Does Bloomreach Work in China? Data Residency, PIPL & an Offshore Commerce Stack

Bloomreach is an enterprise digital experience platform — commerce search, merchandising, recommendations, personalization and a headless CMS — and for a mainland-China audience the deciding question about it is not how quickly its search box responds. It is where the content and the shopper behavior Bloomreach captures are stored, across which border each search and personalization call travels, and who files for the public storefront you build on top of it. Those are compliance questions, and they are the half of “does Bloomreach work in China” that no amount of merchandising or caching work answers.

Bloomreach settles the first one in its own documentation: it hosts on Google Cloud and Amazon Web Services in Ireland, the United States and Luxembourg, with no region inside mainland China. That makes a China-facing Bloomreach deployment reachable but entirely offshore — which leaves your China shoppers’ personal data sitting abroad under China’s data law, routes every discovery call across the border, and still leaves the public site needing an ICP filing of its own. Below is what Bloomreach documents and the China rule each fact triggers — in Bloomreach’s own words and China’s own law, so you can take it to counsel rather than to a benchmark.

Bloomreach in China at a glance

No mainland region — your content and the shopper data it captures sit offshore

Bloomreach’s own List of Subprocessors is the place to start, because it answers the question a speed test never does: where your data actually lives. It names Google Cloud EMEA in Dublin, Ireland as the “Hosting” provider “Applicable to all Engagement and Clarity customers outside of the United States,” and Google LLC in “Mountain View, CA 94043 United States” for customers “in the United States.” For its Discovery and Content stack it adds Amazon Web Services in Luxembourg and Seattle. Not one of those locations is in mainland China.

Because Bloomreach is a hosted platform rather than software you install on a server of your choosing, you do not get to put that region on Chinese soil. Your content and catalog, the search queries your shoppers run, the clicks and purchases its relevance models learn from, and the personalization profiles it builds all live in whichever offshore region your account was provisioned in. That settles the residency question before performance is ever in frame: for a China audience, the data Bloomreach holds is, by its own documentation, kept abroad.

Your China shoppers’ data is a cross-border transfer under PIPL

What Bloomreach stores is not just your product catalog. To rank results, drive recommendations and personalize experiences, it records what visitors type into search, what they click and buy, and the identifiers and consent that tie those actions to a person. Those signals are personal information, and collected from shoppers in China and written to an Ireland, US or Luxembourg region, they leave the country.

Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, Bloomreach’s customer, not Bloomreach — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China has to be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty none of Bloomreach’s offshore regions can meet. Whether a mechanism, in-country storage, or both apply to you depends on how much personal data you handle and who your shoppers are, so treat this as a risk picture to settle with counsel rather than a verdict.

Reachable, but every discovery call is answered across the border

Bloomreach is a set of hosted APIs, not a page you can simply cache and forget. Each search, recommendation and personalization request your China shoppers trigger is answered by the region your account runs in, fronted by a US-based content delivery network. With no deployment inside mainland China, that request and its response cross the border every time.

So the delivery exposure on a China-facing Bloomreach deployment is not a licensing gap in the search box itself — it is that the endpoints your on-site search and merchandising depend on sit offshore, exposed to the same congestion and interruption that affects any cross-border call from China, where a disruption to that path takes the dynamic experience down with it. Caching static assets at the edge helps the shell of the page; it does not move the API that answers the query, and that is the part shoppers feel.

Who gets ICP-filed — your storefront, not the backend

Because Bloomreach is reached over an API, the licensing question does not attach to it the way it attaches to a host. It attaches to the public-facing storefront or site you run on top of it. A website delivered to mainland visitors from inside China turns on an ICP filing (备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must bind to a hosting resource physically inside the mainland and to a mainland legal entity. Bloomreach publishes no mainland region, so it offers nothing to file against — the filing is yours to arrange for the site you build on it.

So “we already run on Bloomreach” does not carry a storefront into China: calling an offshore commerce API from Shanghai is not the same as being licensed to operate a public site there. This is a risk map rather than a verdict — whether an ICP filing, in-country storage for the personal data you capture, or both apply to you is worth settling with counsel before you build.

Where 21YunBox fits — a compliant overlay, not a migration

You keep building on Bloomreach, and your content, catalog, region settings and relevance models stay exactly where they are. We supply the one piece a hosted platform with no mainland footprint leaves to you: compliant, ICP-filed delivery from inside the mainland, placed in front of your existing Bloomreach endpoints — no rebuild, no second commerce platform, and no move off Bloomreach. Our China team weighs your PIPL cross-border and data-residency obligations against your entity and the personal data your discovery and engagement features capture, then stands up the in-country delivery — and, where the law requires your China shoppers’ data to stay on the mainland, the in-country storage a lawful China presence needs.

Get a compliance assessment →

Related reading:

• Cross-border data transfers under PIPL
• What is the China ICP license, and how do you get one?