Cursor Enterprise: Compliance & Monitoring

Audit logs record who changed what in your team and organization: sign-ins, membership, roles, API keys, settings, integrations, Cloud Agent environments, Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. configuration and Origin repositories. They're available on the Enterprise plan, and admins view them in the team dashboard. Payloads carry identifiers, names and changed settings, never prompts, agent output, generated code or credentials. For development activity, Cursor recommends hooks, covered below.

Most of that list is administration, not usage. Events such as privacy_mode, team_rule, team_hook, mcp_server_config and team_repo record your controls changing, which is usually the evidence an auditor asks for when testing controls. If an incident raises the question of whether your documented guardrails were in place, this log answers it. Each event records the time, and it names the actor, client IP and product surface when the request carried them.

None of this helps a pilot on a Teams plan, because audit logs are an Enterprise feature. If a security review will want evidence from your pilot, settle the plan before the pilot starts.

View audit logs in the team dashboard at cursor.com/dashboard/audit-log, which needs admin access on an Enterprise plan. Filter by date range, event type, actor or application, then export the filtered result to CSV. A script can pull the same events from the Admin API, for one team or for every team linked to an organization. To have Cursor push events to your own systems, contact hi@cursor.com to set up streaming.

Streaming puts the same events wherever your alerting and retention already live, so nobody has to watch a second dashboard. A SIEM, reached directly or through the webhook, gives you correlation and alerting next to everything else you monitor. An S3 bucket gives you cheap long-term retention. You may want both, because retention keeps everything for years while alerting surfaces a short list of events fast.

Streaming isn't self-serve. Setup goes through hi@cursor.com, so treat it as a lead-time item and raise it in the same thread as the contract instead of the week before an audit. Until it's live, the CSV export and the Admin API cover you.

Streamed events arrive as JSON with a metadata block that holds the event's id and timestamp, plus team_id, ip_address, user_email and the event's own fields under a key named after its event_type. Event types include login, logout, add_user, update_user_role, team_settings, privacy_mode and the BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. events.

When an event you expected is missing, check the dashboard before the pipeline. Filter to that actor and that day to see whether the event exists at the source. Then check whether Cursor logs that action at all. Its compliance docs keep a list of what isn't logged, and no work on the delivery side will produce those events.

Cursor BlameAn augmented git blame that records line-level human and agent co-authorship, so you can trace which code was written by AI versus a person. Press Enter for the full definition. extends git blame with AI attribution. It marks each line as Tab, Agent or human, and shows which model produced Agent lines. It's an Enterprise feature, and it's off by default until a team admin turns it on in team settings. During a security review or an incident, it tells you who wrote a given line and which lines need extra scrutiny before they ship.

The AI Code Tracking API, also Enterprise-only and still in alpha, reports per-commit AI usage, including whether a commit came from the IDE, the CLI or a cloud agent. Above the line level, the analytics dashboard reports adoption, the audit log gives per-action detail, and the Analytics API lets Enterprise teams pull those metrics into their own reporting.

The dashboard's AI share of committed code comes from diff signatures computed on the device where the code was written. Cursor's analytics docs say AI code tracking now covers the CLI and Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition.. CLI commits still have to be scored on the machine where they were written, and a formatter that rewrites lines can invalidate a signature, per team analytics.

The dashboard puts every line it can't attribute under "Other", which covers human code and any Cursor code it failed to detect. Cursor doesn't document whether Cursor BlameAn augmented git blame that records line-level human and agent co-authorship, so you can trace which code was written by AI versus a person. Press Enter for the full definition. has the same blind spots, so in an audit trail, treat an unattributed line as unknown.

A record of development activity has to come from outside the audit log, and Cursor recommends hooks for it. The two example scripts in Cursor's compliance docs map onto specific hook events. beforeSubmitPrompt fires right after someone hits send, before the request goes to Cursor's backend. afterFileEdit fires after the agent edits a file and receives the path and the edits. Both example scripts post a line to a compliance endpoint you run.

Inline Tab completions have their own hook. Cursor's docs apply afterFileEdit to Agent Chat and put Tab edits on a separate afterTabFileEdit hook, so a record of generated code needs both.

Hooks fail open by default. If a script crashes, times out or exits with an error code other than 2 (the code for deny), the action goes ahead. For a logging hook, a quiet week reads the same whether the team was on holiday or your endpoint was refusing connections. Nothing in the record separates the two, so an auditor asking whether the log is complete gets your word for it. Security hardening covers what fail-open means for hooks you use as controls.

Setting failClosed: true on the logging hook looks like the fix. It does make a failure visible, because a blocked prompt tells someone that logging is broken. But a quiet day in the record still doesn't prove that every prompt was logged, and any failure of the compliance script now blocks your team's prompts.

Measure the hook's own output instead. Count events per day, per developer where you can, and alert when a stream that normally carries traffic goes flat.

If you have Enterprise, put a compliance hook at the Team level. Four levels can define hooks, and the level decides who a hook covers. Enterprise hooks are MDM-managed and system-wide (/Library/Application Support/Cursor/hooks.json on macOS, /etc/cursor/hooks.json on Linux). Team hooks are configured in the web dashboard on Enterprise plans and sync to every member automatically. Project hooks sit in <project-root>/.cursor/hooks.json, and user hooks in ~/.cursor/hooks.json.

Every matching hook runs, whatever its level. A deny from any level blocks the action. For fields such as the follow-up message, Cursor merges responses in priority order (Enterprise, then Team, then Project, then User) and keeps the last one, so a lower level overrides a higher one.

A Team hook follows the person to whatever repo they open, so coverage tracks people, and it runs in cloud agents as well as on desktops. Its create, update and delete events land in the audit log as team_hook, so a change to the compliance hook itself leaves a record. Dashboard hooks don't take per-hook options such as failClosed or matcher, though.

Move to the MDM level when you need those options. Doing that before the script has settled means every fix to it waits on a device-management release.

Project hooks suit rules a single repository needs, and they travel with the code. Coverage then follows repositories, so a repo created next month has no compliance hook until someone adds one.

Cursor's hooks docs list the places a hook doesn't run. User-level hooks never load in cloud agents, so keep them out of a compliance design. Cloud agents can also start in a read-only environment where hooks don't run, so their record starts only once the agent has a writable environment. Tab hooks never fire there either, since Tab is an IDE feature.

On the desktop, the app waits only a short time for hooks to load before it sends a prompt. On Enterprise, turn on Block until hooks are ready in the dashboard's hook settings, so hooks run on every prompt, including the first one after a restart.

On a team of eight, most of this setup is more than you need. A project hook that appends a line per edit, plus git history, shows who changed what and when, and a delivery pipeline isn't worth building yet. What changes with headcount is who notices when logging stops. At eight people, someone sees that the file hasn't grown. Past a few hundred, nobody does unless something watches the event count.

Yes, on the Enterprise plan. OpenTelemetry Export streams your team's usage data to a collector you run: metrics for tokens, tool calls and best-effort cost, and logs for API requests, errors, corrections, skills, hooks, plugins and cloud agent lifecycle events. With Action Recording on, the logs also carry Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. actions. It's a separate pipeline from audit-log streaming, and it answers how much each session consumed and which skills and hooks ran. Admins configure it in Team Settings under OpenTelemetry Export.

Message text stays off unless a team opts in to conversation content, which exports user prompts and assistant responses, plus tool call arguments and results behind a separate toggle. Today it covers only Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. and Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition., and IDE, CLI and desktop conversations aren't on it yet. Cursor scrubs and caps each message before export.

Read the cost limitation before anyone builds a chargeback report. Cursor says cost isn't billing: cursor.cost.usage is a best-effort estimate, one series covers both included-quota drawdown and on-demand usage, and for BYOK it reflects the Cursor Token Rate only, not provider spend. Invoices come from the Admin and billing APIs.

Disabling or deleting a destination drops in-flight data, so rotate credentials by editing the destination instead of deleting and re-adding it.

Per-session analysis has to come from the logs, because metric datapoints carry no conversation or request ids, which keeps cardinality bounded. Cursor's recipe sums input and output tokens from cursor.api.request rows grouped by cursor.conversation.id, ranks the sessions, then left-joins skills, hooks and cloud agent events on the same id. Per-session tool data comes from Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition.'s action logs or a Cloud Agent's opt-in records of tool arguments and results. IDE and CLI tool calls aren't on the wire yet, and a Cloud Agent's Task subagents report under their own conversation id.

Yes. Cursor's compliance docs say it maintains compliance with industry standards including SOC 2 Type II and GDPR. Its security page also lists AIUC-1, ISO/IEC 27001:2022 and ISO/IEC 42001:2023 certifications alongside the SOC 2 Type II attestation. Certificates and reports are available on request through the Trust Center at trust.cursor.com, along with penetration test summaries, security architecture documentation and data flow diagrams.

You request the SOC 2 report through the Trust Center instead of downloading it, and Cursor's help center says access typically arrives within one business day. The standard DPAData Processing Agreement. The contract spelling out exactly how a vendor may process your data: purposes, subprocessors, retention and breach duties. The document privacy reviews actually read. Press Enter for the full definition. is different: it's published at cursor.com/dpa, so a reviewer has something to read on day one.

Put the SOC 2 request in on the day the review opens.

Cursor's announcement post gives the scope: the AIUC-1 testing "covered our key agent surfaces, including the IDE and cloud agents, using a representative enterprise configuration." Cursor describes AIUC-1 as "a new standard for AI agent security, safety, and reliability that combines an audit of organizational controls with adversarial testing of the product itself." It announced the certification on August 13, 2026, after an independent audit by Schellman, which the post names as the first authorized auditor for AIUC-1.

The testing ran across two rounds and several thousand scenarios, and it exercised rules, hooks and Auto-review.

AIUC-1 covers ground that SOC 2 doesn't. A SOC 2 report examines an organization's controls. AIUC-1 also tests the product adversarially: by Cursor's account, it checked how the agent handles insecure requests and actions that could do damage, from generating vulnerable code to running unsafe commands or deleting data.

Two details change how you file the report. The certification recurs, with testing at least quarterly and a full audit each year, so the report has a date and you should request it again. And the scope is a representative enterprise configuration, which says nothing about your own. If your organization has disabled Auto-review or runs without hooks, some of the safeguards the evaluators exercised aren't on.

The post lists AIUC-1 alongside a SOC 2 Type II attestation, third-party penetration testing, a bug bounty program and work toward ISO 27001 and ISO 42001. Cursor's security page, updated on August 25, 2026, lists both ISO certifications as held.

Cursor's Admin Setup Guide starts with the Trust Center and SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition., then moves on to source control, MDM and monitoring. Read it as an order of work, because the monitoring on this page only works once the earlier steps exist.

1. 1Review the Trust Center and Cursor's security brief.
2. 2Complete SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. with Okta, Entra or any SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. 2.0 provider, then optionally SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. and Organizations, Teams and Groups.
3. 3Connect GitHub, GitLab, Bitbucket or Azure DevOps. A Cursor account admin has to connect source control before anyone can start a Cloud Agent from a repository.
4. 4Deploy Cursor with MDM policies, and restrict personal accounts on company devices through AllowedTeamIDs.
5. 5Use the dashboard to monitor usage and set alerts, then follow the Security and Privacy Hardening page for a deeper pass.

The guide ends with two suggested features, and both have a compliance angle. Enabling browser automation for enterprise gives agents built-in browser testing, which is one more kind of agent action for your hooks to cover. The JetBrains path, Cursor Agent via ACPAgent Client Protocol. An open standard that lets any IDE host any coding agent; Cursor uses it to run inside JetBrains/IntelliJ and Android Studio. Press Enter for the full definition., is included with Cursor with no separate JetBrains AI license, which matters when you inventory the IDEs agent traffic can come from.

Use Cursor's responsible disclosure program. Email security-reports@cursor.com with a detailed description of the vulnerability, steps to reproduce, and any relevant screenshots or proof of concept. Cursor says it acknowledges reports within 5 business days.

Send all three in the first email. A report without repro steps turns into a back-and-forth with Cursor's security team, and that's time the vulnerability stays unfixed. This address is for flaws in Cursor itself. A compromise of your own account follows a different path.