cursor-compliance-audit

name	cursor-compliance-audit
description	Compliance and security auditing for Cursor IDE usage: SOC 2, GDPR, HIPAA assessment, evidence collection, and remediation. Triggers on "cursor compliance", "cursor audit", "cursor security review", "cursor soc2", "cursor gdpr", "cursor data governance".
allowed-tools	Read, Write, Edit, Bash(cmd:*)
version	1.0.0
license	MIT
author	Jeremy Longshore <[e-mail]>
compatible-with	claude-code, codex, openclaw
tags	["saas","cursor","security","compliance","audit"]

Cursor Compliance Audit

Compliance and security auditing framework for Cursor IDE usage. Covers SOC 2, GDPR, and HIPAA assessment with audit checklists, evidence collection, and remediation guidance.

Cursor Security Posture

Certifications and Attestations

Certification	Status	Notes
SOC 2 Type II	Certified	Annual audit, report available on request
Penetration testing	Annual	Results shared under NDA (Enterprise)
Encryption at rest	AES-256	All stored data
Encryption in transit	TLS 1.2+	All API communications
Zero data retention	Available	Via Privacy Mode
GDPR compliance	Yes	EU data processing supported
HIPAA BAA	Not available (as of early 2026)	See HIPAA section

Data Processing Architecture

Developer Machine
    │
    ├─► Cursor Client ──► Cursor API (US/EU) ──► Model Provider
    │   (local)           (routing + auth)        (OpenAI/Anthropic)
    │                           │
    │                           └─► Zero retention agreement
    │
    ├─► Codebase Index ──► Embedding API ──► Turbopuffer (vectors)
    │                      (no plaintext stored)
    │
    └─► Local Settings (API keys, preferences)
        (never transmitted)

Audit Checklist: SOC 2

CC6.1 — Logical Access Controls

[ ] SSO (SAML/OIDC) configured and enforced
[ ] MFA enabled at Identity Provider level
[ ] RBAC roles assigned: Owner, Admin, Member
[ ] Inactive users deprovisioned (SCIM or manual)
[ ] Access review completed (quarterly)

Evidence:
  - SSO configuration screenshot from admin dashboard
  - IdP MFA policy documentation
  - User list export from Cursor admin
  - SCIM sync logs (if applicable)

CC6.6 — System Boundaries

[ ] Privacy Mode enforced at team level
[ ] .cursorignore configured for sensitive files
[ ] Data classification aligned with .cursorignore patterns
[ ] Model provider data retention agreements documented
[ ] BYOK configuration documented (if applicable)

Evidence:
  - Privacy Mode enforcement screenshot
  - .cursorignore file contents (committed to git)
  - Cursor data use policy acceptance
  - API key provider agreements

CC6.7 — Data Transmission Security

[ ] All Cursor API calls use TLS 1.2+
[ ] Corporate proxy configured with valid certificates
[ ] No self-signed certificates or TLS bypasses
[ ] Network firewall rules documented

Evidence:
  - Network architecture diagram showing Cursor data flows
  - Firewall rules for cursor.com domains
  - Proxy configuration settings