Vendors · Questionnaire · Cursor
Read Cursor’s own answers to nine buyer questions
Cursor, by Anysphere. Each answer quotes Cursor’s own page or feed as kept on the day shown. Each question cites the NIST text that asks it. The answers are not a score and not a verdict.
Q1
Does the vendor train its models on business and API customers’ data?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not with Privacy Mode on
If you choose to turn off “Privacy Mode”: we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models.
With Privacy Mode on: “Customer Data will not be used for training by Cursor.” The page does not say which setting is the default. Data Use & Privacy Overview, kept 26 Oct 2026 · sha256 3c9ff56d3aa0
Q2
Does the vendor train its models on free and consumer use of its products?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not read
The vendor record does not read this point for Cursor.
Q3
How long does the vendor keep the data that customers send?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Not published in the pages kept
Searched: Data Use & Privacy Overview; Security; Models and pricing; Data Processing Addendum.
Q4
Can a customer have the vendor keep none of its data?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
With Privacy Mode on, ZDR agreements with all providers; non-ZDR models are marked or need an admin; flagged data may be kept for investigation
Cursor maintains zero data retention (ZDR) agreements with all providers, and AI model providers will not store or train on your data.
The same paragraph: “Non-ZDR models will be designated as such or require an admin to opt-in to enable the model for your workspace.” Abuse detectors can keep data for investigation. Data Use & Privacy Overview, kept 26 Oct 2026 · sha256 3c9ff56d3aa0
Q5
Where does the vendor process and store customer data?
NIST AI 600-1, action GV-6.1-009: “Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy …”
NIST AI RMF 1.0, GOVERN 6.1
No infrastructure in China
Cursor does not use or maintain any infrastructure in China.
Security, kept 26 Oct 2026 · sha256 66d02e9bb248
Q6
Which other companies process customer data for the vendor?
NIST AI 600-1, action GV-6.1-007: “Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.”
NIST AI RMF 1.0, GOVERN 6.1; NIST AI RMF 1.0, MANAGE 3.1
Listed on its trust portal; none headquartered in China
Our list of subprocessors is published on our trust portal.
The same section adds: “We do not use any companies headquartered in China as subprocessors, and to our knowledge none of our subprocessors do either.” Security, kept 26 Oct 2026 · sha256 66d02e9bb248
Q7
Which independent audits or certifications does the vendor name?
NIST AI 600-1, Appendix A.1.3: “statement on standards for attestation engagement (SSAE) reports to help with third-party transparency and risk management for GAI systems”
NIST AI RMF 1.0, GOVERN 6.1
SOC 2 Type II; ISO 27001, ISO 42001 and AIUC-1
Cursor holds AIUC-1, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 certifications, along with a SOC 2 Type II attestation.
Security, kept 26 Oct 2026 · sha256 66d02e9bb248
Q8
Does the vendor publish a history of its service incidents?
NIST AI 600-1, action GV-6.2-007: “Service Level Agreements (SLAs) in vendor contracts that address incident response, response times, and availability of critical support.”
NIST AI RMF 1.0, GOVERN 6.2
Yes: a status history feed, with 25 incidents kept since 2026-09-29
Status history feed, kept 1 Nov 2026 · sha256 d6ccd699fcdf. The record.
Q9
Does the vendor publish the dates on which it retires its models?
NIST AI 600-1, action GV-6.2-007: “Review vendor contracts and avoid arbitrary or capricious termination of critical GAI technologies or vendor services …”
NIST AI RMF 1.0, GOVERN 6.2
Not read
Cursor is an AI application; this site reads model retirement pages of model makers and clouds only.
- Cursor, Data Use & Privacy Overview, kept 26 Oct 2026.
- Cursor, Security, kept 26 Oct 2026.
- Cursor, Status history feed, kept 1 Nov 2026.
- NIST, NIST AI 600-1, 2024-07. Republished courtesy of the National Institute of Standards and Technology.