1 min lesson
Security & governance summary
Explain the practical point behind "Lead with their bar, not Cursor's features."
Step 1 of 3
2. Security & governance summaryThe architecture-review section
This is the document the platform team reads first. Lead with their bar, not Cursor's features. Two principals and a skeptical legal team killed a prior AI tool, so the burden of proof sits with you.
Learn more
Advanced table
Architecture-review summary
- Control
- Training
- Northwind requirement
- Source code never used to train models
- How Cursor meets it
- Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition.: a toggle that stops training on your code, enforceable and lockable org-wide on Enterprise
- Control
- Data retention
- Northwind requirement
- Inputs and outputs not stored by providers
- How Cursor meets it
- Zero-data-retention provider agreements, the default for most models - a separate mechanism from the Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. toggle
- Control
- Identity
- Northwind requirement
- SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. mandatory, no personal logins
- How Cursor meets it
- SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition./SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. enforced; self-serve seats migrated under org control
- Control
- Lifecycle
- Northwind requirement
- Automatic deprovisioning on offboard
- How Cursor meets it
- SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. provisioning and deprovisioning tied to the IdP
- Control
- Access
- Northwind requirement
- Role-appropriate permissions
- How Cursor meets it
- RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. and admin controls scoped per team and role
- Control
- Auditability
- Northwind requirement
- Visibility for security review
- How Cursor meets it
- Admin dashboard with usage and audit surfaces
- Control
- Model routing
- Northwind requirement
- Only approved models/endpoints
- How Cursor meets it
- Platform-controlled model selection and routing
| Control | Northwind requirement | How Cursor meets it |
|---|---|---|
| Training | Source code never used to train models | Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition.: a toggle that stops training on your code, enforceable and lockable org-wide on Enterprise |
| Data retention | Inputs and outputs not stored by providers | Zero-data-retention provider agreements, the default for most models - a separate mechanism from the Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. toggle |
| Identity | SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. mandatory, no personal logins | SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition./SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. enforced; self-serve seats migrated under org control |
| Lifecycle | Automatic deprovisioning on offboard | SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. provisioning and deprovisioning tied to the IdP |
| Access | Role-appropriate permissions | RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. and admin controls scoped per team and role |
| Auditability | Visibility for security review | Admin dashboard with usage and audit surfaces |
| Model routing | Only approved models/endpoints | Platform-controlled model selection and routing |
Architecture-review summary: their requirement first, the control that satisfies it second.
Watch out
Don't overclaim a Cursor security feature you can't precisely support. If the platform team asks about a specific certification, data-residency region or contract clause, the credible answer is “I'll confirm the exact posture and bring it back with our security team,” not a confident guess. One wrong claim in a regulated review costs you the account.
Learn more
Advanced table
Adoption + outcome metrics and the ROI narrative
3. Adoption + outcome metrics and the ROI narrative
- Metric
- PR-to-merge cycle time
- Why it matters
- The pain the CTO will pay to fix
- How you instrument it
- Baseline vs. pilot, from the git/PR system
- Metric
- Ramp-to-first-merge
- Why it matters
- Onboarding speed at 3,000-eng scale
- How you instrument it
- New-hire time-to-first-merged-PR
- Metric
- PR throughput
- Why it matters
- Shipping velocity per team
- How you instrument it
- Merged PRs per engineer per sprint
- Metric
- Seat utilization
- Why it matters
- Adoption depth, not just licenses
- How you instrument it
- Active vs. provisioned seats from admin console
- Metric
- Developer satisfaction
- Why it matters
- Durable adoption signal
- How you instrument it
- Short pulse survey, pre/post pilot
| Metric | Why it matters | How you instrument it |
|---|---|---|
| PR-to-merge cycle time | The pain the CTO will pay to fix | Baseline vs. pilot, from the git/PR system |
| Ramp-to-first-merge | Onboarding speed at 3,000-eng scale | New-hire time-to-first-merged-PR |
| PR throughput | Shipping velocity per team | Merged PRs per engineer per sprint |
| Seat utilization | Adoption depth, not just licenses | Active vs. provisioned seats from admin console |
| Developer satisfaction | Durable adoption signal | Short pulse survey, pre/post pilot |
Instrument adoption and outcome together - high seats with flat outcomes is a warning, not a win.
Say it like this
“If the pilot moves payments' median cycle time from 3.5 days toward 2, that's roughly X engineer-hours a sprint returned across the org - and it's measured, not promised. That's the bet and here's the evidence we built to check it.”
Learn more
Optional practice
Practice: Security & governance summary
QYour pilot dashboard shows seat utilization climbing fast but PR-to-merge cycle time essentially flat. What does this tell you and what do you do?