Cursor's control surface: five families + Organizations

The ask: 'Who can use it and how do we provision/deprovision at scale?'

Controls: SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. (SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition./OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition.), SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. for lifecycle, RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. for least privilege.

The ask: 'Where does our code go and is it used to train?'

Controls: Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. (on by default, can't be disabled), zero-data-retention terms with all major model providers, AES-256 at rest, TLS 1.2+ in transit.

The precise storage answer: on first open Cursor chunks the codebase and stores hashed vector embeddings; the raw code is held ephemerally and then deleted, so the only long-term store is the vector DB. 'We don't want your codebase any more than you want us to have it.'

The ask: 'How do we constrain what the tool and agents can do?'

Controls: model / MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. / repo allowlists, hooks, terminal sandboxing, plus .cursorignore - a file that lists paths Cursor must never index or view (distinct from .gitignore), keeping secrets and PIIPersonally Identifiable Information. Data that can identify a person (names, emails, SSNs); regulated and sensitive. Press Enter for the full definition.-laden trees out of the index and out of agent reach.

The ask: 'Can traffic stay off the public internet / inside our boundary?'

Controls: AWS PrivateLinkAn AWS connection Cursor uses for private Git provider and repository-origin traffic; it does not cover model-provider traffic. Press Enter for the full definition., Cloudflare Tunnel, IP allowlisting.

For the strictest cases: self-hosted / private workersCloud-agent machines that run inside your own network so they can reach internal systems; the model inference still calls external providers. Press Enter for the full definition. (beta) run the cloud-agent container in your network so it can reach on-prem source control, internal registries and internal MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. servers. Per-run cloud-agent governance: domain allowlists, run-time caps, env-var isolation, branch/model/MCP selection - and an environment you save and share rather than rebuild.

The ask: 'How do we see and prove what happened?'

Controls: audit logs, usage analytics, AI-code tracking.