Security changed Cursor, Jul 1, 2025
Cursor · Jul 1, 2025 · 6 added, 6 removed · found in an Internet Archive capture
- Added: We use Cloudflare as a reverse proxy in front of parts of our API and website in order to improve performance and security.
- Added: We use Mistral to parse public PDFs found on the internet. No private data reaches Mistral (unless you manually use a Mistral model with your own API key).
- Added: ' marketplace.cursorapi.com ' , ' cursor-cdn.com ' , ' downloads.cursor.com ' , ' anysphere-binaries.s3.us-east-1.amazonaws.com ' : Used for client updates and for downloading extensions from the extension marketplace.
- Removed: ' marketplace.cursorapi.com ' , ' cursor-cdn.com ' : Used for downloading extensions from the extension marketplace.
- Removed: You own all the code generated by Cursor.
- Added: Privacy mode can be enabled in settings or by a team admin. When it is enabled, we guarantee that code data is never stored by our model providers or used for training. Privacy mode can be enabled by anyone (free or Pro user), and is by default forcibly enabled for any user that is a member of a team.
- Added: We take the privacy mode guarantee very seriously. More than 50% of all Cursor users have privacy mode enabled.
- Added: Each request to our server includes an ' x-ghost-mode ' header, containing a boolean value denoting if the user is on privacy mode. To prevent accidentally treating a privacy mode user as a non-privacy mode user, we always default to assuming that a user is on privacy mode if the header is missing.
- Removed: Privacy mode can be enabled during onboarding or in settings. When it is enabled, we guarantee that code data is not stored in plaintext at our servers or by our subprocessors. Privacy mode can be enabled by anyone (free or Pro user), and is by default forcibly enabled for any user that is a member of a team.
- Removed: We take the privacy mode guarantee very seriously. About 50% of all Cursor users have privacy mode enabled. You can read more about the privacy guarantee in our Privacy Policy .
- Removed: With privacy mode enabled, code data is not persisted at our servers or by any of our subprocessors. The code data is still visible to our servers in memory for the lifetime of the request, and may exist for a slightly longer period (on the order of minutes to hours) for long-running background jobs, KV caching, or temporary file caching. For file caching specifically, all data is encrypted with client-generated keys that are only retained for the duration of the request. The code data submitted by privacy mode users will never be trained on.
- Removed: A user's privacy mode setting is stored on the client. Each request to our server includes an ' x-ghost-mode ' header. To prevent accidentally treating a privacy mode user as a non-privacy mode user, we always default to assuming that a user is on privacy mode if the header is missing.
About this change
- Page
- cursor.com/security
- Kind
- Documentation
- Text hash
- d15ddf28fa53 to 6aca484250d6
- Dated by
- the first Internet Archive capture sampled that shows the new text; the change happened on or before this date