cursor-compliance-audit

# Cursor Compliance Audit Compliance and security auditing framework for Cursor IDE usage. Covers SOC 2, GDPR, and HIPAA assessment with audit checklists, evidence collection, and remediation guidance. ## Cursor Security Posture ### Certifications and Attestations | Certification | Status | Notes | |--------------|--------|-------| | SOC 2 Type II | Certified | Annual audit, report available on request | | Penetration testing | Annual | Results shared under NDA (Enterprise) | | Encryption at rest | AES-256 | All stored data | | Encryption in transit | TLS 1.2+ | All API communications | | Zero data retention | Available | Via Privacy Mode | | GDPR compliance | Yes | EU data processing supported | | HIPAA BAA | Not available (as of early 2026) | See HIPAA section | ### Data Processing Architecture ``` Developer Machine │ ├─► Cursor Client ──► Cursor API (US/EU) ──► Model Provider │ (local) (routing + auth) (OpenAI/Anthropic) │ │ │ └─► Zero retention agreement │ ├─► Codebase Index ──► Embedding API ──► Turbopuffer (vectors) │ (no plaintext stored) │ └─► Local Settings (API keys, preferences) (never transmitted) ``` ## Audit Checklist: SOC 2 ### CC6.1 — Logical Access Controls ``` [ ] SSO (SAML/OIDC) configured and enforced [ ] MFA enabled at Identity Provider level [ ] RBAC roles assigned: Owner, Admin, Member [ ] Inactive users de...