Cursor Enterprise Data Retention and Security Controls to Check First

There is no single default retention period that applies to every Cursor model, feature, workspace, Cloud Agent run, or contract. Treat the answer as Unknown until the admin verifies the exact model and feature path. Current Cursor documentation points buyers toward a connected bundle of controls: organization administration, role permissions, repository allowlists or blocklists, model and MCP server controls, SSO and SCIM, audit logs, subprocessors, Privacy Mode, and contract-specific data terms.

For enterprise readers, the practical decision is what an admin should verify before rollout: whether Privacy Mode is enforced, which repositories and models are allowed, which MCP servers an agent may call, whether Cloud Agents are enabled, how agent permissions differ by group, and what evidence the vendor can provide for retention, subprocessors, and audit needs.

Security question|What to verify
Privacy Mode|Whether customer data is excluded from training and which abuse-detection or retention exceptions still apply
Model access|Which models are allowed, blocked, or require admin opt-in
Repository access|Whether admins can whitelist or blocklist repos before agents run
MCP access|Which MCP servers are approved, logged, and revocable
Identity|Whether SSO, SCIM, and deprovisioning are enforced
Cloud Agents|Whether encrypted repository copies are allowed, how long snapshots remain, and whether network egress is restricted
Audit|Whether Enterprise audit logs cover the events the security team needs and can be exported
Evidence|SOC 2 report, penetration-test summary, subprocessors, and customer agreement terms

Newer workflow surface|What Cursor documents|Enterprise review
Remote control for local agents (Oct 6, 2026)|Agents remain on the local computer; the iOS app connects to them. Enterprise organizations have it off by default.|Confirm whether admins enable it, which identities may pair, and which local repositories remain in scope.
Rollouts (Sep 23, 2026)|Monitors pull-request changes after deployment and reports per-environment health from connected delivery and telemetry systems.|Verify connected source control, deploy events, telemetry, and the escalation path; the vendor says it does not merge or roll back on its own today.
Security Review (Sep 23, 2026)|Reviews pull requests for exploitable security issues and posts findings with severity, attack path, and a proposed fix.|Treat it as an additional review signal, not a substitute for required security tests, human ownership, or the team's release gate.

Which Cursor Enterprise retention exceptions should admins verify?
Privacy Mode prevents customer data from being used for training and Cursor documents zero-data-retention arrangements for covered providers, but exceptions remain. Some models require provider retention and admin approval, and Cloud Agents store encrypted repository copies while an agent runs. Enterprise buyers should verify the exact model, feature, workspace, and contract terms.

What Cursor Enterprise security controls should admins check first?
Start with SSO and SCIM, role permissions, Privacy Mode enforcement, repository and model controls, MCP allowlists, Run Mode and sandbox settings, Cloud Agent network and retention controls, audit logs, and subprocessors.

Evidence boundary: KyenAI rechecked Cursor's Enterprise organization controls, Security page, Data Use & Privacy Overview, and changelog on October 14, 2026. The Security page was updated August 25 and Data Use & Privacy Overview September 3. Privacy Mode excludes customer data from training under Cursor's stated policy, but abuse-detection exceptions, BYOK behavior, non-ZDR model opt-ins, and Cloud Agent storage remain. Remote control, Rollouts, and Security Review are separate workflow features and do not establish a universal retention period. Verify the exact model, feature, workspace, region, and contract before procurement.

Field|Current evidence
Primary source|Cursor: Organizations for Cursor Enterprise
Source date|2026-06-03
Update scope|enterprise security controls, Privacy Mode, retention caveats, repository controls, MCP controls, and agent permissions
Verification note|Official source only; no search-result scraping, no ranking guarantee, no uncited claims

The useful change is not only administrative scope. Cursor's public enterprise, security, and data-use pages show that enterprise security depends on several connected controls: identity, role permissions, repository allowlists or blocklists, model access, MCP server controls, subprocessors, Privacy Mode, and retention exceptions. That makes the page a security decision guide rather than a short changelog rewrite.

Enterprise admins should map teams, identity groups, cost centers, repositories, model policies, MCP servers, and agent permissions before turning on broader access. The strongest early use is separating experimental groups from production-facing teams while still verifying Privacy Mode, retention terms, and audit evidence.

This update is most relevant for buyers searching whether Cursor Enterprise is secure enough for company code. The decision is not yes or no from a headline; it is whether the buyer can verify admin controls, retention behavior, subprocessors, and permission boundaries for their own workspace.

Limits and open questions: public pages do not establish every account-specific security default, retention exception, export field, or customer-agreement term. Those should be verified through admin docs, trust-portal evidence, and a controlled enterprise trial before stronger claims are made. Source handling note: KyenAI records the publisher, publication date, and source URL on the page, then keeps the update date tied to evidence-backed edits rather than automatic refreshes. When source material is thin, the system keeps interpretation narrow and waits for stronger documentation. Editorial review compares the new claim against the article summary, fact table, internal links, and listed source before allowing another optimization pass. Search outcomes are measured after publication rather than assumed at writing time.

Verify Cursor Enterprise Privacy Mode, ZDR exceptions, model and Cloud Agent retention, SSO/SCIM, MCP controls, audit evidence, and contract terms before rollout.

Cursor Data Retention & Enterprise Security: Privacy Mode, ZDR

Organizations for Cursor Enterprise

Security

Data Use & Privacy Overview

What's New in Cursor — Latest Updates & Release Notes

Cursor Enterprise retention is not one universal number. Verify Privacy Mode, model-provider exceptions, Cloud Agent storage, SSO/SCIM, repository and model controls, MCP governance, audit logs, and contract terms before rollout.

Cursor Enterprise Data Retention & Security: What Admins Must Verify

GitHub now lets Copilot run inside isolated local or cloud sandboxes. Local sandboxing restricts filesystem, network, and system access for command execution, while cloud sandboxes provide ephemeral Linux environments hosted by GitHub.

For enterprise AI coding adoption, the product shift is clear: agents need execution layers with identity, policy, and isolation. This article belongs in security and governance monitoring, not just productivity coverage.

Field|Current evidence
Primary source|GitHub: Cloud and local sandboxes for GitHub Copilot now in public preview
Source date|2026-06-02
Update scope|cloud and local execution isolation for Copilot agent tasks
Verification note|Official source only; no search-result scraping, no ranking guarantee, no uncited claims

The information gain is the split between local and cloud isolation. Local sandboxes restrict file, network, and system access around command execution, while cloud sandboxes provide an ephemeral Linux environment. That distinction helps security teams decide where untrusted or high-risk agent work should run.

A practical rollout should classify tasks by risk: dependency updates and exploratory commands can use stronger isolation, while normal edits may stay local with narrower permissions. The point is not to trust the agent more; it is to reduce blast radius when the agent makes a bad call.

Teams should treat sandboxes as a control layer for agent execution, not as a replacement for code review, secret scanning, or CI. The best early use case is letting an agent investigate or test without broad access to the workstation.

Limits and open questions: public preview status means behavior, pricing, platform support, and policy defaults can change. The article should not imply complete protection until GitHub documents the exact boundaries and failure modes. Source handling note: KyenAI records the publisher, publication date, and source URL on the page, then keeps the update date tied to evidence-backed edits rather than automatic refreshes. When source material is thin, the system keeps interpretation narrow and waits for stronger documentation. Editorial review compares the new claim against the article summary, fact table, internal links, and listed source before allowing another optimization pass. Search outcomes are measured after publication rather than assumed at writing time.

GitHub's public preview for cloud and local sandboxes gives Copilot isolated execution environments for agentic development.

Cloud and local sandboxes for GitHub Copilot now in public preview

GitHub Copilot Sandboxes Put Agent Execution Behind Policy Boundaries

Name the owner, publisher, version, distribution source, methods, resources, prompts, data classes, credential source, network destinations, dependencies, and deployment environment.

Record the server profile

Test protected resource metadata, token audience, minimal scopes, rejected tokens, incremental elevation, and the absence of token passthrough for HTTP-based MCP authentication.

Verify authentication and scopes

Decide repository read, write, delete, outbound network, secret access, and production access separately. Document each default, data risk, approval, logging expectation, and launch gate.

Complete the permission matrix

Enumerate exposed protocol features, exercise expected allow and deny cases, inspect errors and protocol exchanges, and retain evidence for the reviewed server version.

Validate with MCP Inspector

Disable the server, revoke tokens and secrets, remove client access, identify retained records, and confirm who evaluates affected systems before production approval.

Prove revocation and incident response

MCP security launch decisions

MCP security best practices

MCP authorization specification

MCP authorization security considerations

MCP Inspector

Secure MCP servers with OAuth, token audience checks, least privilege, secret and network boundaries, logging, and revocation. Download the checklist.

MCP Server Security Checklist: 25 Controls — Least Privilege & Revocation

Calling every control an MCP requirement

Granting one broad MCP permission bundle

Testing only the happy path

Logging secrets in the name of auditability

MCP server security starts with a source-backed checklist for OAuth, token audience validation, least privilege, secrets, network boundaries, logging, and revocation.

MCP Server Security Checklist: 25 Controls for AI Agents — OAuth, Least Privilege

Choose one team, one repository type, allowed tasks, forbidden tasks, and a review owner.

Write the pilot boundary

Separate read-only, limited write, command execution, network access, and deployment paths.

Create permission tiers

Record actor, repo, session, tools called, files changed, commands run, approval state, and final outcome.

Define audit fields

Keep what developers actually used, remove confusing rules, and close gaps found in logs or reviews.

Review after two weeks

Keep a copyable checklist in the engineering handbook or repo instructions so developers can apply the same approval, logging, and rollback rules during real work.

Publish the Markdown policy

Coding agent governance checklist

GitHub Copilot coding agent

Cursor Enterprise organizations

OWASP Top 10 for LLM Applications

Use this AI coding agent governance checklist for permissions, logs, approval gates, prohibited actions, rollback, and emergency stop.

AI Coding Agent Governance Checklist

Starting with a company-wide rollout

Treating all tools as equal

Logging either too much or too little

A useful coding agent governance checklist covers identity, permissions, tool access, logs, human approval, sandboxing, cost limits, and incident response. Start with a small pilot before wider rollout.

AI Coding Agent Governance Checklist: Permissions, Logs and Approvals

List AGENTS.md, CLAUDE.md, .github/copilot-instructions.md, .github/instructions/*.instructions.md, .cursorrules, and .cursor/rules/*.mdc, then record the exact agent surfaces expected to read each file.

Inventory files and surfaces

Choose the maintained source for setup, architecture, security, edit boundaries, tests, and review rules. Mark generated or manually synchronized adapters so maintainers know which wording is authoritative.

Define the canonical shared policy

Place Codex guidance in AGENTS.md, Claude Code guidance in CLAUDE.md, broad Copilot guidance in .github/copilot-instructions.md, and current Cursor guidance in focused .cursor/rules/*.mdc files.

Create documented adapters

Translate the deprecated .cursorrules file into scoped .mdc rules, preserve it during comparison, and remove it only after observed behavior and repository checks support the change.

Migrate Cursor rules safely

Use the same clean repository state, task, prompt, permissions, and verification criteria for every tool. Record versions and mark unavailable success, elapsed time, cost, or human-intervention data as Not measured.

Run a controlled comparison

Current instruction-file decision table

Use AGENTS.md with Codex

AGENTS.md open format and supported-agent ecosystem

Claude Code memory documentation

GitHub Copilot custom instructions support matrix

Adding custom instructions for GitHub Copilot

Cursor rules documentation

Cursor CLI instruction-file support

Configuration Smells in AGENTS.md Files

Compare AGENTS.md, copilot-instructions.md, CLAUDE.md, and Cursor rules by supported tool surface, scope, precedence, and safe sync policy.

AGENTS.md vs Copilot Instructions vs CLAUDE.md vs Cursor Rules (2026)

Saying Copilot reads or ignores CLAUDE.md everywhere

Deleting .cursorrules without a migration check

Copying a shared policy until adapters drift

Publishing zeros or estimates as benchmark data

Choose between AGENTS.md, copilot-instructions.md, CLAUDE.md, and Cursor rules by tool surface, scope, precedence, and the workflow you need to support.

Security & Governance

Evidence updates

Cursor Enterprise Data Retention & Security: What Admins Must Verify

GitHub Copilot Sandboxes Put Agent Execution Behind Policy Boundaries

Security & Governance

Core guides

MCP Server Security Checklist: 25 Controls for AI Agents — OAuth, Least Privilege

AI Coding Agent Governance Checklist: Permissions, Logs and Approvals

AGENTS.md vs copilot-instructions.md: Which File Should You Use?

Evidence updates

Cursor Enterprise Data Retention & Security: What Admins Must Verify

GitHub Copilot Sandboxes Put Agent Execution Behind Policy Boundaries