Is Cursor SOC 2 compliant?

Yes

Anysphere · Coding

Yes. Anysphere holds a SOC 2 report covering Cursor, which gives independent assurance over its security controls.

What we checked

This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.

SOC 2 report: Confirmed; Anysphere reports a SOC 2 attestation. Request the current report and relevant bridge letter during procurement.
ISO 27001: Confirmed; Anysphere also reports ISO/IEC 27001 certification.
Default data training: Opt-out required; For free/Pro individual users Privacy Mode is opt-in (off by default), and with it off Cursor states it 'may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models.'
Business-tier training: No by default; Privacy Mode is enforced/on by default for Team and Enterprise plans, so code is not used for training by Cursor or its model-provider subprocessors.

Practical risk: On the free/Pro tier Privacy Mode is opt-in and OFF by default, so an at-work user who does not enable it has their code, prompts and editor actions stored and used to train Cursor's models.

How to make a decision

Check the precise account tier, written contract and intended data before approving Cursor. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.

More on Cursor

Is Cursor HIPAA compliant?Is Cursor GDPR compliant?Is Cursor ISO 27001 certified?Does Cursor train on your data?

See the full Cursor risk profile, with every data-handling fact and its source, or browse all rated AI tools.