1 min lesson
The vendor security review of Cursor itself
Say what this means in practice: "Separately, their TPRM (third-party risk management) team will run Cursor through a security questionnaire."
Step 1 of 2
The vendor security review of Cursor itself
Separately, their TPRM (third-party risk management) team will run Cursor through a security questionnaire. Have the facts ready and accurate. The current control surface, with perishable specifics verified before you quote them in a deal:
SOC 2 Type IIAES-256 at restTLS 1.2+ in transitAnnual third-party pen testingPrivacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition.Zero-data-retention termsAWS PrivateLinkAn AWS connection Cursor uses for private Git provider and repository-origin traffic; it does not cover model-provider traffic. Press Enter for the full definition.Cloudflare TunnelSSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. (SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition./OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition.)SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition.RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition.Audit logs
Verified (June 2026)
The control surface above is current as of June 2026.
Proof point you can cite: the enterprise page states Cursor is trusted by 64% of the Fortune 500.
Perishable specifics (certs, dates, exact terms) change. Confirm them against current security docs before putting them in writing for a customer.