{
  "@context": "https://spdx.org/rdf/3.0.1/spdx-context.jsonld",
  "@graph": [
    {
      "type": "CreationInfo",
      "@id": "_:creationInfo",
      "specVersion": "3.0.1",
      "created": "2026-11-04T00:00:00Z",
      "createdBy": [
        "https://jesseahawkins.com/vendors/cursor/aibom/tool"
      ]
    },
    {
      "type": "Tool",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/tool",
      "creationInfo": "_:creationInfo",
      "name": "jesseahawkins.com vendor record"
    },
    {
      "type": "SpdxDocument",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/document",
      "creationInfo": "_:creationInfo",
      "name": "AI BOM for Cursor: Cursor, by Anysphere",
      "profileConformance": [
        "core",
        "software",
        "ai"
      ],
      "rootElement": [
        "https://jesseahawkins.com/vendors/cursor/aibom/ai-package"
      ]
    },
    {
      "type": "ai_AIPackage",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "creationInfo": "_:creationInfo",
      "name": "Cursor: Cursor, by Anysphere"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/ai_subprocessors",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors = Listed on its trust portal; none headquartered in China. Evidence snapshot sha256:66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26. Responsive to (not compliant with): dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/certifications",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "certifications = SOC 2 Type II; ISO 27001, ISO 42001 and AIUC-1. Evidence snapshot sha256:66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/data_residency",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency = No infrastructure in China. Evidence snapshot sha256:66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/dpa",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa = Published; governs processing under the Master Services Agreement. Evidence snapshot sha256:95face0c2e6cc4f05737d9bb2e3cd43b7ab6f2497cf8c761abd7620e7f24e044; recorded 2026-11-03T00:00:00Z; valid from 2026-11-03."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/trains_on_customer_data",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data = Not with Privacy Mode on. Evidence snapshot sha256:3c9ff56d3aa0af39ff66c7ff75e6f005efe1a0a42ed42b9e4c0ab869d9e17c7e; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26. Responsive to (not compliant with): eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/usage_limits",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits = A weekly pool of usage for Cursor models on each paid plan; third-party models on Premium and above at API list price. Evidence snapshot sha256:cb5ece5b5229ffe067d8af2f829bb180001455896812b687547282a8d90c9cb7; recorded 2026-11-03T00:00:00Z; valid from 2026-11-03."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/zero_data_retention",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention = With Privacy Mode on, ZDR agreements with all providers; non-ZDR models are marked or need an admin; flagged data may be kept for investigation. Evidence snapshot sha256:3c9ff56d3aa0af39ff66c7ff75e6f005efe1a0a42ed42b9e4c0ab869d9e17c7e; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/customer_data_retention_period",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period is recorded with no value (fact cursor/customer_data_retention_period@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/ai_subprocessors/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors, in Cursor's own words: \"Our list of subprocessors is published on our trust portal.\" Source: https://cursor.com/security"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/certifications/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "certifications, in Cursor's own words: \"Cursor holds AIUC-1, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 certifications, along with a SOC 2 Type II attestation.\" Source: https://cursor.com/security"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/data_residency/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency, in Cursor's own words: \"Cursor does not use or maintain any infrastructure in China.\" Source: https://cursor.com/security"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/dpa/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa, in Cursor's own words: \"This Data Processing Addendum (“DPA”) governs Anysphere, Inc.’s (“Anysphere” or “Vendor”) processing of Personal Data provided by Customer through the Service, in accordance with the Master Services Agreement between Anysphere and Customer (“Agreement”).\" Source: https://cursor.com/terms/dpa"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/trains_on_customer_data/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data, in Cursor's own words: \"If you choose to turn off “Privacy Mode”: we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models.\" Source: https://cursor.com/data-use"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/usage_limits/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits, in Cursor's own words: \"Each paid plan includes one pool of usage for Cursor models.\" Source: https://cursor.com/docs/models-and-pricing"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/zero_data_retention/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention, in Cursor's own words: \"Cursor maintains zero data retention (ZDR) agreements with all providers, and AI model providers will not store or train on your data.\" Source: https://cursor.com/data-use"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/notice",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/document",
      "contentType": "text/plain",
      "statement": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cursor/aibom/annotation/signature",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cursor/aibom/document",
      "contentType": "text/plain",
      "statement": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}