Not legal advice · Summaries of vendors' public pages, which change often. Verify with the vendor and your contract before relying on anything here.
AI Terms Tracker
Get weekly changes

Does Cursor (Teams / Enterprise) train on your data?

Anysphere · Coding · Last verified

Not stated

Vendor pages don't say clearly.

Short answer: Unknown

With Privacy Mode on, Cursor does not train on your data; with it off, Cursor may use code data to train. Team admins can enforce Privacy Mode; the default for team plans isn't stated on the pages checked.

Source: cursor.com/data-use

Why this matters: Unknown doesn't mean no. Ask Anysphere to confirm in writing before sharing confidential data, because training can't be undone. Why training matters →

4/7 assurances found·5 of 9 fields confirmed from vendor pages

Below: retention, SOC 2, ISO 27001/42001, DPA, BAA, data residency and zero-retention for Cursor (Teams / Enterprise), each linked to Anysphere's own page.

Summary of Anysphere's public pages as of Oct 17, 2026. Not legal advice: terms vary by plan and contract and can change. Confirm with Anysphere before relying on it.

Trains on your data by default

Unknown

With Privacy Mode on, Cursor does not train on your data; with it off, Cursor may use code data to train. Team admins can enforce Privacy Mode; the default for team plans isn't stated on the pages checked.

Source:

Data retention

ZDR with Privacy Mode

Privacy Mode: ZDR agreements with all providers; files cached temporarily, encrypted.

Source:

SOC 2 Type II

Yes

SOC 2 Type II attestation.

Source:

ISO/IEC 27001

Yes

ISO/IEC 27001:2022.

Source:

ISO/IEC 42001

Yes

ISO/IEC 42001:2023 (also AIUC-1).

Source:

DPA available

Unknown

Not stated on the Anysphere pages we checked.

Pages checked:

BAA / HIPAA

Unknown

Not stated on the Anysphere pages we checked.

Pages checked:

Data residency options

Unknown

Not stated on the Anysphere pages we checked.

Pages checked:

Zero-retention option

Yes

Privacy Mode enables zero data retention with model providers (abuse-detection exceptions).

Source:

Vendor pages we monitor for this tool

We save a fingerprint (SHA-256 of the page's visible text) on every check so we can spot when a vendor edits its terms.

PageCheckedFingerprint
https://cursor.com/securityOct 17, 20266df5acc4c522…
https://cursor.com/privacyOct 17, 20265076facc2610…
https://cursor.com/data-useOct 17, 202635ad6bdfe60e…

Compare with

See all Coding tools · Why AI training on your data matters · How we source and verify this