Is Cursor HIPAA compliant?

Unverified

Anysphere · Coding

Not verified. Check directly with Anysphere before using Cursor with protected health information (PHI).

What we checked

This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.

Business Associate Agreement: Not verified; No public BAA was confirmed. Treat PHI use as blocked until Anysphere provides written terms.
Enterprise route: Enterprise; For regulated use, validate the BAA, configured service and users under the Enterprise contract.
Default data training: Opt-out required; For free/Pro individual users Privacy Mode is opt-in (off by default), and with it off Cursor states it 'may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models.'
Business-tier training: No by default; Privacy Mode is enforced/on by default for Team and Enterprise plans, so code is not used for training by Cursor or its model-provider subprocessors.

Practical risk: On the free/Pro tier Privacy Mode is opt-in and OFF by default, so an at-work user who does not enable it has their code, prompts and editor actions stored and used to train Cursor's models.

How to make a decision

Check the precise account tier, written contract and intended data before approving Cursor. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.

More on Cursor

Is Cursor GDPR compliant?Is Cursor SOC 2 compliant?Is Cursor ISO 27001 certified?Does Cursor train on your data?

See the full Cursor risk profile, with every data-handling fact and its source, or browse all rated AI tools.