Does Auvik Work in China? PIPL, Data Residency & an Offshore Monitoring Cloud
Auvik runs no region inside mainland China — its collector ships your network topology, device configs, hostnames and IP addresses to AWS regions in the US, Ireland, Germany, Australia and Canada — so the telemetry you collect in China comes to rest offshore, a cross-border transfer of personal information under PIPL. A compliance-first look at data residency and the two doors.
Does Auvik work in China?
Whether you can run Auvik against systems in mainland China is first a data-residency question, not a speed one. Auvik is cloud network monitoring: a collector you install inside your network discovers your topology and reports it out to Auvik's cloud, so what decides things is where that cloud keeps the data.
By Auvik's own regions documentation, Auvik "uses Amazon Web Services (AWS) data centers throughout the globe to meet the performance and data residency needs of our partners," across "seven available regions" in the US, Ireland, Germany, Australia and Canada — none in mainland China — and "the location of your account is also the region where your data resides." So the network and device telemetry gathered from your China systems — which routinely carries IP addresses, hostnames and user context — comes to rest offshore: a cross-border transfer of personal information that PIPL governs, needing notice, separate consent, a transfer mechanism, and for a CIIO or large-volume handler, in-country storage. The table below is Auvik's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on what you monitor, your data volumes and your role. Our China team can map your Auvik exposure with you →
Compliance snapshot
- ✓ Reachable: the collector dials out from inside your network, so Auvik's cloud is rarely the blocked part
- ! Your China network and device telemetry comes to rest in an offshore AWS region — US, Ireland, Germany, Australia or Canada
- ! That telemetry carries IP addresses, hostnames and user context — a cross-border transfer of personal information under PIPL
- ✕ No mainland-China region and no in-country data-residency option on Auvik
- ✓ A compliant, ICP-filed in-country delivery and storage path exists — no rebuild, no move off Auvik
What Auvik's own documentation says about China
| Fact | Primary source |
|---|---|
| In Auvik's own words: Auvik "uses Amazon Web Services (AWS) data centers throughout the globe to meet the performance and data residency needs of our partners," and there are "currently seven available regions" — US East (North Virginia), US West (Oregon), US East (Ohio), EU West (Ireland), EU Central (Frankfurt), Asia-Pacific (Sydney) and Canada (Central). None is in mainland China, and "the location of your account is also the region where your data resides." | Auvik Support — Auvik regions, retrieved 2026-10-07 |
| Auvik's collector discovers and ships network and device telemetry — topology, device configurations, hostnames, IP and interface addresses, plus account and usage records — that routinely contains personal information. Gathered from systems in China and stored in an offshore AWS region, it leaves the country. PIPL governs that cross-border transfer: the handler (you, Auvik's customer — not Auvik) must give notice, obtain separate consent, and satisfy one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 |
| The exposure scales with volume and role, not merely with using the tool: under the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024 |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside mainland China (CSL Article 39 (formerly Article 37); PIPL Article 40). Auvik publishes no mainland-China region, so the only way to keep your China monitoring data on Chinese soil is to run that collection and its storage on infrastructure inside the mainland — and standing that up legally is what brings an ICP filing into the picture for the public stack you operate. | PIPL Article 40; CSL Article 39 (formerly Article 37); Auvik — Auvik regions (region list), retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a team pointing Auvik at infrastructure in mainland China, the question that decides things is not how fast the network map paints — it is where the data Auvik gathers is allowed to sit. Auvik is a cloud you report monitoring data to: a collector runs inside your network, discovers your devices and topology, and dials out to Auvik’s platform, so getting to Auvik is seldom the sticking point. Auvik settles the residency question itself in its regions documentation — every region it runs is an Amazon Web Services data center, and not one of them is in mainland China. What that leaves exposed is the telemetry: network maps, device configurations, hostnames and IP addresses, swept up inside China and coming to rest in an offshore region, where China’s law reads it as a cross-border transfer of personal information. The connection is the easy part; the place the data lands is the compliance part.
Auvik in China at a glance
| What decides it | In Auvik's own terms |
|---|---|
| Where it runs | Seven AWS regions: US East (North Virginia), US West (Oregon), US East (Ohio), EU West (Ireland), EU Central (Frankfurt), Asia-Pacific (Sydney) and Canada (Central). “The location of your account is also the region where your data resides.” No region is inside mainland China. |
| What's underneath | Every region is an Amazon Web Services data center. Auvik runs on AWS “throughout the globe” — offshore in all seven cases, with the nearest, Sydney, still well outside the mainland. |
| What it collects | Network topology, device configurations, hostnames, IP and interface addresses, and account and usage records — monitoring telemetry that routinely carries personal data. |
| Your China data on Auvik | Comes to rest in your account's offshore region — a cross-border transfer of personal information PIPL governs, with an in-country storage duty for CIIOs and large-volume handlers that no offshore region can meet. |
| Who needs the ICP filing | Your own public mainland website or app — not Auvik, a cloud your collector dials out to. Reaching it is not the test; where its data lives is. |
No mainland-China region, so your telemetry lives offshore
Auvik sets out where it runs in its regions documentation: it “uses Amazon Web Services (AWS) data centers throughout the globe to meet the performance and data residency needs of our partners,” spread over “seven available regions.” Those regions are US East (North Virginia), US West (Oregon), US East (Ohio), EU West (Ireland), EU Central (Frankfurt), Asia-Pacific (Sydney) and Canada (Central). Auvik adds that “the location of your account is also the region where your data resides,” and that while it may shift accounts between clusters for load balancing, “any such moves will respect data residency laws.” Not one of those seven regions is in mainland China, and the nearest — Sydney — is still well outside it. That settles the residency question before performance is ever in the frame: wherever your Auvik account sits, your China monitoring data sits there too, offshore.
The exposure is the telemetry Auvik ships, not the dashboard
What turns this into a compliance question rather than a latency one is the kind of data a network monitor collects. Auvik discovers topology and sweeps up device configurations, hostnames, IP and interface addresses; it ties account and access records to the people who use them; and its collector carries whatever your devices and logs expose, which in practice includes user context. Gathered from systems inside China and reported to an AWS region in the US, Ireland, Germany, Australia or Canada, that personal information crosses the border. Under China’s Personal Information Protection Law the handler — you, Auvik’s customer, not Auvik — has to give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must stay in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — an in-country storage duty none of Auvik’s offshore regions can satisfy. How much of your monitoring data counts as personal information, and in what volume, is worth settling with counsel.
Reachable as a backend — which is why ICP is not the Auvik question
Auvik is not a public website you serve to visitors in China; it is a cloud your collector reports to. The collector sits inside your network and opens the connection outward to Auvik, so reaching it is seldom the failure mode — and that is precisely why the ICP filing regime under State Council Order No. 292 and MIIT Order No. 33 does not attach to Auvik. ICP attaches to the public-facing mainland website or app you run. What does attach to Auvik is the other door: the cross-border transfer and the residency of the telemetry it stores. So “we already run Auvik” carries into China without a filing on Auvik itself — but not without answering where your China monitoring data is allowed to live.
This is a risk map, not a verdict: whether you face only a transfer-mechanism obligation or an in-country storage duty as well turns on what you monitor, how much personal data it contains, and who your users are — worth confirming with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You carry on running Auvik. We add what an offshore-only platform cannot: compliant, ICP-filed delivery from inside the mainland for the public stack you operate, and — where the law demands it — in-country storage for the China data that has to stay on Chinese soil, placed in front of what you already run, with no rebuild and no move off Auvik. Our China team works through your PIPL cross-border and data-residency position against your entity and your data volumes, then stands up the in-country delivery and storage a lawful China presence calls for, while Auvik keeps collecting the telemetry that can lawfully leave the mainland.
Related reading:
Frequently Asked Questions
Does Auvik store Chinese systems' monitoring data in China?
No. By Auvik's own regions documentation, your data resides in whichever region your account sits in, and the seven available regions are in the US, Ireland, Germany, Australia and Canada — none in mainland China. So the topology, device and telemetry data Auvik gathers from your China systems is held offshore.
Is it against the law to use Auvik in China?
Not inherently. The issue is the cross-border transfer of personal information, which PIPL permits if you give notice, obtain separate consent and meet one of its transfer mechanisms. Whether you also face a data-localization duty depends on your role — for example, whether you are a CIIO — and the volume of personal information you handle. Treat it as a risk to assess with counsel, not a blanket prohibition.
Can 21YunBox help make our Auvik setup compliant in China?
Yes. Our China team can help you assess the cross-border and data-residency exposure for your data volumes and role, and stand up the compliant, ICP-filed in-country delivery — and, where the law requires your China data to stay on the mainland, in-country storage — while you keep running Auvik. Get in touch to work through your specific case.
