Security changed Cursor, Apr 25, 2025
Cursor · Apr 25, 2025 · 12 added, 10 removed · found in an Internet Archive capture
- Added: Cursor is SOC 2 Type II certified. Please visit trust.cursor.com to request a copy of the report.
- Added: We commit to doing at-least-annual penetration testing by reputable third parties. Please visit trust.cursor.com to request an executive summary of the latest report.
- Removed: Cursor is SOC 2 Type II certified. Please email hi@cursor.com to request a copy of the report.
- Removed: We commit to doing at-least-annual penetration testing by reputable third parties. Please email hi@cursor.com to request an executive summary of the latest report.
- Added: Our infrastructure is primarily hosted on AWS. Most of our servers are in the US, with some latency-critical servers located in AWS regions in (Tokyo) and Europe (London).
- Added: Some secondary infrastructure is hosted on Microsoft Azure. All of our Azure servers are in the US.
- Added: Some secondary infrastructure is hosted on Google Cloud Platform (GCP). All of our GCP servers are in the US.
- Added: Our custom models are hosted with Fireworks, on servers in the US, Asia (Tokyo), and Europe. Fireworks may store some code data if privacy mode is disabled to speed up inference for our models. We have a zero data retention agreement with Fireworks.
- Removed: Our infrastructure is primarily hosted on AWS. Most of our servers are in the US, with some latency-critical servers located in AWS regions in Asia (Tokyo) and Europe (London).
- Removed: Our custom models are hosted with Fireworks, on servers in the US, Asia (Tokyo), and Europe (London). Fireworks may store some code data if privacy mode is disabled to speed up inference for our models.
- Added: We rely on some Grok models offered over the xAI API to give AI responses. We have a zero data retention agreement with xAI.
- Added: We use Sentry to monitor errors and performance in our app. Code data is never explicitly sent, but may show up in reported errors. Data from privacy mode users never reaches Sentry.
- Added: Embeddings and metadata of some indexed docs are stored on Pinecone. These docs are fetched from the public web.
- Removed: Embeddings and metadata of indexed docs are stored on Pinecone. These docs are fetched from the public web. We are in the process of migrating these to Turbopuffer.
- Removed: We use ToDesktop for distributing our app and for doing auto-updates. They are trusted by several widely used apps, such as Linear and ClickUp .
- Removed: ' download.todesktop.com ' : Used for checking for and downloading updates.
- Added: Cursor allows you to semantically index your codebase, which allows it to answer questions with the context of all of your code as well as write better code by referencing existing implementations. Codebase indexing is enabled by default, but can be turned off in settings.
- Removed: Cursor allows you to semantically index your codebase, which allows it to answer questions with the context of all of your code as well as write better code by referencing existing implementations. Codebase indexing is enabled by default, but can be turned off during onboarding or in the settings.
- Added: At inference time, we compute an embedding, let Turbopuffer do the nearest neighbor search, send back the obfuscated file path and line range to the client, and read those file chunks on the client locally. We then send those chunks back up to the server to answer the user's question. This means that for privacy mode users, no plaintext code is stored on our servers or in Turbopuffer.
- Added: To block specific files in your codebase from being sent to Cursor's servers and included in AI requests, add a ' .cursorignore ' file to your codebase that lists the files and directories that should be excluded. Cursor will make a best effort to prevent exposure of these files from being included in any request.
- Removed: At inference time, we compute an embedding, let Turbopuffer do the nearest neighbor search, send back the obfuscated file path and line range to the client, and read those file chunks on the client locally. We then send those chunks back up to the server to answer the user's question. This means that no plaintext code is stored on our servers or in Turbopuffer.
- Removed: While a ' .cursorignore ' file can prevent files from being indexed, those files may still be included in AI requests, such as if you recently viewed a file and then ask a question in the chat. We are considering adding a ' .cursorban ' file to address the use case of wanting to block files from being sent up in any request - please make a forum post or reach out at hi@cursor.com if this is a feature that would be interesting to you.
About this change
- Page
- cursor.com/security
- Kind
- Documentation
- Text hash
- 8916037bab8b to d15ddf28fa53
- Dated by
- the first Internet Archive capture sampled that shows the new text; the change happened on or before this date