Teams & Enterprise
Security and Privacy Hardening
This page consolidates the security and privacy guidance spread across the Cursor docs into one reference, so teams configuring Cursor can review and apply the right controls without hunting through every page. Each item links to its source doc for the full detail.
Shared responsibility
Cursor and your team share responsibility for a secure deployment. Cursor builds, secures, and operates the platform; you decide how to configure and adopt it for your environment. This page focuses on the controls you own. For Cursor's own posture, see the Trust Center, Security page, and Data Use policies.
- Cursor handles platform security, encryption, infrastructure, certifications, and the contractual commitments documented in the Trust Center.
- You configure identity, privacy enforcement, agent controls, extensibility trust, and monitoring, covered in the sections below.
- Layer controls for defense in depth: pair best-effort guardrails (Auto-review, allowlists,
.cursorignore) with deterministic ones (approvals, hooks, sandboxing) rather than relying on a single layer. - Most enforcement levers here (org-wide policies, MDM, SIEM streaming) are Enterprise features set in the team dashboard or through MDM. Per-user controls such as
.cursorignoreand Run Mode defaults apply more broadly.
Admin quickstart
Do these first. Each links to its detail page. Other items for regulated orgs, like Cloud Agent retention windows, appear in the tables below.
- Enforce Privacy Mode org-wide so members can't disable Privacy Mode or its zero data retention guarantees for Cursor-routed models.
- Set the org Run Mode policy to Auto-review (not Run Everything) and enable sandboxing.
- Distribute hooks for enforcement and logging across the team.
- Apply network allowlisting and exclude Cursor domains from SSL inspection; set Cloud Agent network egress if you use Cloud Agents.
- Set a Rules baseline for steering, knowing rules are non-deterministic.
- Govern plugins and MCP servers by reviewing what they install and approving trusted sources.
- Add
.cursorignoreentries for secrets and regulated paths. - Lock identity with SSO, SCIM, and Allowed Team IDs (MDM); restrict extensions, set an install cooldown (and optional signature verification), and keep clients on a supported version.
- Decide which models your organization allows and restrict the rest; restrict personal API keys (BYOK) if you rely on Cursor's ZDR agreements.
- Periodically review and stream audit logs to your SIEM.
- For encryption with your own keys, enable CMEK when your compliance program requires it (embeddings and Cloud Agent data).
Identity and access
Control who signs in and on which device.
| Control | Recommendation | Learn more |
|---|---|---|
| SSO and SCIM | Centralize authentication and automate user deprovisioning. | SSO, SCIM |
| Allowed Team IDs | Block personal accounts on corporate devices via MDM so Privacy Mode always applies. | Identity |
| Allowed Extensions | Allowlist trusted publishers; any entry blocks the rest unless you add "*": true. | Extensions |
| Extension install cooldown | Defer extension installs and updates until a marketplace version has been public for a set number of hours (enforced fleet-wide), with optional signature verification, to blunt short-lived malicious uploads. | Cooldown, Signatures |
| Supported version | Keep clients current and manage updates with the UpdateMode MDM policy. | Versions |
| Workspace Trust | Enforce through MDM so untrusted folders open in restricted mode. Restricted mode limits AI features; use it for truly untrusted trees, not day-to-day repos. | Workspace Trust |
Privacy and data
Control how your code and data are handled.
| Control | Recommendation | Learn more |
|---|---|---|
| Privacy Mode | Enforce org-wide so members can't disable Privacy Mode or its ZDR commitments for Cursor-routed models; on by default for Enterprise. See exceptions under BYOK and models with provider retention. | Privacy |
| Personal API keys (BYOK) | Restrict them; with your own keys, zero data retention is subject to your own agreement with the model provider, not Cursor's. | BYOK |
| CMEK | Encrypt embeddings and Cloud Agent data with your own key when your compliance program requires customer-managed keys. | CMEK |
| Model access | Approve specific models for use by your organization. Non-ZDR models require admin approval. | Models |
| Repository blocklist | Keep sensitive repos out of Cursor entirely. | Blocklist |
| Protected Git Scopes | Lock your Git org or namespace so only your teams use those repos with Cloud Agents and Bugbot. | Scopes |
Also see HIPAA BAA and Cyber Safeguards when those apply to your deployment.
Data retention and deletion
You and your users have several ways to manage your data.
| Mechanism | What it covers | How |
|---|---|---|
| Individual account deletion | That user's account and associated data, including indexed codebases; removed within 30 days. Does not by itself complete enterprise tenant offboarding. | Dashboard → Advanced Account Settings → Delete Account (guide) |
| Data subject requests | Personal Data access, correction, or deletion requests (DSAR). | Email hi@cursor.com to exercise privacy rights (Privacy Policy) |
| Shared chats and canvases | Published share links. | Delete from the dashboard (shared chats, shared canvases) |
| Cloud Agent deletion | An agent's conversation transcript and artifacts, on demand. | Delete Agent API |
| Automatic expiry | Indexed codebases (6 weeks inactivity); Cloud Agent snapshots (90 days inactivity). | Automatic, no action needed (indexing, snapshots) |
| Enterprise retention windows | Cap Cloud Agent data retention (Indefinite or 90 days; custom windows in early access). | Cloud Agent retention; contact sales |
| Contract termination (Enterprise) | Return or deletion of personal data for the enterprise engagement. | Governed by the DPA; coordinate with your account team |
Agent runtime and deterministic controls
The hard boundaries on what agents can do. Steering belongs with these, never instead of them.
| Control | Recommendation | Learn more |
|---|---|---|
| Auto-review (Run Mode) | Prefer it over Run Everything; it runs allowlisted calls, sandboxes shell commands when it can, and routes the rest through a best-effort classifier, so combine it with hooks. | Run Modes, Sandboxing |
| Network allowlisting | Allowlist *.cursor.sh and set per-server MCP network policy; exclude Cursor domains from SSL inspection so users don't disable security to "make it work." | Network, MCP network |
| Cloud Agent network egress | Restrict Cloud Agents' outbound access with Default + allowlist or Allowlist-only modes; Enterprise admins can lock the policy org-wide. | Cloud Agent network |
| Cloud Agent OIDC tokens | Federate Cursor-managed Cloud Agent VMs into AWS, GCP, Azure, or custom OIDC verifiers with short-lived JWTs instead of long-lived cloud keys. | OIDC tokens |
| Private connectivity | Reach private source control through PrivateLink or Cloudflare Tunnel, and align Cursor traffic with your endpoint security (AV/EDR/DLP). | Connectivity, Endpoint |
| Hooks | Enforce and observe at agent lifecycle points (block commands, scrub secrets, audit); distribute by MDM or cloud and set failClosed for critical hooks. | Hooks |
| Integrate your own tools | Call your SIEM, DLP, allowlist, or policy APIs from hooks instead of relying only on defaults. | Examples, Partners |
.cursorignore | Block agent read and context for secrets and regulated trees; terminal and MCP tools can't honor it, so pair with approvals and file permissions. | Ignore files |
| Other protections | Keep Browser, File-Deletion, External-File, and .cursor directory protection enabled so risky actions still require approval. | Protections, .cursor |
Steering and extensibility
Guidance and add-ons shape behavior and expand capability. Both are non-deterministic and are trust decisions.
| Control | Recommendation | Learn more |
|---|---|---|
| Rules | Steer behavior org-wide with Team Rules, but treat them as suggestions and pair them with the deterministic controls above. | Rules |
| Plugins | A plugin can bundle MCP servers, skills, subagents, rules, and hooks, so review what it installs and favor private team marketplaces. | Plugins, Marketplace security |
| MCP | Approve servers with the allowlist, restrict per-server tools, and apply network modes; review each server before enabling. | MCP allowlist, Security |
Monitor and respond
Review output, verify controls, and keep an audit trail.
| Practice | Recommendation | Learn more |
|---|---|---|
| Pre-production review | Have Bugbot and Security Agents review Cursor-generated code before it ships to production. | Bugbot, Security Agents |
| Audit logs | Periodically review them and stream to SIEM, webhooks, or S3 for authentication and admin events. | Compliance |
| Compliance logging | Use hooks to capture development-activity metadata beyond Cursor's audit logs. | Hooks logging |
| Responsible disclosure | Report vulnerabilities to security-reports@cursor.com. | Disclosure |
Further reading
Background and product context. The docs linked throughout this page are the authority for each control.
- Governing agent autonomy with Auto-review
- Implementing a secure sandbox for local agents
- Hooks for security and platform teams
Platform commitments
The controls on this page describe how to configure your own environment. They complement Cursor's platform security and contractual commitments:
- Trust Center for certifications, security architecture, and subprocessors
- Master Services Agreement and Data Processing Agreement for contractual and data-protection terms
Subscribe in the Trust Center to get notified when subprocessors or Cursor's security posture change. Cursor sends a confirmation email to the address you enter, and you must verify it before updates start arriving.
Harden Cursor for your organization
Contact our team to enable org-wide enforcement, CMEK, and SIEM streaming.