Teams & Enterprise
Security and Privacy Hardening
This page consolidates the security and privacy guidance spread across the Cursor docs into one reference, so teams configuring Cursor can review and apply the right controls without hunting through every page. Each item links to its source doc for the full detail.
Shared responsibility
Cursor and your team share responsibility for a secure deployment. Cursor builds, secures, and operates the platform; you decide how to configure and adopt it for your environment. This page focuses on the controls you own. For Cursor's own posture, see the Trust Center, Security page, and Data Use policies.
- Cursor handles platform security, encryption, infrastructure, certifications, and the contractual commitments documented in the Trust Center.
- You configure identity, privacy enforcement, agent controls, extensibility trust, and monitoring, covered in the sections below.
- Layer controls for defense in depth: pair best-effort guardrails (Auto-review, allowlists,
.cursorignore) with deterministic ones (approvals, hooks, sandboxing) rather than relying on a single layer. - Most enforcement levers here (org-wide policies, MDM, SIEM streaming) are Enterprise features set in the team dashboard or through MDM. Per-user controls such as
.cursorignoreand Run Mode defaults apply more broadly.
Admin quickstart
Do these first. Each links to its detail page. Other items for regulated orgs, like Cloud Agent retention windows, appear in the tables below.
- Enforce Privacy Mode org-wide so members can't disable Privacy Mode or its zero data retention commitments for Cursor-routed models.
- Set the org Run Mode policy to Auto-review (not Run Everything) and enable sandboxing.
- Distribute hooks for enforcement and logging across the team.
- Apply network allowlisting and exclude Cursor domains from SSL inspection. For Grok Bot, apply those exclusions on every proxy profile. Set Cloud Agent network egress if you use Cloud Agents.
- Set a Rules baseline for steering, knowing rules are non-deterministic.
- Govern plugins and MCP servers by reviewing what they install and approving trusted sources.
- Add
.cursorignoreentries for secrets and regulated paths. - Lock identity with SSO, SCIM, and Allowed Team IDs (MDM); restrict extensions, set an install cooldown (and optional signature verification), and keep clients on a supported version.
- Decide which models your organization allows and restrict the rest; restrict personal API keys (BYOK) if you rely on Cursor's ZDR agreements.
- Periodically review and stream audit logs to your SIEM.
- For encryption with your own keys, enable CMEK when your compliance program requires it (Cloud Agent data).
- If you use Grok Bot, apply its recommended configuration: an allowlist network policy with Apply to MCP servers, Enforce Auto-review with team rules, Execution on Local Computer set to Never allow, and Action Recording. Details are in the Grok Bot section.
Identity and access
Control who signs in and on which device.
| Control | Recommendation | Learn more |
|---|---|---|
| SSO and SCIM | Centralize authentication and automate user deprovisioning. | SSO, SCIM |
| Allowed Team IDs | Block personal accounts on corporate devices via MDM so Privacy Mode always applies. | Identity |
| Tenancy restriction | Send x-cursor-allowed-tenants from a TLS-terminating proxy so this network only accepts listed organizations and teams. | Tenancy restriction |
| Allowed Extensions | Allowlist trusted publishers; any entry blocks the rest unless you add "*": true. | Extensions |
| Extension install cooldown | Defer extension installs and updates until a marketplace version has been public for a set number of hours (enforced fleet-wide), with optional signature verification, to blunt short-lived malicious uploads. | Cooldown, Signatures |
| Supported version | Keep clients current and manage updates with the UpdateMode MDM policy. | Versions |
| Workspace Trust | Enforce through MDM so untrusted folders open in restricted mode. Restricted mode limits AI features; use it for truly untrusted trees, not day-to-day repos. | Workspace Trust |
Privacy and data
Control how your code and data are handled.
| Control | Recommendation | Learn more |
|---|---|---|
| Privacy Mode | Enforce org-wide so members can't disable Privacy Mode or its ZDR commitments for Cursor-routed models; on by default for Enterprise. See exceptions under BYOK and models with provider retention. | Privacy |
| Personal API keys (BYOK) | Restrict them; with your own keys, zero data retention is subject to your own agreement with the model provider, not Cursor's. | BYOK |
| CMEK | Encrypt Cloud Agent data with your own key when your compliance program requires customer-managed keys. | CMEK |
| Model access | Approve specific models for use by your organization. Non-ZDR models require admin approval. | Models |
| Repository blocklist | Keep sensitive repos out of Cursor entirely. | Blocklist |
| Protected Git Scopes | Add an organization-level lock on top of the per-user Git check so only your teams use those repos with Cloud Agents, automations, and Bugbot. | Scopes |
Also see HIPAA BAA and Cyber Safeguards when those apply to your deployment.
Data retention and deletion
You and your users have several ways to manage your data.
| Mechanism | What it covers | How |
|---|---|---|
| Individual account deletion | That user's account and associated data; removed within 30 days. Does not by itself complete enterprise tenant offboarding. | Dashboard → Advanced Account Settings → Delete Account (guide) |
| Data subject requests | Personal Data access, correction, or deletion requests (DSAR). | Email hi@cursor.com to exercise privacy rights (Privacy Policy) |
| Shared chats and canvases | Published share links. | Delete from the dashboard (shared chats, shared canvases) |
| Cloud Agent deletion | An agent's conversation transcript and artifacts, on demand. | Delete Agent API |
| Automatic expiry | Cloud Agent snapshots (30 days inactivity). | Automatic, no action needed (snapshots) |
| Enterprise retention windows | Cap Cloud Agent data retention (Indefinite or 90 days; custom windows in early access). | Cloud Agent retention; contact sales |
| Contract termination (Enterprise) | Return or deletion of personal data for the enterprise engagement. | Governed by the DPA; coordinate with your account team |
Agent runtime and deterministic controls
The hard boundaries on what agents can do. Steering belongs with these, never instead of them.
| Control | Recommendation | Learn more |
|---|---|---|
| Auto-review (Run Mode) | Prefer it over Run Everything; it runs allowlisted calls, sandboxes shell commands when it can, and routes the rest through a best-effort classifier, so combine it with hooks. | Run Modes, Sandboxing |
| Network allowlisting | Allowlist Cursor domains and set per-server MCP network policy; exclude those domains from SSL inspection so users don't disable security to "make it work." | Network, SSL inspection, MCP network, Proxies |
| Cloud Agent network egress | Restrict Cloud Agents' outbound access with Default + allowlist or Allowlist-only modes; Enterprise admins can lock the policy org-wide. | Cloud Agent network |
| Cloud Agent OIDC tokens | Federate Cursor-managed Cloud Agent VMs into AWS, GCP, Azure, or custom OIDC verifiers with short-lived JWTs instead of long-lived cloud keys. | OIDC tokens |
| Private connectivity | Reach private source control through PrivateLink or Cloudflare Tunnel, and align Cursor traffic with your endpoint security (AV/EDR/DLP). | Connectivity, Endpoint |
| Hooks | Enforce and observe at agent lifecycle points (block commands, scrub secrets, audit); distribute by MDM or cloud and set failClosed for critical hooks. | Hooks |
| Integrate your own tools | Call your SIEM, DLP, allowlist, or policy APIs from hooks instead of relying only on defaults. | Examples, Partners |
.cursorignore | Block agent read and context for secrets and regulated trees; terminal and MCP tools can't honor it, so pair with approvals and file permissions. | Ignore files |
| Other protections | Keep Browser, File-Deletion, External-File, and .cursor directory protection enabled so risky actions still require approval. | Protections, .cursor |
Steering and extensibility
Guidance and add-ons shape behavior and expand capability. Both are non-deterministic and are trust decisions.
| Control | Recommendation | Learn more |
|---|---|---|
| Rules | Steer behavior org-wide with Team Rules, but treat them as suggestions and pair them with the deterministic controls above. | Rules |
| Plugins | A plugin can bundle MCP servers, skills, subagents, rules, and hooks, so review what it installs and favor private team marketplaces. Use Allow Members to Publish on the Default marketplace if you want to limit who can share personal skills. | Plugins, Marketplace security |
| Skills | Members can publish personal skills to the team marketplace or sync ~/.cursor/skills/ for their own Cloud Agents. Publishing stores a team-hosted copy. Sync stays private to the author. Both have admin opt-outs. | Publish a skill, Skill sync |
| MCP | Approve servers with the allowlist, restrict per-server tools, and apply network modes; review each server before enabling. | MCP allowlist, Security |
Monitor and respond
Review output, verify controls, and keep an audit trail.
| Practice | Recommendation | Learn more |
|---|---|---|
| Pre-production review | Have Bugbot and Security Agents review Cursor-generated code before it ships to production. | Bugbot, Security Agents |
| Audit logs | Periodically review them and stream to SIEM, webhooks, or S3 for authentication and admin events. | Compliance |
| OpenTelemetry Export | Stream usage and activity telemetry to your own collector over OTLP. This is separate from audit-log SIEM streaming. | OpenTelemetry Export, Compliance |
| Compliance logging | Use hooks to capture development-activity metadata beyond Cursor's audit logs. | Hooks logging |
| Responsible disclosure | Report vulnerabilities to security-reports@cursor.com. | Disclosure |
Grok Bot
Grok Bot controls live on the Grok Bot page of the dashboard, separate from the editor and Cloud Agent settings above. The organization-wide enable switch, Network Controls, Enforce Auto-review, Auto-review rules, Inference Hooks, Team Setup Scripts, Team Secrets, Allow Sudo on Bot Computers, Allow Local Egress Routing, Action Recording, and computer management are Enterprise only; the rest apply on Teams and Enterprise. Start from the recommended configuration.
Access and network
Who can use Grok Bot, how members sign in, and where computers and member devices can connect.
| Control | Recommendation | Learn more |
|---|---|---|
| Enable and group access | On Enterprise, turn Grok Bot on and scope it with Manage Group Access before members start. | Enabling Grok Bot |
| Identity and sign-in | Grok Bot uses your Cursor SSO and SCIM. Assign the Cursor app to the people who need access and add a sign-in rule for the computer's browser. | Identity and access, Identity and sign-ins |
| Gateway and TLS inspection | Allow *.cursor.sh, *.cursorvm.com, and *.*.cursorvm.com, exempt them from TLS inspection, and apply the rules to every profile, including off-network. | Proxies, Every profile |
| Network Controls | Pick an allowlist mode; teams without a policy default to allow-all. Turn on Apply to MCP servers so connected apps follow the same list, and lock the team policy. | Network policy, MCP servers, Network Controls |
| Connector policy | Audit the Team Marketplace before you enable Grok Bot; any permitted connector is available to every Bot a member runs. | Connector policy, MCP allowlist |
| Egress and private networks | Hosted computers use shared static egress ranges. To reach private services, route through a member's desktop or install your networking client with Team Setup Scripts. | Static egress IPs, Private networks |
Approvals and capabilities
What Bots may do on behalf of members, and the review layers that stop actions and model requests.
| Control | Recommendation | Learn more |
|---|---|---|
| Enforce Auto-review | Turn it on before you rely on team Auto-review rules. Auto Review doesn't cover every side effect, so keep approvals and the network policy beside it. | Enforce Auto-review, Approvals and Auto Review |
| Auto-review rules | Add Ask first rules for production deployments, external email, payments, and legal terms. Keep Allow automatically rules narrow. | Auto-review rules |
| Team Rules | Keep them short and few. Rules guide a Bot; use Auto-review rules for approval behavior. | Team Rules |
| Execution on Local Computer | Set Never allow unless Bots have a specific reason to work on member machines. | Local execution, Security |
| Cloud Agents | Turn off Cloud Agent delegation if your team doesn't need it. | Cloud Agents |
| Template sharing | Controls where members can publish Bot templates. Keep sharing team-only if you don't want templates shared outside your team. | Template sharing, Share a Bot |
| Sudo and local egress routing | Both are on by default. Decide whether Bots may run as root and whether members may route Bot traffic through their own desktops. | Sudo, Local egress |
| Inference hooks | Have your own AI security server screen each model request, including against your data loss prevention policy. Start in Shadow mode, then move to Allow the Request or Block the Request. | Inference hooks, Security |
| Endpoint tooling | Admins can install the security or networking tools they consider appropriate on every team computer with Team Setup Scripts. | Endpoint tooling, Private networks |
| Team Setup Scripts and Team Secrets | Scripts run as the computer user with sudo, on start and roughly daily; verify them on a pilot computer first. Keep secret values out of the manifest and store them as Team Secrets. | Setup Scripts, Team Secrets |
| Group settings | Tighten controls on the Grok Bot page and widen them per group; except for network policy, group settings only widen. | Group settings |
Logging, data, and lifecycle
What gets recorded, where it goes, and how you clean up computers.
| Control | Recommendation | Learn more |
|---|---|---|
| Action Recording | Turn it on; it is off by default. Configure OpenTelemetry Export to receive the events, since they don't appear on the Audit Log page. | Action Recording, OpenTelemetry Export |
| Audit logs | Filter the Audit Log by application to review Grok Bot control-plane events, and stream them to your SIEM. | Audit logs, Logging and audit |
| Privacy Mode | Enforce Privacy Mode; your team's setting governs Grok Bot. | Models and data, Privacy Mode |
| Computer lifecycle | Turn on Terminate Inactive Computers so unused computers shut down after 30 days. Terminating or deleting a computer doesn't remove access; remove the member or revoke their IdP sessions for that. | Computers, Inactive computers |
| Data retention and deletion | Use the in-product deletion features: members reset their own computer and clean up files, sessions, and routines, and Enterprise admins use Manage Member Computers and Data to delete members' computers or all of their Grok Bot data. | Retention and deletion, Delete all Grok Bot data |
| Desktop deployment | Deploy the installer version you tested through MDM, and move devices to the current release on a regular cadence. | Deployment, Rollout checklist |
Member guidance
Admin controls set the ceiling. Share these habits with members at rollout.
| Practice | Recommendation | Learn more |
|---|---|---|
| State boundaries in the request | Say what a Bot may change and where it must stop. Clear instructions guide the Bot; approvals and the network policy enforce the limits. | Approvals |
| Credential handling in Bot | Store logins and cards in Vault or connect 1Password, and add API keys and other secrets through the secure secret card, so Bots use them without seeing the values. Keep credentials out of chat, Shell, and ordinary files. | Vault, 1Password, Add a secret |
| Prefer Allow once over Always allow | Approve each action that touches accounts, money, or shared resources. | Approvals |
| Check the audience before a Bot shares data | Before a Bot posts, sends, or publishes to a connected app, email, or an external site, confirm that only the intended audience can read that destination. Keep sending and publishing behind approval, including in routines. | Approvals, Routines |
| Size browser sign-ins to the task | Every Bot a member runs shares one computer, so sign out of accounts a Bot no longer needs. | How users are isolated |
| Start new roles read-only | Begin with read-only tasks and draft outputs; keep sending, publishing, purchasing, and production changes behind approval. | Recommended configuration |
| Review connected apps and routines | Check them regularly, re-test a routine after a website, app, or source format changes, and when work completes pause or delete its routines, remove connected apps, and remove sensitive files from /workspace. | Identity and sign-ins, Routines |
Security reviewers can start with Grok Bot security and the security FAQ. Settings can also be managed through the Admin API.
Further reading
Background and product context. The docs linked throughout this page are the authority for each control.
- Cloud Agent security overview
- Governing agent autonomy with Auto-review
- Implementing a secure sandbox for local agents
- Hooks for security and platform teams
Platform commitments
The controls on this page describe how to configure your own environment. They complement Cursor's platform security and contractual commitments:
- Trust Center for certifications, security architecture, and subprocessors
- Master Services Agreement and Data Processing Agreement for contractual and data-protection terms
- Grok Bot Terms, which supplement your agreement when you enable or access Grok Bot; Enterprise admins accept them when they enable Grok Bot from the dashboard
Subscribe in the Trust Center to get notified when subprocessors or Cursor's security posture change. Cursor sends a confirmation email to the address you enter, and you must verify it before updates start arriving.
Harden Cursor for your organization
Contact our team to enable org-wide enforcement, CMEK, and SIEM streaming.