Cursor: our review

Cursor is a code editor built on top of VS Code, with one major difference: the built-in assistant doesn't just complete the current line, it reads the whole project — files, dependencies, history — before proposing a change, or applying it itself. That ability to reason over an entire repository, rather than an isolated file, is what sets it apart from a simple autocomplete.

A view of the whole repository, not a single file

Cursor's Agent mode walks an entire repository, opens several files, writes code in each, and runs commands, with user approval at sensitive steps. A developer can ask it to rename a function used in twenty files, or add a field to a form and propagate the change down to the database: Cursor identifies the affected files itself. This capability relies on indexing the source code, sent in small chunks to Cursor's servers to compute vector embeddings — a detail that matters for what follows.

Where the code goes, and what Privacy Mode changes about it

This is the question any firm or SMB should ask before rolling the tool out widely. By default, every request passes through Cursor's servers and then those of the chosen model provider (OpenAI, Anthropic, or xAI depending on the model selected): the code leaves the company's infrastructure, whether Privacy Mode is enabled or not — even a personal API key passes through Cursor's server for the final construction of the request. What Privacy Mode changes is what happens to this data once it gets there. Cursor states it on its Data Use & Privacy Overview page: enabled, it guarantees that no customer data is used to train its own models, and that model providers neither retain nor train on it — Cursor says it maintains zero data retention agreements with each of them. Disabled, the code, prompts, and actions in the editor can be stored and used to improve AI features and train its models.

On an individual Pro account, Privacy Mode doesn't turn on by itself: it's up to the user to do it in settings. On the Teams and Enterprise plans, it's enabled by default for all members, and an administrator can lock it so no workstation can disable it — a detail that matters for a firm that doesn't want to depend on every employee's vigilance. This topic has its place in an advisory audit before deploying the tool.

The limits

Two reservations to know about. The first: even with Privacy Mode on, the code passes through model providers' security classifiers, which can retain it temporarily if it triggers an abuse alert — the guarantee covers routine training and storage, not this specific case. The second: some models aren't covered by any zero-retention agreement and stay disabled by default, which means an administrator has to turn them on knowingly — a setting easy to miss without a dedicated technical referent.

Our recommendation

For a team working with proprietary code or client data, Cursor only makes sense with Privacy Mode enabled and locked at the organization level: the Teams plan does this by default, the individual plan doesn't. See also our selection of comparable code assistants. Rule it out if no one in the organization can verify this setting workstation by workstation, or if a client contract forbids any code transit outside the company, even encrypted and not retained.