Cursor Security & Privacy Mode: What Teams Need to Know

Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. ensures your code is never used for training - by Cursor or the underlying model providers. It's available on all tiers, on by default for Enterprise teams, and admins can enforce it org-wide so members can't turn it off. Note: your code is still sent to providers to generate responses; the guarantee is about training and retention, not transmission.

Available and enforced are two different states.

Until an admin locks it org-wide, Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. is a per-account setting that each person can change, and the gap between the two states is where the practical risk sits. Enterprise teams start with it on. On every other plan the documented position is only that it is available, so read each account's setting rather than assuming it matches your policy.

Enterprise admins can also set an allowed team ID, which blocks sign-in from personal accounts on corporate machines. That control exists for a specific failure: a personal account may not have Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. enabled at all, so a developer signing into their own account on a work laptop steps outside a locked org policy without ever deciding to.

Bringing your own API key moves the guarantee to a different contract, and it is the detail I would raise with a security reviewer before they find it themselves. With your own key, zero data retention rests on your agreement with the model provider rather than on Cursor's arrangement with that provider. Read those terms separately from Cursor's.

The controls that matter for teams are the ones you can lock org-wide: enforced Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition., zero data retention, SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. and SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition., and CMEK on Enterprise. The table maps each to its effect and the tier it's available on. One honest limit up front: model inference never runs on-prem. Self-hosted cloud-agent runners cover tool execution only.

Three of those seven rows are Enterprise, which is the trade-off the table states without arguing for. CMEK, US data residency and the HIPAA BAA are not switches a Teams plan turns on later, so choosing a plan and settling your security posture turn out to be one decision rather than two. Enforced Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. and zero data retention are the two that do not depend on tier, and between them they answer the training question outright.

Not for the training guarantee, and yes for several of the controls around it. Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. is available on every tier and keeps your code out of training data, though locking it org-wide takes an admin. SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. and SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. sit on Teams and Enterprise. CMEK, US data residency and a signed HIPAA BAA are Enterprise only.

Under a dozen engineers with no managed fleet, most of what you have is convention, and that is a more defensible position than it tends to sound. The controls that survive at that size are the per-account settings plus whatever ships inside the repository: .cursorignore over vendored data and generated artifacts, and a .cursor/hooks.json committed to the repo so every clone picks it up. A teammate can edit either one, which is tolerable while the team is small enough that somebody reads every diff.

It stops being tolerable earlier than most teams expect. Two dashboard settings that apply to everyone are worth more than any number of local conventions, and the security hardening guide walks the order Cursor recommends configuring them in. Start that migration while the account list is still short enough to audit by hand.

The honest, precise version of Cursor's posture: Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. is on by default for Enterprise teams (individuals switch it on in settings), most models run under zero-data-retention agreements - the few that require provider-side retention need an admin's approval before a Privacy Mode team can use them - and Cursor holds SOC 2 Type II. On location: Enterprise teams can enroll in US data residency so inference, processing and storage for supported features stay in the US, with EU and APAC residency in active development.

• `.cursorignoreA file listing paths Cursor must never index or read, kept separate from .gitignore. Press Enter for the full definition.` keeps paths out of indexing and blocks them from Agent, Tab, inline edit and @-mentions. It's best-effort - terminal and MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. tool output can't be filtered - so treat it as a guardrail for vendored data and generated artifacts, not the only defense for real secrets.
• Hooks add a deterministic layer on top of the model: run a PIIPersonally Identifiable Information. Data that can identify a person (names, emails, SSNs); regulated and sensitive. Press Enter for the full definition./secret scanner as a hook so sensitive strings are caught by rules, not left to the model's discretion.

Draw the line deliberately. Support and account teams using Cursor keep some work out of the model on purpose - billing and account-specific tasks need context they'd rather not hand to an LLM. That boundary isn't absolute, though: account-management data can be piped in from your CRM through an MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. server when the contractual or use-case detail genuinely helps the agent. The skill is deciding which side of the line a given piece of customer context sits on.

When the line does get crossed, the audit log will not be the thing that tells you. Cursor's audit log covers authentication and admin events rather than what went into a prompt, so a policy promising to detect a leak after the fact is promising something the log does not do. Hooks are where prompt-level evidence gets captured, and the compliance and monitoring guide covers what to record.