawkins:evidence:certifications",
          "value": "snapshot:sha256:66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134"
        },
        {
          "name": "com.jesseahawkins:recorded-at:certifications",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:certifications",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:fact:data_residency",
          "value": "No infrastructure in China"
        },
        {
          "name": "com.jesseahawkins:evidence:data_residency",
          "value": "snapshot:sha256:66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134"
        },
        {
          "name": "com.jesseahawkins:recorded-at:data_residency",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:data_residency",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:fact:dpa",
          "value": "Published; governs processing under the Master Services Agreement"
        },
        {
          "name": "com.jesseahawkins:evidence:dpa",
          "value": "snapshot:sha256:95face0c2e6cc4f05737d9bb2e3cd43b7ab6f2497cf8c761abd7620e7f24e044"
        },
        {
          "name": "com.jesseahawkins:recorded-at:dpa",
          "value": "2026-11-03T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:dpa",
          "value": "2026-11-03"
        },
        {
          "name": "com.jesseahawkins:fact:trains_on_customer_data",
          "value": "Not with Privacy Mode on"
        },
        {
          "name": "com.jesseahawkins:evidence:trains_on_customer_data",
          "value": "snapshot:sha256:3c9ff56d3aa0af39ff66c7ff75e6f005efe1a0a42ed42b9e4c0ab869d9e17c7e"
        },
        {
          "name": "com.jesseahawkins:recorded-at:trains_on_customer_data",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:trains_on_customer_data",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:responsive-to:trains_on_customer_data",
          "value": "eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:usage_limits",
          "value": "A weekly pool of usage for Cursor models on each paid plan; third-party models on Premium and above at API list price"
        },
        {
          "name": "com.jesseahawkins:evidence:usage_limits",
          "value": "snapshot:sha256:cb5ece5b5229ffe067d8af2f829bb180001455896812b687547282a8d90c9cb7"
        },
        {
          "name": "com.jesseahawkins:recorded-at:usage_limits",
          "value": "2026-11-03T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:usage_limits",
          "value": "2026-11-03"
        },
        {
          "name": "com.jesseahawkins:fact:zero_data_retention",
          "value": "With Privacy Mode on, ZDR agreements with all providers; non-ZDR models are marked or need an admin; flagged data may be kept for investigation"
        },
        {
          "name": "com.jesseahawkins:evidence:zero_data_retention",
          "value": "snapshot:sha256:3c9ff56d3aa0af39ff66c7ff75e6f005efe1a0a42ed42b9e4c0ab869d9e17c7e"
        },
        {
          "name": "com.jesseahawkins:recorded-at:zero_data_retention",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:zero_data_retention",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:withheld:customer_data_retention_period",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:quote:ai_subprocessors",
          "value": "Our list of subprocessors is published on our trust portal."
        },
        {
          "name": "com.jesseahawkins:source:ai_subprocessors",
          "value": "https://cursor.com/security"
        },
        {
          "name": "com.jesseahawkins:quote:certifications",
          "value": "Cursor holds AIUC-1, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 certifications, along with a SOC 2 Type II attestation."
        },
        {
          "name": "com.jesseahawkins:source:certifications",
          "value": "https://cursor.com/security"
        },
        {
          "name": "com.jesseahawkins:quote:data_residency",
          "value": "Cursor does not use or maintain any infrastructure in China."
        },
        {
          "name": "com.jesseahawkins:source:data_residency",
          "value": "https://cursor.com/security"
        },
        {
          "name": "com.jesseahawkins:quote:dpa",
          "value": "This Data Processing Addendum (“DPA”) governs Anysphere, Inc.’s (“Anysphere” or “Vendor”) processing of Personal Data provided by Customer through the Service, in accordance with the Master Services Agreement between Anysphere and Customer (“Agreement”)."
        },
        {
          "name": "com.jesseahawkins:source:dpa",
          "value": "https://cursor.com/terms/dpa"
        },
        {
          "name": "com.jesseahawkins:quote:trains_on_customer_data",
          "value": "If you choose to turn off “Privacy Mode”: we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models."
        },
        {
          "name": "com.jesseahawkins:source:trains_on_customer_data",
          "value": "https://cursor.com/data-use"
        },
        {
          "name": "com.jesseahawkins:quote:usage_limits",
          "value": "Each paid plan includes one pool of usage for Cursor models."
        },
        {
          "name": "com.jesseahawkins:source:usage_limits",
          "value": "https://cursor.com/docs/models-and-pricing"
        },
        {
          "name": "com.jesseahawkins:quote:zero_data_retention",
          "value": "Cursor maintains zero data retention (ZDR) agreements with all providers, and AI model providers will not store or train on your data."
        },
        {
          "name": "com.jesseahawkins:source:zero_data_retention",
          "value": "https://cursor.com/data-use"
        }
      ]
    }
  ],
  "properties": [
    {
      "name": "com.jesseahawkins:vendor",
      "value": "cursor"
    },
    {
      "name": "com.jesseahawkins:record",
      "value": "https://jesseahawkins.com/vendors/cursor/"
    },
    {
      "name": "com.jesseahawkins:notice",
      "value": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "name": "com.jesseahawkins:signed",
      "value": "false"
    },
    {
      "name": "com.jesseahawkins:signature-note",
      "value": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}