AI tools and client data

Is Cursor safe for client data?

Short answer: Whether Cursor is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Free and Pro and on Teams and Enterprise, Cursor says a setting stops it training its models on what staff type, and we did not find which way that setting starts. Every fact on this page is Cursor's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.

By Kfir Yair, CISSP. Published . Updated .

See which AI tools your staff use

Plan by plan, in Cursor’s own words

An editor built around an assistant that reads the whole project and can run commands, which makes it the most capable thing on a developer's laptop.

What you are askingFree and ProTeams and Enterprise
Trains the vendor's models by defaultIt turns on one setting. Cursor says Privacy Mode is available on every plan and that it then does not train on your data.“Privacy Mode is available to anyone (free or Pro).” source, read An admin can set Privacy Mode for the team, so it is not left to each developer.“Privacy Mode can be enabled in settings or by a team or enterprise admin.” source, read
How to turn training offPrivacy Mode, in settings. This is the single most useful switch on this page.“When enabled, we will not train on your data.” source, read Not found in the pages we read.
How long data is keptNot found in the pages we read.Not found in the pages we read.
What an admin can see or controlNot found in the pages we read.A new joiner gets the team's setting rather than the default, which is what makes this worth doing once.“New team members inherit the team's Privacy Mode settings.” source, read
Single sign-onNot found in the pages we read.SAML 2.0, configured by an enterprise organisation admin.“Enterprise org admins configure SSO in the Organization's Settings.” source, read
Business Associate AgreementNot found in the pages we read.Not found in the pages we read.
Where the data is processedNot found in the pages we read.Cursor does not say where your code is processed. It does say where it is not.“Cursor does not use or maintain any infrastructure in China.” source, read

An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the Cursor pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask Cursor before client information goes near it.

What this means for

The duty does not change because the tool is new. What changes is where the client information ends up.

  • Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
  • Dental and medical practices. We didn't find a BAA statement in the pages listed below; ask Cursor before any patient data goes in. See dental practices.
  • CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
  • Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
  • Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.

How to tell which version your staff use

The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.

  1. 1. Ask

    Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.

  2. 2. Look at the billing and the admin console

    This finds what the business pays for. It does not find a personal account, which is the one that matters here.

  3. 3. Look on the computers

    A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.

Settings to check today

From Cursor’s own documentation. Each one is a change somebody can make this afternoon.

  • Turn Privacy Mode on at the team level, today, and let new laptops inherit it.“Privacy Mode can be enabled in settings or by a team or enterprise admin.” source, read
  • If you are asked for certifications, these are the ones Cursor publishes.“Cursor holds AIUC-1, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 certifications, along with a SOC 2 Type II attestation.” source, read

Worth knowing

  • A new developer joining a team does not have to be told to switch Privacy Mode on.“New team members inherit the team's Privacy Mode settings.” source, read

Questions we get asked

Is Cursor safe for client data?

Whether Cursor is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.

On Free and Pro and on Teams and Enterprise, Cursor says a setting stops it training its models on what staff type, and we did not find which way that setting starts.

Every fact on this page is Cursor's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.

Does Cursor train its models on what our staff type into Cursor?

On Free and Pro and on Teams and Enterprise, Cursor says a setting stops it training its models on what staff type, and we did not find which way that setting starts. On Free and Pro: It turns on one setting.

Cursor says Privacy Mode is available on every plan and that it then does not train on your data. Cursor's own words: "Privacy Mode is available to anyone (free or Pro)." (read 2026-11-02).

On Teams and Enterprise: An admin can set Privacy Mode for the team, so it is not left to each developer. Cursor's own words: "Privacy Mode can be enabled in settings or by a team or enterprise admin." (read 2026-11-02).

How long does Cursor keep what we put into Cursor?

On Free and Pro: Not found in the pages we read. On Teams and Enterprise: Not found in the pages we read.

Can an administrator read what our staff typed into Cursor?

A new joiner gets the team's setting rather than the default, which is what makes this worth doing once. Cursor's own words: "New team members inherit the team's Privacy Mode settings." (read 2026-11-02).

Will Cursor sign a Business Associate Agreement for Cursor?

We didn't find a BAA statement in the pages listed below; ask Cursor before any patient data goes in.

How do we find out which version of Cursor our staff are using?

Look on the computers. A tool somebody installed themselves, or signed into with a personal account, does not appear in any IT list. Obsidian Ridge's free 30-day AI security assessment takes that inventory for 30 days and shows what each tool could reach.

Sources

Cursor’s own pages, with the date each was read. Nothing on this page comes from anywhere else.

All 15 tools, side by side, or run the AI tool risk checker over the ones you know about.

Other tools people ask about

Same question, different answers. The ones in the same category are the ones staff swap between.