Does Auth0 Work in China? Identity Data Residency, PIPL & the Two Doors
Auth0 is a hosted identity provider that stores user identities, credentials and login records in an offshore tenant region — the US, EU, UK, Australia, Japan, Canada, or a 20-region Private Cloud list — with none in mainland China. That makes your China users' identity data a PIPL cross-border transfer. A compliance-first look at the two doors.
Does Auth0 work in China?
Whether you can use Auth0 for mainland-China users is a data-residency question first, not a speed one. Auth0 is a hosted identity provider — it holds the accounts, credentials, profiles and login records your application authenticates against — so the deciding fact is which country that identity data is stored in.
You choose your tenant's region when you create it, and Auth0's regions all sit offshore. Its Public Cloud runs in the US, EU, UK, Australia, Japan and Canada; even Auth0's most geographically flexible option, Private Cloud on AWS, is "fully deployable" across a 20-region list — Australia, Bahrain, Brazil, Canada, France, Germany, Hong Kong, India, Indonesia, Ireland, Japan, Mexico, Singapore, South Africa, South Korea, Sweden, Thailand, the UAE, the United Kingdom and the USA — and not one is in mainland China. So the identities and sign-in records of your China users are held outside the country: a cross-border transfer of personal information PIPL governs, needing notice, separate consent and a transfer mechanism, and — for a CIIO or large-volume handler — in-country storage. Because sign-in is answered from that offshore region, the authentication round trip crosses the border as well. The table below is Auth0's own wording and the rules it triggers.
This is a risk picture, not a verdict — what you owe turns on your data volumes, your role, and how sensitive the identity data is. Our China team can map your Auth0 exposure with you →
Compliance snapshot
- ! Reachable in China, but every sign-in is answered from an offshore tenant region — the auth round trip crosses the border
- ! Stores identities, credentials and login logs in the offshore region you pick (US, EU, UK, Australia, Japan, Canada)
- ! That identity data leaving China is a cross-border transfer of personal information PIPL governs
- ✕ No mainland-China tenant region — even Private Cloud's 20-region AWS list has none
- ✓ A compliant, ICP-filed in-country delivery path exists — no rebuild, no migration off Auth0
What Auth0's own documentation says about China
| Fact | Primary source |
|---|---|
| In Auth0's own words, "Private Cloud on AWS is fully deployable in the following regions: Australia, Bahrain, Brazil, Canada, France, Germany, Hong Kong, India, Indonesia, Ireland, Japan, Mexico, Singapore, South Africa, South Korea, Sweden, Thailand, United Arab Emirates (UAE), United Kingdom, USA" — and none is in mainland China (Hong Kong, the nearest, sits outside the mainland for ICP and data-residency purposes). Auth0's standard Public Cloud regions — the US, EU, UK, Australia, Japan and Canada — likewise include no mainland-China location. | Auth0 Docs — Private Cloud on AWS (deployable regions), retrieved 2026-10-07 |
| Auth0 states, "With Private Cloud on AWS, you choose the region where your data is stored" — and the data in question is personal information: user identities, credentials, profiles, group memberships and authentication logs. Because the choice set has no mainland-China option, data collected from users in China leaves the country to whichever offshore region you pick. | Auth0 Docs — Private Cloud on AWS (region selection), retrieved 2026-10-07 |
| Identity data held offshore is a cross-border transfer under China's Personal Information Protection Law. The personal-information handler — you, Auth0's customer, not Auth0 — must give notice, obtain separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 (cross-border provision of personal information) |
| An identity provider often handles sensitive personal information — biometric factors used for multi-factor authentication, financial-account identifiers, or the data of minors under 14. PIPL allows sensitive personal information to be handled only for a specific purpose with sufficient necessity and with separate consent, which raises the bar for holding those data types in an offshore identity store. | PIPL Articles 28–29 (sensitive personal information) |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside mainland China (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40). Auth0 publishes no mainland-China region, so the only way to keep your China users' identity data on Chinese soil is to run that identity and its storage on infrastructure inside the mainland — and standing that up legally is what brings an ICP filing into the picture. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) (data localization) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
Whether Auth0 “works” in mainland China is a data-residency question before it is a performance one. Auth0 is a hosted identity provider: it stores the accounts, credentials, profiles and login records your application authenticates against — and it keeps them in a tenant region you choose, every one of which sits outside mainland China. A China-facing app on Auth0 is reachable, but each sign-in is answered from offshore, which turns your China users’ identity data into a cross-border transfer China’s law governs and leaves you no mainland footing for the filing an in-country presence needs. Those are the two doors, and Auth0 documents where its data lives in its own words.
Auth0 in China at a glance
| What decides it | In Auth0's own terms |
|---|---|
| Where identities live | Tenant data is stored in the region you choose at tenant creation. Public Cloud runs in the US, EU, UK, Australia, Japan and Canada; Private Cloud on AWS is “fully deployable” across a 20-region list. No region is inside mainland China. |
| You choose the region | “With Private Cloud on AWS, you choose the region where your data is stored” — but the choice set contains no mainland-China option, so China users' data is stored offshore. |
| What data it holds | Identities, credentials, profiles, group memberships and authentication logs — personal information under PIPL, some of it (biometric MFA factors, minors' data, financial identifiers) sensitive personal information. |
| Cross-border transfer | China users' identity data leaving the mainland is a cross-border transfer of personal information. The handler — you, not Auth0 — must give notice, obtain separate consent, and clear one transfer mechanism. |
| Serving & residency | A public-facing mainland site still needs an ICP filing tied to in-country hosting, and a CIIO or large-volume handler must store China personal information in the mainland — neither of which an offshore Auth0 region provides. |
Door one — Auth0 keeps your China users’ identities offshore
Auth0 does not run inside mainland China, and it is candid about where it does run. You pick a tenant region when you create the tenant, and the choices are all offshore: the Public Cloud operates in the US, EU, UK, Australia, Japan and Canada, and even Auth0’s most geographically flexible deployment, Private Cloud on AWS, is “fully deployable in the following regions: Australia, Bahrain, Brazil, Canada, France, Germany, Hong Kong, India, Indonesia, Ireland, Japan, Mexico, Singapore, South Africa, South Korea, Sweden, Thailand, United Arab Emirates (UAE), United Kingdom, USA.” Not one is in mainland China — and Hong Kong, the nearest, sits outside the mainland for ICP and data-residency purposes.
That settles where your users’ identities live. Auth0 holds personal information — accounts, credentials, profiles, group memberships and authentication logs — and, in its own words, “you choose the region where your data is stored.” When your users are in China, that region is offshore, so their identity data leaves the country. Under China’s Personal Information Protection Law that is a cross-border transfer: the personal-information handler — you, Auth0’s customer, not Auth0 — must give notice, obtain separate consent, and clear one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). Some of what an identity provider handles is sensitive personal information — biometric factors used for multi-factor authentication, financial-account identifiers, or the data of minors under 14 — which PIPL allows only for a specific, necessary purpose and with separate consent, raising the bar further for holding it offshore.
Door two — no mainland region, so no in-country residency or ICP footing
Keeping the data in China is the other door, and here Auth0’s geography runs out. For a critical information infrastructure operator or a large-volume handler, personal information collected in the mainland must be stored in the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40). Auth0 publishes no mainland-China region, so there is nowhere on Auth0 to keep that identity data on Chinese soil. Standing up an in-country identity store — and the public site in front of it — then turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, which must attach to a hosting resource physically inside the mainland. “We already run on Auth0” does not carry across either door: reaching China is not the same as being cleared to store data there, or to operate a public site there.
Reachable is not the same as compliant
Auth0 is not blocked in China — a browser in the mainland can reach it and the sign-in pages load. But reachability is a delivery matter, not the compliance question. The login round trip is answered from the offshore tenant region, and no amount of network tuning changes which country the identity data is stored in. That is why “it loads, so we’re fine” misses the exposure: the risk on a China-facing Auth0 setup is not that users cannot sign in — it is that signing in moves their identity data across the border and leaves you without an in-country residency or ICP footing.
This is a risk map, not a verdict: whether you face a cross-border-transfer obligation, a data-localization duty, an ICP filing, or all three turns on what you serve, how much personal information you hold, how sensitive it is, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building on Auth0. We add the piece a hosted identity provider with no mainland region leaves to you: compliant, ICP-filed delivery from inside the mainland, placed in front of your existing stack — no rebuild, no second codebase, and no migration off Auth0. Our China team maps your cross-border and data-residency obligations against your entity, your data volumes and how sensitive the identity data is, then stands up the in-country delivery and — where the law requires your China users’ identity data to stay on the mainland — the in-country storage a lawful China presence needs, while Auth0 keeps doing the authentication.
Related reading:
Frequently Asked Questions
Does Auth0 store Chinese users' identity data in China?
No. You pick your tenant's region when you create it, and Auth0's regions are all offshore — Public Cloud in the US, EU, UK, Australia, Japan and Canada, and Private Cloud on AWS across a 20-region list that runs from Australia to the USA. None is in mainland China. So the identities, credentials and login records of your China users are stored outside the country.
Is it illegal to use Auth0 in China?
Not inherently. The exposure is the cross-border transfer of personal information, which PIPL permits if you give notice, obtain separate consent and meet one transfer mechanism. How heavy that lift is scales with volume and role — under the CAC's March 2024 cross-border rules a non-CIIO moving fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the assessment, standard contract and certification, while a CIIO or large-volume handler faces an in-country storage duty. Treat it as a risk to confirm with counsel, not a blanket prohibition.
Can 21YunBox help make our Auth0 setup compliant in China?
Yes. Our China team can assess your cross-border and data-residency exposure for your data volumes and role, and stand up compliant, ICP-filed in-country delivery — and, where the law requires your China users' identity data to stay on the mainland, in-country storage — while your app keeps authenticating through Auth0. Get in touch to work through your specific case.
