Skip to lesson
Exit
Cursor Product & Developer-Workflow Fluency1 / 2

1 min lesson

Know when to route, not guess

Explain the order in "Know when to route, not guess", then say how you would verify the result.

Step 1 of 2

Know when to route, not guess

You are the orchestrator of the security conversation, not the sole expert in it. Your job is to keep it moving and to bring the right person in fast.

  1. 1Anticipate. Send the standard security packet (SOC 2 report, data-handling overview, Privacy mode) before they ask, so the review starts warm.
  2. 2Answer what you can. Handle admin, identity and high-level data posture confidently and accurately.
  3. 3Route the deep cuts. Pull in the security/trust resource or Field Engineering for architecture, contractual retention terms and detailed questionnaires.
  4. 4Own the timeline. Track the review like a deal stage. Find the owner on their side, set a date and unblock weekly until it clears.
Say it like this

“Short version: when Privacy mode is on, Cursor guarantees your code data isn't used for training by Cursor or its model providers. The codebase index stores encrypted embeddings, with no plaintext copy of your code on Cursor's servers, and stored embeddings are deleted after six weeks of inactivity. Cursor is SOC 2 Type II and the report is available on request through the Trust Center at trust.cursor.com. The exact retention terms for your contract I'll confirm in writing, and I'll bring in our security team to walk your reviewers through them.”