Give the client a dated assurance sheet that separates Cursor's documented statements from your team's verified practices and unresolved questions. Do not promise that code stays on the machine or that a training restriction means no storage occurs.
Separate three different assurances
Cursor's documentation states that AI features send prompts and code context to model providers. With Privacy Mode enabled, Cursor says code is not used for training by Cursor or other AI model providers.
Cloud Agents raise a separate question: they require repository access, store encrypted repository copies temporarily while running and delete those copies after completion.
These statements concern data flows, training and temporary repository storage respectively. Combining them into “no data is shared or retained” would go beyond the supplied evidence.
Build the client assurance sheet
Use three labelled sections rather than one compliance tick:
- Provider documentation: Quote or accurately summarise each bounded statement, with its source and review date.
- Team evidence: Identify the intended workflow, responsible reviewer and dated evidence for any configuration claim the team makes.
- Unverified questions: List controls or assurances not established by the supplied material, with an owner for follow-up.
For each proposed task, record whether it involves interactive assistance or Cloud Agent delegation, what categories of material are intended and who authorised that use. Do not attach customer code, private prompts, credentials or confidential repository screenshots.
Ask whether the client accepts the proposed provider data flow, whether the use is authorised and which retention questions require further review. These are assurance questions, not legal advice or a certification.
Evaluate a hypothetical client request
Suppose a hypothetical Hyderabad consultancy is asked to assure a prospective client that “nothing leaves the laptop”. Its demonstration repository contains 20 fabricated functions and no customer material.
The correct evaluation is to reject that wording: the documented AI data flow includes prompts and code context going to model providers. A narrower statement can describe the training restriction conditional on Privacy Mode, while separately disclosing Cloud Agent repository handling if that workflow is proposed.
Score each assurance as documented, team-evidenced or unresolved. A provider statement alone cannot prove that the team's intended configuration or task scope matches it.
Decide what can honestly be signed off
Stop if the client requires an assurance contradicted by the documented flow or unsupported by available evidence. Next, clarify the requirement and seek appropriate review before introducing any client material.
If evaluating access offers, check the AI tools catalog for access format and save terms before buying. Marketplace account, code or token offers are not proof of official subscription equivalence, privacy configuration or contractual assurance.
Sources and scope
Source material checked 29 October 2026; features/policies may change. Cursor privacy and data governance supports the data-flow, conditional training and Cloud Agent storage statements. The assurance sheet and hypothetical evaluation are editorial advice.