Security changed Cursor, Feb 1, 2025

1. +Added: Keeping your source code and developer environment secure is important to us. This page outlines how we approach security for Cursor.
2. -Removed: Keeping your source code and developer environment secure is critical to us. This page outlines how we approach security for Cursor.
3. +Added: While we have several large organizations already trusting Cursor, please note that we are still in the journey of growing our product and improving our security posture. If you're working in a highly sensitive environment, you should be careful when using Cursor (or any other AI tool). We hope this page gives insight into our progress and helps you make a proper risk assessment.
4. +Added: Cursor is SOC 2 Type II certified. Please email hi@cursor.com to request a copy of the report.
5. +Added: We commit to doing at-least-annual penetration testing by reputable third parties. Please email hi@cursor.com to request an executive summary of the latest report.
6. -Removed: While we have several large organizations already trusting Cursor, please note that we are still in the journey of growing our product and improving our security posture. If you're working in a highly sensitive environment, you should be careful when using Cursor or any other AI tool. We hope this page gives insight into our progress and helps you make a proper risk assessment.
7. -Removed: Cursor is SOC 2 Type I certified, and in process of completing SOC 2 Type II (expected November, 2024). Please email hi@cursor.com to request a copy of the report.
8. -Removed: We commit to doing at-least-annual penetration testing by reputable third parties. Our first report is available as of September, 2024. Please email hi@cursor.com to request a copy of the report.
9. +Added: Our infrastructure is primarily hosted on AWS. Most of our servers are in the US, with some latency-critical servers located in AWS regions in Asia (Tokyo) and Europe (London).
10. +Added: Our custom models are hosted with Fireworks, on servers in the US, Asia (Tokyo), and Europe (London). Fireworks may store some code data if privacy mode is disabled to speed up inference for our models.
11. +Added: We rely on many of OpenAI's models to give AI responses. Requests may be sent to OpenAI even if you have an Anthropic (or someone else's) model selected in chat (e.g. for summarization). We have a zero data retention agreement with OpenAI.
12. +Added: We rely on many of Anthropic's models to give AI responses. Requests may be sent to Anthropic even if you have an OpenAI (or someone else's) model selected in chat (e.g. for summarization). We have a zero data retention agreement with Anthropic.
13. +Added: We rely on some Gemini models offered over Google Cloud's Vertex API to give AI responses. Requests may be sent to Google Cloud Vertex API even if you have an OpenAI (or someone else's) model selected in chat (e.g. for summarization). We have a zero data retention agreement with Vertex.
14. +Added: Embeddings of indexed codebases, as well as metadata associated with the embeddings (obfuscated file names), are stored with Turbopuffer on Google Cloud's servers in the US. You can read more on the Turbopuffer security page . Users can disable codebase indexing; read more about it in the Codebase Indexing section of this document.
15. +Added: Used for web search functionality. Search requests are potentially derived from code data (e.g. when using "@web" in the chat, a separate language model will look at your message, conversation history and current file to determine what to search for, and Exa/SerpApi will see the resulting search query).
16. +Added: We use MongoDB for some of our analytics data, for users who do not have privacy mode enabled.
17. +Added: We use Datadog for logging and monitoring. As discussed in the Privacy Mode Guarantee section , logs related to privacy mode users do not contain any code data.
18. +Added: We use Databricks MosaicML for training some of our custom models. Data from privacy mode users never reaches Databricks.
19. +Added: We use Foundry for training some of our custom models. Data from privacy mode users never reaches Foundry.
20. +Added: We use Voltage Park for training some of our custom models. Data from privacy mode users never reaches Voltage Park.
21. +Added: We use Slack as our internal communication tool. We may send snippets of prompts of non-privacy users in our internal chats for debugging.
22. +Added: We use Google Workspace to collaborate. We may send snippets of prompts of non-privacy users in our internal emails for debugging.
23. +Added: Embeddings and metadata of indexed docs are stored on Pinecone. These docs are fetched from the public web. We are in the process of migrating these to Turbopuffer.
24. +Added: We use Amplitude for some of our analytics data. No code data is stored with Amplitude; only event data such as "number of Cursor Tab requests".
25. +Added: We use HashiCorp Terraform to manage our infrastructure.
26. +Added: We use Stripe to handle billing. Stripe will store your personal data (name, credit card, address).
27. +Added: We use Vercel to deploy our website. The website has no way of accessing code data.
28. +Added: We use WorkOS to handle auth. WorkOS may store some personal data (name, email address).
29. -Removed: Click to see how Privacy Mode affects where code data is sent:
30. -Removed: AWS Sees code data : Our infrastructure is primarily hosted on AWS. Most of our servers are in the US, with some latency-critical servers located in AWS regions in Asia (Tokyo) and Europe (London).
31. -Removed: Fireworks Sees code data : Our custom models are hosted with Fireworks, on servers in the US, Asia (Tokyo), and Europe (London). Fireworks may store some code data if privacy mode is disabled to speed up inference for our models.
32. -Removed: OpenAI Sees code data : We rely on many of OpenAI's models to give AI responses. Requests may be sent to OpenAI even if you have an Anthropic (or someone else's) model selected in chat (e.g. for summarization). We have a zero data retention agreement with OpenAI.
33. -Removed: Anthropic Sees code data : We rely on many of Anthropic's models to give AI responses. Requests may be sent to Anthropic even if you have an OpenAI (or someone else's) model selected in chat (e.g. for summarization). We have a zero data retention agreement with Anthropic.
34. -Removed: Google Cloud Vertex API Sees code data : We rely on some Gemini models offered over Google Cloud's Vertex API to give AI responses. Requests may be sent to Google Cloud Vertex API even if you have an OpenAI (or someone else's) model selected in chat (e.g. for summarization).
35. -Removed: Turbopuffer Stores obfuscated code data : Embeddings of indexed codebases, as well as metadata associated with the embeddings (obfuscated file names), are stored with Turbopuffer on Google Cloud's servers in the US. You can read more on the Turbopuffer security page . Users can disable codebase indexing; read more about it in the Codebase Indexing section of this document.
36. -Removed: Exa and SerpApi See search requests (potentially derived from code data) : Used for web search functionality. Search requests are potentially derived from code data (e.g. when using "@web" in the chat, a separate language model will look at your message, conversation history and current file to determine what to search for, and Exa/SerpApi will see the resulting search query).
37. -Removed: MongoDB Sees no code data : We use MongoDB for some of our analytics data, for users who do not have privacy mode enabled.
38. -Removed: Datadog Sees no code data : We use Datadog for logging and monitoring. As discussed in the Privacy Mode Guarantee section , logs related to privacy mode users do not contain any code data.
39. -Removed: Databricks Sees no code data : We use Databricks MosaicML for training some of our custom models. Data from privacy mode users never reaches Databricks.
40. -Removed: Foundry Sees no code data : We use Foundry for training some of our custom models. Data from privacy mode users never reaches Foundry.
41. -Removed: Slack Sees no code data : We use Slack as our internal communication tool. We may send snippets of prompts of non-privacy users in our internal chats for debugging.
42. -Removed: Google Workspace Sees no code data : We use Google Workspace to collaborate. We may send snippets of prompts of non-privacy users in our internal emails for debugging.
43. -Removed: Pinecone Sees no code data : Embeddings and metadata of indexed docs are stored on Pinecone. These docs are fetched from the public web. We are in the process of migrating these to Turbopuffer.
44. -Removed: Amplitude Sees no code data : We use Amplitude for some of our analytics data. No code data is stored with Amplitude; only event data such as "number of Cursor Tab requests".
45. -Removed: HashiCorp Sees no code data : We use HashiCorp Terraform to manage our infrastructure.
46. -Removed: Stripe Sees no code data : We use Stripe to handle billing. Stripe will store your personal data (name, credit card, address).
47. -Removed: Vercel Sees no code data : We use Vercel to deploy our website. The website has no way of accessing code data.
48. -Removed: WorkOS Sees no code data : We use WorkOS to handle auth. WorkOS may store some personal data (name, email address).
49. +Added: Cursor is a fork of the open-source Visual Studio Code (VS Code), maintained by Microsoft. They publish security advisories on their GitHub security page . Every other mainline VS Code release, we merge the upstream ' microsoft/vscode ' codebase into Cursor. You can check which version of VS Code that your Cursor version is based on by clicking "Cursor > About Cursor" in the app. If there is a high-severity security-related patch in the upstream VS Code, we will cherry-pick the fix before the next merge and release immediately.
50. -Removed: Cursor is a fork of the open-source Visual Studio Code (VS Code), maintained by Microsoft. They publish security advisories on their GitHub security page . Every other mainline VS Code release, we merge the upstream microsoft/vscode codebase into Cursor. You can check which version of VS Code that your Cursor version is based on by clicking "Cursor > About Cursor" in the app. If there is a high-severity security-related patch in the upstream VS Code, we will cherry-pick the fix before the next merge and release immediately.
51. +Added: ' api2.cursor.sh ' : Used for most API requests.
52. +Added: ' api3.cursor.sh ' : Used for Cursor Tab requests (HTTP/2 only).
53. +Added: ' repo42.cursor.sh ' : Used for codebase indexing (HTTP/2 only).
54. +Added: ' api4.cursor.sh ' , ' us-asia.gcpp.cursor.sh ' , ' us-eu.gcpp.cursor.sh ' , ' us-only.gcpp.cursor.sh ' : Used for Cursor Tab requests depending on your location (HTTP/2 only).
55. +Added: ' marketplace.cursorapi.com ' , ' cursor-cdn.com ' : Used for downloading extensions from the extension marketplace.
56. +Added: ' download.todesktop.com ' : Used for checking for and downloading updates.
57. +Added: Two security-related differences to VS Code to note:
58. +Added: Workspace Trust is disabled by default in Cursor. You can enable it by setting ' security.workspace.trust.enabled ' to ' true ' in your Cursor settings. It is disabled by default to prevent confusion between Workspace Trust's "Restricted Mode" and Cursor's "Privacy Mode", and because its trust properties are nuanced and hard to understand (for example, even with Workspace Trust enabled, you are not protected from malicious extensions, only from malicious folders). We are open to community feedback on whether we should enable it by default.
59. +Added: Extension code signatures: Cursor does not verify signatures of extensions that are downloaded from the marketplace. VS Code recently started doing this. In particular, the ' extensions.verifySignature ' setting defaults to ' false ' in Cursor but to ' true ' in VS Code. If you set it to ' true ' in Cursor, you'll see a pop-up saying that signature verification failed, every time you try to download an extension. We hope to start supporting extension signature verification in the medium-term future.
60. -Removed: api2.cursor.sh : Used for most API requests.

25 more changed paragraphs are on the page itself.