2 min lesson
The security baseline, stated precisely
Consider this situation. "A security reviewer says: 'Privacy mode is on, so we have zero data retention, right?' How do you answer?" Start with the decision, then the evidence.
Step 1 of 2
The security baseline, stated preciselythe one-pager that closes deals
Vague reassurance loses a security reviewer; the named posture wins one. Learn this baseline cold so you can recite it without hedging, then point to the documentation rather than improvising specifics.
- Privacy mode
- When it is enabled (in settings or by a team admin), Cursor guarantees code data is not used for training by Cursor or its model providers. On Enterprise it is on by default and an admin can lock it org-wide.
- Zero data retention (ZDR)
- A separate matter. ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. comes from agreements with model providers, not from the Privacy mode toggle. Confirm the current arrangement in writing before you promise it.
- Attestations
- SOC 2 Type II, with the report available on request through the Trust Center.
- Data residency
- US-only residency is an opt-in on Enterprise, with a 10% uplift on model pricing for eligible models. Inference still runs on Cursor's infrastructure or its providers'.
- Where to point them
- trust.cursor.com for the written terms and the sub-processor list, and the Agent Security docs on cursor.com/docs for cloud-agent behavior.
Confirm in writing: recite this baseline, and let the contract be the source of record.
Cursor chunks the codebase and stores encrypted embeddings in a vector store, with no plaintext copy of your code on Cursor's servers. Cursor states the vectors cannot be reversed into the original code, and stored embeddings are deleted after six weeks of inactivity. Say that, then point to trust.cursor.com for the written terms. This is the question reviewers test first, so keep the wording this tight.
Learn more
Advanced table
The concrete admin console levers
The concrete admin console levers
"There's an admin dashboard" is literate; naming the actual levers is fluent. An admin governing cost, access and data exposure expects these specifics.
- Lever
- Audit logs (Enterprise)
- What it does
- Track authentication, user changes and settings changes
- Why an admin cares
- The accountability trail a security team requires before broad rollout
- Lever
- Spend alerts & group limits
- What it does
- Cost limits at individual, group or team level; group-level limits are Enterprise
- Why an admin cares
- No surprise from runaway spend; the cost-governance lever finance asks for
- Lever
- Restrict analytics to admins
- What it does
- Toggle: on = admins only, off = democratized
- Why an admin cares
- Controls who sees usage data across the org
- Lever
- .cursorignoreA file listing paths Cursor must never index or read, kept separate from .gitignore. Press Enter for the full definition.
- What it does
- Blocks agent reads and context for listed paths; terminal and MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. tools can bypass it, so pair it with approvals and file permissions
- Why an admin cares
- Keeps secrets and regulated trees out of the agent's context; distinct from .gitignore
- Lever
- Cloud-agent environments
- What it does
- Per-run env vars, domain allowlists, run-time limits, branch, MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. toggles, model
- Why an admin cares
- Bounds what an agent can do; environments can be saved, shared and snapshotted
| Lever | What it does | Why an admin cares |
|---|---|---|
| Audit logs (Enterprise) | Track authentication, user changes and settings changes | The accountability trail a security team requires before broad rollout |
| Spend alerts & group limits | Cost limits at individual, group or team level; group-level limits are Enterprise | No surprise from runaway spend; the cost-governance lever finance asks for |
| Restrict analytics to admins | Toggle: on = admins only, off = democratized | Controls who sees usage data across the org |
| .cursorignoreA file listing paths Cursor must never index or read, kept separate from .gitignore. Press Enter for the full definition. | Blocks agent reads and context for listed paths; terminal and MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. tools can bypass it, so pair it with approvals and file permissions | Keeps secrets and regulated trees out of the agent's context; distinct from .gitignore |
| Cloud-agent environments | Per-run env vars, domain allowlists, run-time limits, branch, MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. toggles, model | Bounds what an agent can do; environments can be saved, shared and snapshotted |
Speaking these by name is what tells an admin you've actually configured a deployment.
Beyond active-user counts, the admin dashboard surfaces usage across surfaces (IDE, cloud agents, CLI) and by model, work classifiers (new feature vs bug fix vs maintenance), an agent-mode breakdown (plan vs ask vs agent writing code), plan-mode adoption, skills/hooks/MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. invocation counts and a prompt-specificity score. Lots of low-specificity prompts, or expensive models on trivial tasks, tell you exactly where to invest in training. All of it is also available via an analytics API and admin API for custom reporting.
Some features exclude legacy privacy mode. Origin and shared canvases are documented examples, and a team on legacy privacy mode has to move to current Privacy mode before it can use them. Check each feature's doc during rollout so the exclusion does not silently block adoption. Related: self-hosted cloud agentsCloud agents whose infrastructure runs inside your own VPC, keeping more of the environment under your control and offering configurable retention. Press Enter for the full definition. (Enterprise) keep the repository checkout and tool execution on hardware the customer operates, but inference is still external. The agent loop and the model calls stay with Cursor and its providers.
The accounts that adopt fastest are the ones where the ADM treated security as a workstream from day one rather than a surprise at month two. Pre-empting the standard questions, owning the questionnaire timeline and knowing exactly who answers what can take weeks out of time-to-adoption. In an EBR, "we cleared security in eleven days" is a number worth saying.