Does Cursor keep data in Australia?
No Australian storage option. No Australian data residency. Enterprise can enroll in US-only residency; EU/EEA and APAC coverage is in active development.
Anysphere (Cursor) · AI code editor · Plans covered: Hobby, Pro, Pro+, Ultra, Teams, Enterprise · Last checked
What Anysphere (Cursor) says
| Claim | Status | Vendor's words | Source | Last checked |
|---|---|---|---|---|
| Storage at rest | Not in Australia | Today, customers can enroll in US-only data residency (inference, processing, and storage in the US). Note: Same page: "US-only data residency is available today. Coverage for the EU/EEA and APAC is in active development." No Australian storage region is published. Without US-only enrollment, Cloud Agents store encrypted repository copies on Cursor infrastructure; default region is not published as Australia. | cursor.com | |
| Processing (incl. AI inference) | Not in Australia | Today, customers can enroll in US-only data residency (inference, processing, and storage in the US). Note: Published residency enrollment keeps inference in the US, not Australia. APAC residency is described as in active development. LLM requests go to model providers (OpenAI, Anthropic, Google and Cursor inference providers) under Privacy Mode / ZDR rules; that is not an AU processing commitment. | cursor.com | |
| Support access | Not published | The vendor does not publish a statement on this. Note: Enterprise privacy docs describe Privacy Mode, CMEK and residency layers but do not publish support-staff countries or an Australia-only support option. Subprocessors are listed on the trust portal (not fully scraped in this pass). | cursor.com | |
| Plan required | Not in Australia | US-only data residency is available to Enterprise customers and is enabled per team. Note: The only published residency enrollment is US-only for Enterprise (documented 10% uplift on eligible model pricing). No Australian residency plan is published. EU+UK inference-only coverage is available on request; broader EU and APAC are in development. | cursor.com | |
| Exclusions | Partly | Some functionality depends on external services or on infrastructure Cursor doesn't control, so US data residency can't be provided for it: SSO / authentication — Routes through Cursor's identity provider (WorkOS) regardless of region. Bring your own key (BYOK) — US data residency is not supported for BYOK. Note: Even under US-only residency, SSO/WorkOS, BYOK, custom model gateways, MCPs/@Web, Bugbot (repo infrastructure), shared links outside the team, and Slack/web-triggered Cloud Agents are called out as leaving the residency guarantee. There is no AU residency setting to exclude from. | cursor.com | |
| IRAP status | Not published | The vendor does not publish a statement on this. Note: Security page lists AIUC-1, ISO/IEC 27001:2022, ISO/IEC 42001:2023 and SOC 2 Type II. IRAP is not mentioned on the pages opened. | cursor.com |
Why it matters
General information, not a compliance ruling.
- APP 8
- APP 8: sending personal information overseas, including remote access, can be a cross-border disclosure → see storage, processing, support access. Relies on: Storage at rest, Processing (incl. AI inference), Support access
- ISM-1572
- ISM-1572: contract must record processing and storage regions → see storage + processing. Relies on: Storage at rest, Processing (incl. AI inference)
- APRA CPS 230
- CPS 230: offshoring with a material service provider must be assessed and notified to APRA → see storage, processing, support access, exclusions. Relies on: Storage at rest, Processing (incl. AI inference), Support access, Exclusions
- OVIC IPP 9
- IPP 9 (Victoria): personal information may leave Victoria only in set circumstances → see storage, processing, support access. Relies on: Storage at rest, Processing (incl. AI inference), Support access
Changelog
No changes recorded yet.