Is Cursor ISO 27001 certified?

Yes

Anysphere · Coding

Yes. Anysphere is ISO/IEC 27001 certified for Cursor, the international information-security management standard.

What we checked

This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.

ISO/IEC 27001: Confirmed; Anysphere reports ISO/IEC 27001 certification. Ask for scope and current certificate dates before treating it as supplier assurance.
SOC 2: Confirmed; Anysphere also reports a SOC 2 attestation, which can complement but does not replace ISO scope evidence.
Default data training: Opt-out required; For free/Pro individual users Privacy Mode is opt-in (off by default), and with it off Cursor states it 'may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models.'
Business-tier training: No by default; Privacy Mode is enforced/on by default for Team and Enterprise plans, so code is not used for training by Cursor or its model-provider subprocessors.

Practical risk: On the free/Pro tier Privacy Mode is opt-in and OFF by default, so an at-work user who does not enable it has their code, prompts and editor actions stored and used to train Cursor's models.

How to make a decision

Check the precise account tier, written contract and intended data before approving Cursor. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.

More on Cursor

Is Cursor HIPAA compliant?Is Cursor GDPR compliant?Is Cursor SOC 2 compliant?Does Cursor train on your data?

See the full Cursor risk profile, with every data-handling fact and its source, or browse all rated AI tools.