AI tool approval / Cursor

Cursor Business Security, Privacy & AI Tool Approval Checklist - 2026

Review Cursor Teams and Enterprise for company use: Privacy Mode, training, retention exceptions, backend routing, admin controls, and a practical approval checklist.

Last source verification: 6 September 2026. Reviewed by Operating Templates against the official pages linked below.

Scope: company-managed Teams and Enterprise

This review covers an editor-based pilot in a company-managed Cursor workspace. "Business" describes the approval use case; Cursor currently advertises Teams and Enterprise plans. Record your actual subscription and contract. Cursor Pricing and plan features

Cloud Agents, CLI automation, Bugbot, MCP connections, and other integrations require separate scope decisions before use. An editor approval does not automatically authorize every feature bundled with the subscription.

Decision: consider a restricted pilot once evidence is complete

Our assessment: A named-user pilot using approved repositories can be considered when privacy settings are enforced, model and retention terms are accepted, and the reviewer has checked the controls below. This is a proposed decision framework, not a blanket approval of Cursor.

Keep pending if required retention terms, processing locations, contract permissions, or administrative controls remain unresolved. If policy prohibits external code processing, do not approve the proposed workflow.

Record the allowed data, repositories, models, restrictions, accountable owner, evidence, expiry, and reviewer sign-off before rollout.

Document this approval decision - AI Tool Approval Form & Register, $49

Turn the evidence below into an editable request, signed decision, and spreadsheet register with owners and review dates.

Also rolling out company rules and training? AI Policy Launch Pack - $249.

How to read the evidence

Documented by Cursor: A statement in the linked official documentation, reviewed on the date above. It is vendor evidence, not an independent audit.
Technically verified: No Cursor runtime, network, retention, or tenant-control tests were performed for this article. Your reviewer should add dated test results for your deployment.
Not established: Tenant-specific settings, contractual exceptions, and unanswered questions remain open until supported by evidence. Recommendations below are our review guidance.

Privacy Mode, training, and retention

Documented by Cursor: With Privacy Mode enabled, Cursor says customer data is not used for training and describes ZDR agreements with model providers. Abuse detection can still lead to retained prompts or conversations for investigation. Non-ZDR models are identified or require administrative opt-in. Cursor Data Use & Privacy Overview

Documented by Cursor: With Privacy Mode off, code, prompts, and editor activity may be stored and used to improve features and train models. Cursor Data Use & Privacy Overview

Review action: Capture enforced workspace settings, restrict changes, and review each enabled model. Record acceptance of abuse-retention exceptions separately from the no-training commitment.

Backend routing and temporary caching

Documented by Cursor: Personal API-key requests still pass through Cursor's backend for prompt construction. File contents may be temporarily cached on Cursor servers, encrypted with client-generated keys available server-side during a request. Cursor Data Use & Privacy Overview

Not established: A precise cache expiry and a single maximum abuse-investigation retention period are not specified in that overview. Request the applicable terms. A personal API key does not establish a direct-only connection to a model provider.

Third-party models, stored code, and processing locations

Documented by Cursor: AI requests send prompts and code context to model providers; custom models can involve inference providers. Cloud Agents store encrypted repository copies while running. Certain retention models require approval before use, with the opt-in applying to the team. Cursor Privacy and Data Governance

Documented by Cursor: Residency depends on enrollment, features, and model eligibility. The reviewed documentation describes US-only coverage and EU plus Iceland inference-only coverage on request. Cursor Privacy and Data Governance

Review action: Obtain the current subprocessor list and DPA. Map the intended features to processing, storage, and inference locations. Keep Cloud Agents outside the initial pilot unless repository storage has been reviewed.

Administrative controls: check the purchased plan

Documented by Cursor: Its plan comparison lists enforced organization-wide Privacy Mode and SSO for Teams and Enterprise. It lists SCIM, audit logs, repository blocklists, model access restrictions, and central auto-run, browser, and network controls under Enterprise. Cursor Enterprise plan comparison

Review action: Match every required control to your subscription and test it with a regular member account. If a missing control is mandatory, keep approval pending or change the proposed plan. Do not substitute a screenshot of an Enterprise feature for evidence that it exists in your Teams workspace.

Source-code exposure and agent permissions

Documented by Cursor: Agents can read and edit workspace files; some changes need no approval. Terminal allowlists and auto-review are described as best-effort guardrails rather than a hard security boundary. MCP connections and tool approvals have their own controls. Cursor Agent Security

Review action: Keep secrets out of the pilot repository, test exclusions across the enabled features, review generated changes, and restrict tool and network permissions. Treat source-code confidentiality and agent execution permissions as separate approval questions.

Reviewing more than one coding agent? Use the common AI Coding Agent Security & Vendor Review Checklist for permission boundaries, evidence requests and a worked restricted-pilot decision.

Reviewing GitHub Copilot too? Read the Copilot Business & Enterprise approval checklist.

Cursor approval checklist

For each item, record evidence, an owner, and a status: confirmed, pending, or not applicable with a reason. This is the free review checklist; the paid files provide the reusable approval workflow.

Scope and owner. Record the exact plan, workspace, editor version, named users, business owner, repositories, and permitted tasks. Require a fresh review before expanding scope.
Data classification. List permitted code and data categories. Exclude credentials, production secrets, customer records, and restricted client code unless explicitly assessed and authorized. Obtain repository-owner approval.
Privacy configuration. Capture evidence that workspace Privacy Mode is enforced. Test with a normal member account and record whether personal-account sign-in can bypass the intended controls.
Models and providers. Record the approved model list and current subprocessors. Decide who may enable a model with retention; require a new decision before opting in.
Retention and contracts. Obtain the applicable DPA and clarify cache lifetime, abuse-investigation retention, deletion, and processing locations for the features and providers you will use.
Source-code exposure. Test file exclusions with synthetic marker files across chat, indexing, terminal actions, and enabled integrations. Record results and limitations without exposing real secrets.
Agent permissions. Define allowed terminal actions, network access, extensions, and MCP servers. Keep human review for sensitive actions and generated changes. Record compensating controls where the plan lacks central enforcement.
Pilot and re-review. Name the decision maker, evidence location, pilot end date, restrictions, incident contact, and next review date. Reopen approval after model, feature, contract, or data-category changes.

Questions still to confirm before sign-off

What cache and abuse-retention periods apply to the exact models and features in this workspace?
Which processing and storage regions are contractually covered, and what falls outside that coverage?
Can a member bypass the intended restrictions through a personal account, API key, terminal action, or integration?
What evidence shows exclusions and administrative controls work in the deployed editor version?
Who can enable new models or integrations, and who reviews changes to vendor terms?

What to put in the approval register

Follow the five-step AI tool approval process to turn your evidence into a decision. Record "Cursor / exact plan / workspace" alongside the use case, owner, allowed data, evidence links and dates, unresolved questions, decision maker, conditions, and next review date. Use "pending evidence" until the reviewer signs off. A purchase or completed checklist is not approval.

Get the editable AI Tool Approval Form & Register - $49

Official sources and review history

Cursor Data Use & Privacy Overview. Vendor page updated 28 August 2026. Accessed 6 September 2026.
Cursor Security. Vendor page updated 25 August 2026. Accessed 6 September 2026.
Cursor Pricing and plan features. Current plan names and advertised capabilities. Accessed 6 September 2026.
Cursor Enterprise plan comparison. Teams versus Enterprise control availability. Accessed 6 September 2026.
Cursor Privacy and Data Governance. Data flows, enforcement, retention models, and residency. Accessed 6 September 2026.
Cursor Agent Security. Agent permissions and limits of guardrails. Accessed 6 September 2026.

First editorial review: 6 September 2026. Recheck before approval and when models, features, or policies change. Vendor publication dates and our verification date are separate; this page does not imply continuous monitoring.

Independent review guidance from Operating Templates. Not affiliated with or endorsed by Cursor. The templates support internal decisions and do not certify vendor security or legal compliance.