1 min lesson
The security baseline, stated precisely
Name the parts in "The security baseline, stated precisely" and give the practical job of each one.
Step 1 of 2
The security baseline, stated preciselythe one-pager that closes deals
Vague reassurance loses a security reviewer; the named posture wins one. Learn this baseline cold so you can recite it without hedging, then point to the documentation rather than improvising specifics.
- Privacy mode
- On by default and cannot be turned off - no code or prompts stored downstream or used for training.
- Zero data retention
- ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. agreements in place with all major model providers.
- Attestations
- SOC 2 Type 2; SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. and MDM enforcement supported.
- Data residency
- Code never leaves the US; Cursor's own VMs are SOC 2 compliant.
- Where to point them
- trust.cursor.com and the dedicated cloud-agent security page (repo cloning, snapshots, secrets/env-var storage).
Big companies have enabled cloud agents after months-long security reviews - the posture is built to survive one.
On first open, Cursor chunks the codebase and stores vector embeddings - the embeddings are hashed and stored, but the raw code is held ephemerally and then deleted. Long-term storage is ONLY the vector DB. This is the precise, repeatable answer to the #1 security question, and it's faster and better than grep on large (e.g. 2M-line) repos at prompt time. Get this one verbatim - it's the one reviewers test.
Learn more
Advanced table
The concrete admin console levers
The concrete admin console levers
"There's an admin dashboard" is literate; naming the actual levers is fluent. An admin governing cost, access and data exposure expects these specifics.
- Lever
- Audit logs
- What it does
- Track authentication, user changes and settings changes
- Why an admin cares
- The accountability trail a security team requires before broad rollout
- Lever
- Spend alerts & group limits
- What it does
- Cost limits at individual, group or team level
- Why an admin cares
- No surprise from runaway spend; the cost-governance lever finance asks for
- Lever
- Restrict analytics to admins
- What it does
- Toggle: on = admins only, off = democratized
- Why an admin cares
- Controls who sees usage data across the org
- Lever
- .cursorignoreA file listing paths Cursor must never index or read, kept separate from .gitignore. Press Enter for the full definition.
- What it does
- Specifies files Cursor should never index or view
- Why an admin cares
- Keeps sensitive code out of indexing and agent reach - distinct from .gitignore
- Lever
- Cloud-agent environments
- What it does
- Per-run env vars, domain allowlists, run-time limits, branch, MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. toggles, model
- Why an admin cares
- Bounds what an agent can do; environments can be saved, shared and snapshotted
| Lever | What it does | Why an admin cares |
|---|---|---|
| Audit logs | Track authentication, user changes and settings changes | The accountability trail a security team requires before broad rollout |
| Spend alerts & group limits | Cost limits at individual, group or team level | No surprise from runaway spend; the cost-governance lever finance asks for |
| Restrict analytics to admins | Toggle: on = admins only, off = democratized | Controls who sees usage data across the org |
| .cursorignoreA file listing paths Cursor must never index or read, kept separate from .gitignore. Press Enter for the full definition. | Specifies files Cursor should never index or view | Keeps sensitive code out of indexing and agent reach - distinct from .gitignore |
| Cloud-agent environments | Per-run env vars, domain allowlists, run-time limits, branch, MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. toggles, model | Bounds what an agent can do; environments can be saved, shared and snapshotted |
Speaking these by name is what tells an admin you've actually configured a deployment.
The admin dashboard surfaces usage across surfaces (IDE, cloud agents, CLI) and by model, work classifiers (new feature vs bug fix vs maintenance), an agent-mode breakdown (plan vs ask vs agent writing code), plan-mode adoption, skills/hooks/MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. invocation counts and a prompt-specificity score. Lots of low-specificity prompts - or expensive models on trivial tasks - tells you exactly where to invest in training. All of it is also available via an analytics API and admin API for custom reporting. This is the same data that feeds every ROIReturn on Investment. The value gained versus what it cost, the language an economic buyer funds deals in. Press Enter for the full definition. and adoption decision you'll make on the account.
Cloud agents respect the same privacy mode as the account, but they do NOT work with LEGACY privacy mode - the cloud VM must store the codebase for the duration of the agent run, which legacy privacy mode forbids. A team on legacy privacy mode has to switch off it to use cloud agents. Surface this during rollout; left undiscovered it silently blocks cloud-agent adoption. Related: "self-hosted" (private workersCloud-agent machines that run inside your own network so they can reach internal systems; the model inference still calls external providers. Press Enter for the full definition.) runs the container in the customer's network for on-prem source access, but inference is still external - the agent still calls the model providers, exactly like the desktop.
The accounts that adopt fastest are the ones where the ADM treated security as a workstream from day one rather than a surprise at month two. Pre-empting the standard questions, owning the questionnaire timeline and knowing exactly who answers what can take weeks out of time-to-adoption. In an EBR, "we cleared security in eleven days" is a number worth saying.
If asked how you'd handle a security objection you don't know cold, do not bluff. Say what you do know accurately, name that you'd confirm exact terms in writing and name the internal partner you'd bring. Demonstrating sound judgment about the limits of your own knowledge is exactly the truth-seeking signal Cursor screens for.