1 min lesson
Perishable specifics (certs, exact terms) change
Say what this means in practice. "Hand back specifics, not reassurance."
Step 1 of 3
Addressing IP-leak fear head-on
The fear under the question is the nightmare of proprietary source landing in a model's training corpus and resurfacing for a competitor. Name that fear out loud. Hand back specifics, not reassurance. The table pairs each objection with the answer.
Learn more
Advanced table
Perishable specifics such as certs and exact terms change
- Legal / security objection
- "Our code could be used to train a competitor's model."
- What resolves it
- Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition.: code is not used for training by Cursor or its model providers; ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. terms cover retention under managed inference, with the BYO-key and provider-retention exceptions named
- Legal / security objection
- "We need proof, not promises."
- What resolves it
- SOC 2 Type II report + penetration test summaries via the Trust Center
- Legal / security objection
- "Is it encrypted?"
- What resolves it
- AES-256 at rest; TLS 1.2+ in transit to Cursor services
- Legal / security objection
- "Data can't traverse the public internet."
- What resolves it
- The inference path is TLS through your own proxy with Cursor's domains allowlisted; the Git-provider leg can be private (PrivateLinkAn AWS connection Cursor uses for private Git provider and repository-origin traffic; it does not cover model-provider traffic. Press Enter for the full definition. / Cloudflare Tunnel, Enterprise); anything beyond that is an escalation to Cursor's security team
- Legal / security objection
- "What if a dev forgets to enable Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition.?"
- What resolves it
- Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. enforced org-wide as an admin policy, not left to individuals
- Legal / security objection
- "We self-host our models."
- What resolves it
- Model routing / BYO keys; flag that ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. terms then shift to the provider
| Legal / security objection | What resolves it |
|---|---|
| "Our code could be used to train a competitor's model." | Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition.: code is not used for training by Cursor or its model providers; ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. terms cover retention under managed inference, with the BYO-key and provider-retention exceptions named |
| "We need proof, not promises." | SOC 2 Type II report + penetration test summaries via the Trust Center |
| "Is it encrypted?" | AES-256 at rest; TLS 1.2+ in transit to Cursor services |
| "Data can't traverse the public internet." | The inference path is TLS through your own proxy with Cursor's domains allowlisted; the Git-provider leg can be private (PrivateLinkAn AWS connection Cursor uses for private Git provider and repository-origin traffic; it does not cover model-provider traffic. Press Enter for the full definition. / Cloudflare Tunnel, Enterprise); anything beyond that is an escalation to Cursor's security team |
| "What if a dev forgets to enable Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition.?" | Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. enforced org-wide as an admin policy, not left to individuals |
| "We self-host our models." | Model routing / BYO keys; flag that ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. terms then shift to the provider |
Perishable specifics such as certs and exact terms change; confirm against current security docs before you put them in a customer's hands.
"Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. means your code is not used to train models, by us or our providers, and we enforce it org-wide. Under our managed inference, zero-data-retention terms cover storage: code sent for inference is not stored. I'll put the data flow and the SOC 2 report in front of your security team this week. And I'll tell you the boundaries up front. If you bring your own model keys, your provider's terms govern that traffic, not ours. A few models, Fable 5.1 among them, are retained by their provider even under Privacy Mode, so they stay off until your admin opts in."
In the technical or discovery round, an interviewer may bait you: "So you guarantee our code is never retained, right?" The senior answer volunteers the exceptions, BYO keys and models with provider-side retention, before they corner you on them. Selling on the caveat is the exact judgment this role tests.
Learn more
Optional practice