1 min lesson
Procurement, security review & land-and-expand
Show why this lesson detail matters: "Enterprise deals die in procurement and security review more often than in the demo."
Step 1 of 3
Procurement and security as a path you clear, not a wall you climb
Enterprise deals die in procurement and security review more often than in the demo. Your job is to remove friction and route precisely.
Learn more
Advanced table
Surface the artifact, set the follow-up. Never invent a term
- Buyer asks for
- Master agreement
- You provide / route
- MSAMaster Service Agreement. The overarching contract between customer and vendor that everything else (order forms, DPAs, SLAs) hangs off. Negotiated once so each later purchase doesn't restart legal review. Press Enter for the full definition. → AE/Legal
- Owner
- Legal
- Buyer asks for
- Data processing terms
- You provide / route
- DPAData Processing Agreement. The contract spelling out exactly how a vendor may process your data: purposes, subprocessors, retention and breach duties. The document privacy reviews actually read. Press Enter for the full definition. → AE/Legal
- Owner
- Legal
- Buyer asks for
- Security attestation
- You provide / route
- SOC 2 Type II report
- Owner
- Security/FE routes
- Buyer asks for
- Who touches our data
- You provide / route
- Sub-processors list
- Owner
- Trust Center
- Buyer asks for
- Self-service due diligence
- You provide / route
- Trust Center
- Owner
- Trust Center
| Buyer asks for | You provide / route | Owner |
|---|---|---|
| Master agreement | MSAMaster Service Agreement. The overarching contract between customer and vendor that everything else (order forms, DPAs, SLAs) hangs off. Negotiated once so each later purchase doesn't restart legal review. Press Enter for the full definition. → AE/Legal | Legal |
| Data processing terms | DPAData Processing Agreement. The contract spelling out exactly how a vendor may process your data: purposes, subprocessors, retention and breach duties. The document privacy reviews actually read. Press Enter for the full definition. → AE/Legal | Legal |
| Security attestation | SOC 2 Type II report | Security/FE routes |
| Who touches our data | Sub-processors list | Trust Center |
| Self-service due diligence | Trust Center | Trust Center |
Surface the artifact, set the follow-up. Never invent a term.
SOC 2 Type II, AES-256 at rest, TLS 1.2+ in transit, annual penetration test, Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. + ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. (not with your own API keys), PrivateLinkAn AWS connection Cursor uses for private Git provider and repository-origin traffic; it does not cover model-provider traffic. Press Enter for the full definition. + Cloudflare Tunnel, SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition./SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition./OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition., SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition., RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition., model/MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition./repo allowlists, hooks, terminal sandboxing, audit logs, AI-code tracking. State what's verified; route anything you're unsure of.
If asked 'do you support [specific regulation]?' or 'can you commit to X in the contract?' and you don't have a verified answer, say 'let me get you the precise answer from our security/legal team' and set the follow-up. An invented compliance commitment can sink the deal or worse. Confidence in your lane; routing outside it.
Learn more
Optional practice