1 min lesson
Perishable specifics (certs, exact terms) change
Use "Name that fear out loud, then hand back specifics" to describe the practical rule.
Step 1 of 3
Addressing IP-leak fear head-on
The fear under the question is the nightmare of proprietary source landing in a model's training corpus and resurfacing for a competitor. Name that fear out loud, then hand back specifics: the Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. no-training guarantee enforced org-wide, ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. terms, the SOC 2 report, and an honest account of the network path (TLS through their own proxy, with a private leg available for a self-hosted Git provider).
Learn more
Advanced table
Perishable specifics (certs, exact terms) change
- Legal / security objection
- “Our code could be used to train a competitor's model.”
- What resolves it
- Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition.: code is not used for training by Cursor or its model providers; ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. terms cover retention
- Legal / security objection
- “We need proof, not promises.”
- What resolves it
- SOC 2 Type II report + penetration test summaries via the Trust Center
- Legal / security objection
- “Is it encrypted?”
- What resolves it
- AES-256 at rest; TLS 1.2+ in transit to Cursor services
- Legal / security objection
- “Data can't traverse the public internet.”
- What resolves it
- The inference path is TLS through your own proxy with Cursor's domains allowlisted; the Git-provider leg can be private (PrivateLinkAn AWS connection Cursor uses for private Git provider and repository-origin traffic; it does not cover model-provider traffic. Press Enter for the full definition. / Cloudflare Tunnel, Enterprise); anything beyond that is an escalation to Cursor's security team
- Legal / security objection
- “What if a dev forgets to enable Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition.?”
- What resolves it
- Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. enforced org-wide as an admin policy, not left to individuals
- Legal / security objection
- “We self-host our models.”
- What resolves it
- Model routing / BYO keys; flag that ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. terms then shift to the provider
| Legal / security objection | What resolves it |
|---|---|
| “Our code could be used to train a competitor's model.” | Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition.: code is not used for training by Cursor or its model providers; ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. terms cover retention |
| “We need proof, not promises.” | SOC 2 Type II report + penetration test summaries via the Trust Center |
| “Is it encrypted?” | AES-256 at rest; TLS 1.2+ in transit to Cursor services |
| “Data can't traverse the public internet.” | The inference path is TLS through your own proxy with Cursor's domains allowlisted; the Git-provider leg can be private (PrivateLinkAn AWS connection Cursor uses for private Git provider and repository-origin traffic; it does not cover model-provider traffic. Press Enter for the full definition. / Cloudflare Tunnel, Enterprise); anything beyond that is an escalation to Cursor's security team |
| “What if a dev forgets to enable Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition.?” | Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. enforced org-wide as an admin policy, not left to individuals |
| “We self-host our models.” | Model routing / BYO keys; flag that ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. terms then shift to the provider |
Perishable specifics (certs, exact terms) change; confirm against current security docs before you put them in a customer's hands.
“Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. means your code is not used to train models, by us or our providers, and we enforce it org-wide. Zero-data-retention terms cover storage: code sent for inference is not stored. I'll put the data flow and the SOC 2 report in front of your security team this week. And I'll tell you the one boundary up front: if you bring your own model keys, your provider's terms govern that traffic, not ours.”
In the technical or discovery round, an interviewer may bait you: “So you guarantee our code is never retained, right?” The senior answer volunteers the BYO-keys exception before they corner you on it. Selling on the caveat is the exact judgment this role tests.
Learn more
Optional practice