Does Agility CMS Work in China? Data Residency, PIPL & an Offshore Content API
Agility CMS is an API-first headless CMS hosted on Microsoft Azure, provisioning each instance into one of five offshore regions — USA North Central, USA East, Canada, Europe or Australia — with none in mainland China, so your content and any personal data in it sit offshore under PIPL, and the ICP filing attaches to the public site you run on top. A compliance-first look at the two doors.
Does Agility CMS work in China?
Whether you can use Agility CMS in mainland China is first a data-residency question, not a speed one. Agility CMS is an API-first headless CMS: it stores the content your site is built on — and any personal data your content models and editor accounts hold — and serves it through a content API. Where it keeps that content is what China's law responds to.
Agility's own hosting documentation states that “Agility CMS is a SaaS platform hosted on Microsoft Azure” and that “Instances are provisioned into one of five regions” — USA North Central, USA East, Canada, Europe and Australia, with none in mainland China. So every piece of your content, and any personal data in it about China users, lives in a single offshore Azure region: a cross-border transfer of personal information PIPL governs. And because Agility is a backend behind a frontend you build and host, the ICP filing question lands on the public mainland site you run, not on Agility. The table below pairs Agility's own wording with the rule each line triggers.
This is a risk picture, not a verdict — what applies turns on what your models hold, how much of it is personal, and who your users are. Our China team can map your Agility exposure with you →
What Agility's own documentation says about China
| Fact | Primary source |
|---|---|
| Agility CMS is hosted on Microsoft Azure, and every instance lands in one of five offshore regions. Its own hosting documentation states that “Agility CMS is a SaaS platform hosted on Microsoft Azure, using Azure's globally compliant infrastructure as its backbone,” and that “Instances are provisioned into one of five regions.” Agility documents no mainland-China region, so the content your site is built on — and any personal data in it — is stored offshore wherever your instance runs. | Agility CMS — Hosting, Security & Compliance (agilitycms.com), retrieved 2026-10-08 |
| All five regions are offshore, and so is the API that serves your content. Agility's public status page lists its five regions as USA North Central, USA East, Canada, Europe and Australia, each running a “Content Fetch API” and an “Asset CDN.” None is in mainland China, and the nearest, Australia, is still outside it — so a China-facing Agility site renders from, and depends on, an offshore content backend reached across the border. | Agility CMS — System Status (status.agilitycms.com), retrieved 2026-10-08 |
| If your content models or editor accounts hold personal data, that data is held offshore. An enterprise headless CMS does not only store marketing copy — content models routinely carry author profiles, user-generated content and form-style entries, and Agility's Content Manager web app holds your editors' names, emails and roles. Gathered from people in China and kept in an offshore Azure region, that is a cross-border transfer of personal information under PIPL: the handler — you, Agility's customer, not Agility — must give notice, obtain separate consent, and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). | PIPL Chapter III, Articles 38–43 |
| There is no in-product way to keep the China slice of your data on Chinese soil. For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Because Agility provisions each instance into a single offshore region and publishes none in mainland China, meeting that duty means running the storage on infrastructure inside the mainland — a separate arrangement from your Agility instance, not a region toggle. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| The ICP filing attaches to your public site, not to the headless backend. Agility is a content API a frontend queries; the ICP filing (State Council Order No. 292; MIIT Order No. 33) attaches to the public mainland website or app you build on top of it and the in-country hosting resource it runs on — not to the CMS. With no mainland region, Agility gives that site no footing to file against. | State Council Order No. 292; MIIT Order No. 33 — ICP filing portal (beian.miit.gov.cn) |
Sources verified by the 21YunBox compliance team on 2026-10-08.
For a mainland-China audience, the deciding question about Agility CMS is not how fast a page paints — it is where the content your site is built on is stored, and where the API that serves it answers from. Agility CMS is an API-first headless CMS: a live content backend your frontend calls on each request, and a Content Manager web app your team signs in to author it — not a bundle of files you can simply park at an edge. Its own hosting documentation answers both questions, and both answers point offshore: Agility runs on Microsoft Azure and provisions each instance into one of five regions, none of them in mainland China. Reaching that offshore backend from inside China is rarely the whole problem; the licensing footing and the data residency are the exposure.
Agility CMS in China at a glance
| What decides it | In Agility's own terms |
|---|---|
| Where your content lives | “Agility CMS is a SaaS platform hosted on Microsoft Azure,” and “Instances are provisioned into one of five regions.” Those five — USA North Central, USA East, Canada, Europe and Australia — are all offshore, and none is in mainland China. |
| How it's delivered | Agility's status page runs a “Content Fetch API” and an “Asset CDN” in each region. Cached reads can come from an edge near the visitor; draft, preview, personalized and write queries still resolve against the offshore Azure region across the border. |
| Who signs in to edit | The Content Manager web app holds your team's editor accounts — names, emails, roles — on the same offshore Azure infrastructure. For China-based editors, that is personal data kept outside the mainland. |
| Serving the public | The site you build on Agility and serve to mainland visitors needs an ICP filing tied to a mainland hosting resource. As a headless backend with no mainland region, Agility offers no ICP-filing footing of its own — the filing lands on your site. |
| Your data on Agility | Personal data in content models about Chinese users is stored offshore — a cross-border transfer PIPL governs, plus a data-localization duty for CIIOs and large-volume handlers that an offshore region cannot meet. |
No mainland region, so the licensing question lands on your site
Agility CMS runs on Microsoft Azure, and in its own hosting documentation it is “a SaaS platform hosted on Microsoft Azure,” with “Instances … provisioned into one of five regions.” Those five, named on Agility’s public status page, are USA North Central, USA East, Canada, Europe and Australia — every one offshore, and not one in mainland China. That footprint settles the licensing question before performance enters it. A public-facing website delivered to mainland visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically inside the mainland. Because Agility is a backend reached over a content API — and your frontend is a separate application you build and host — there is nothing on Agility to file against, and the filing lands on your public site, not on the CMS. Already shipping on Agility does not carry a site across the border: calling an offshore content API from Shanghai is a world away from being cleared to operate a mainland site.
A live content API, not a bundle of files
A headless CMS is dynamic by nature: your site asks Agility for content on request rather than shipping a fixed set of files, and your team reaches the same backend through the Content Manager web app to author it. Agility’s status page shows a Content Fetch API and an Asset CDN in each region, so published reads can be answered from an edge close to the user — but draft and preview content, personalized or uncached reads, every editor change and every write still travel back to the offshore Azure region your instance lives in. That round trip is one an edge cache in front of a foreign origin does not remove, and it leaves a China-facing site leaning on an offshore content API staying reachable across the border. It is why dropping a CDN in front under-answers the China question for a headless stack: speeding up the cacheable public reads leaves the dynamic path crossing the border — and leaves the ICP and data-residency facts exactly where they were.
Your China users’ content — and your editors’ accounts — sit offshore
Model anything that holds personal data in Agility — author profiles, account records, user-generated content, comments, form entries — and for China users that personal information lives in an offshore Azure region, outside the mainland. The same is true of the Content Manager web app itself: the names, emails and roles of China-based team members who sign in to edit are personal data held offshore. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, Agility’s customer, not Agility — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty a single offshore region, chosen from five that are all outside the mainland, cannot satisfy.
None of this is a verdict on your build: whether an ICP filing, in-country storage for the personal data in your content, or both apply to you depends on what you publish, how much personal information you handle, and who your users are — a question to settle with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep authoring in Agility, and your content, content models and Content Manager stay exactly as they are. We add the one piece a managed headless CMS with no mainland footprint leaves to you: compliant, ICP-filed delivery from inside the mainland, set in front of the public site you already run — no rebuild, no second codebase, and no move off Agility CMS. Our China team weighs your ICP and PIPL data-residency obligations against your entity and the personal data your content and editor accounts hold, then stands up the in-country delivery — and, where the law requires it, the in-country storage — a lawful China presence needs, while your Agility instance stays exactly where it is.
Related reading:
