Does Bitbucket Work in China? Data Residency, Localization & PIPL Cross-Border
Bitbucket Cloud runs on Atlassian's AWS infrastructure in the United States with no mainland-China region, and Atlassian has postponed Bitbucket Cloud data residency to 2026 — so repositories, Pipelines logs and secrets rest offshore. A compliance-first look at Bitbucket data residency, localization and PIPL cross-border transfer.
Does Bitbucket work in China?
Bitbucket reaches China; the compliance question is where your code and secrets come to rest — and on Bitbucket Cloud that is the United States, with no mainland-China region to pick.
Atlassian has postponed Bitbucket Cloud data residency to 2026 — the first new locations planned are the European Union (December 2026) and India (June 2027), and mainland China is not on that roadmap — so repositories, Bitbucket Pipelines logs, build artifacts and pipeline secrets rest offshore on Atlassian's AWS infrastructure. Source code routinely carries embedded credentials and personal information in configs, fixtures and commit history, so holding a China team's repositories offshore is a cross-border transfer under PIPL on top of the trade-secret exposure, and a critical-information-infrastructure operator or high-volume handler owes in-country storage an offshore SaaS cannot meet. Atlassian itself recommends Bitbucket Data Center — the self-managed edition you run on your own infrastructure, including the mainland — for customers with strict residency requirements.
This is a risk map, not a ruling — your duties turn on your entity, your data volumes and who your users are. Our China team can map your exposure →
What Bitbucket's own documentation says about China
| Fact | Primary source |
|---|---|
| Bitbucket Cloud has no region selection today — Atlassian postponed data residency to 2026. In Atlassian's August 2024 roadmap update it states: "For customers who have a strict requirement for data residency, we recommend continuing to use Bitbucket Data Center." The first planned locations are the European Union (December 2026) and India (June 2027); no mainland-China region is on the roadmap, so repositories, Pipelines logs and secrets rest on Atlassian's AWS infrastructure in the United States. | Atlassian, 'Roadmap update: Support for data residency in Bitbucket Cloud is postponed' (atlassian.com), retrieved 2026-10-10 |
| Atlassian's data residency feature does not cover Bitbucket, and none of its locations is China. Atlassian's data residency documentation lists the covered products as "Jira, Jira Service Management, Jira Product Discovery, Confluence, and Loom" — Bitbucket is absent. The locations it offers are Global, Australia, Canada, EU, Germany, India, Japan, Singapore, South Korea, Switzerland, United Kingdom and USA; there is no mainland-China location to select. | Atlassian Support, 'Understand data residency' (support.atlassian.com), retrieved 2026-10-10 |
| A China team's code held offshore is a cross-border transfer of personal information under PIPL. Where repositories, Pipelines logs or issue tickets contain personal information — names and emails in commit history, real data in test fixtures — storing them on Bitbucket Cloud's US infrastructure is a cross-border transfer governed by PIPL Articles 38–40: notice, separate consent, and one lawful mechanism (a CAC security assessment, the standard contract, or certification), on top of the trade-secret exposure of placing source code offshore. | Personal Information Protection Law (PIPL), Articles 38–40, retrieved 2026-10-10 |
| CIIOs and high-volume handlers owe an in-country storage duty an offshore SaaS cannot meet. A critical-information-infrastructure operator or high-volume handler must keep China personal information on the mainland — PIPL Article 40 and Cybersecurity Law Article 39 (formerly Article 37) (the 2025 amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged). A Bitbucket Cloud instance resting in the US cannot satisfy it; a self-managed Bitbucket Data Center on mainland infrastructure can. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37), retrieved 2026-10-10 |
Sources verified by the 21YunBox compliance team on 2026-10-10.
For a mainland-China engineering team, the deciding question about Bitbucket is not whether a repository clones or a git push reaches the server. It is where the code and secrets Bitbucket holds are allowed to come to rest. Bitbucket is Atlassian’s source-control and CI platform — Git repositories plus Bitbucket Pipelines — and source control holds a company’s most sensitive assets: proprietary source code, the credentials and keys embedded in configs, fixtures and pipeline settings, build logs and artifacts, and the personal information that lands in commit history, issues and test data. On Bitbucket Cloud, the managed edition, that data rests on Atlassian’s AWS infrastructure in the United States — there is no mainland-China region to select, and Atlassian has postponed Bitbucket Cloud data residency to 2026. The self-managed edition, Bitbucket Data Center, is residency-flexible: you can run it on mainland infrastructure and keep that code in-country.
Bitbucket in China at a glance
| What decides it | In Bitbucket's own terms — and China's law |
|---|---|
| Where the data physically rests (the region reality) | Bitbucket Cloud runs on Atlassian's AWS infrastructure in the United States and offers no region selection today — Atlassian postponed Bitbucket Cloud data residency to 2026 (the European Union first in December 2026, then India in June 2027; no mainland-China region planned). Mainland capacity exists only where you self-host Bitbucket Data Center on your own in-country infrastructure. |
| What Bitbucket holds, and why it is personal information | A source-control and CI system holds proprietary source code (a trade secret), the credentials, tokens and API keys embedded in configs, fixtures and Pipelines settings, build logs and artifacts, and personal information that lands in commit history, issue tickets and test fixtures — names, emails and sometimes real customer data. So where it rests is a legal question, not a performance one. |
| Your China users' records when the repositories are offshore | Hold a China team's repositories, Pipelines logs or tickets — with personal information in them — on Bitbucket Cloud's US infrastructure and you are making a cross-border transfer under PIPL (Articles 38–40): notice, separate consent, and one transfer mechanism — a CAC security assessment, the standard contract, or certification — on top of the trade-secret exposure. |
| The in-country storage duty (CIIO / high-volume handler) | A critical-information-infrastructure operator or high-volume handler must keep China personal information on the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged). An offshore Bitbucket Cloud instance structurally cannot. |
| Reachability is not the axis (and the China-facing surface) | Whether Bitbucket is reachable from China is a delivery matter, not the legal test; residency of the code, secrets and logs is. The lawful levers are to run Bitbucket Data Center in-country and to put any China-facing surface — your self-hosted Bitbucket, developer and CI portals — on ICP-filed delivery. |
Where the code and secrets actually rest
When you use Bitbucket Cloud you do not choose a region — Atlassian runs the service on its AWS infrastructure, and for Bitbucket that infrastructure is in the United States. Unlike Jira and Confluence, which are covered by Atlassian’s data residency feature (pinning to Global, Australia, Canada, EU, Germany, India, Japan, Singapore, South Korea, Switzerland, the United Kingdom or the USA), Bitbucket is not covered by it — and none of those locations is China in any case. In its August 2024 roadmap update Atlassian said plainly that it had “postponed our plans to build support for data residency in Bitbucket Cloud until 2026,” with the first new locations being the European Union (December 2026) and India (June 2027). Mainland China is not on that roadmap.
So every repository, Pipelines run, build log, artifact and stored secret on Bitbucket Cloud rests offshore. Atlassian itself draws the conclusion for strict cases: “For customers who have a strict requirement for data residency, we recommend continuing to use Bitbucket Data Center.” That is the self-managed edition — the software you install and run on your own infrastructure, including servers inside mainland China. It is residency-flexible by nature: the code rests wherever you deploy it.
A word on durability, because a self-hosted lever is only worth building on if it lasts. Bitbucket Server, the older self-managed product, reached end of support on February 15, 2024. Bitbucket Data Center is different: Atlassian has stated that, unlike other Atlassian Data Center products that reach end of life on March 28, 2029, “Bitbucket and Bamboo Data Center will not end of life and will continue beyond the Data Center end of life in 2029.” Existing Bitbucket Data Center licenses remain available until March 28, 2029, after which Atlassian sells it through the Bitbucket Hybrid License. The self-hosted, in-country lever is therefore durable — confirm your licensing path with Atlassian, but the deployment model you need is not going away.
What it holds is personal information
A source-control platform is not a cache or a CDN edge — it is the canonical store of your engineering organization’s crown jewels. A Bitbucket repository holds proprietary source code, and alongside it the things that routinely end up in version control: database credentials and API keys in config and environment files, tokens in CI pipeline settings, and personal information in test fixtures, seed data, commit metadata and issue tickets — names, emails, and sometimes real customer records used in testing. Bitbucket Pipelines adds build logs, artifacts and deployment secrets to the pile.
That is why residency, not reachability, is the test. When any of that personal information belongs to people in China and rests in an offshore Bitbucket Cloud instance, you are making a cross-border transfer, and PIPL Articles 38–40 govern it: notice, separate consent, and one lawful transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. The security-assessment measures set when that assessment is mandatory rather than optional. The trade-secret exposure of placing your source code abroad sits on top of all of this.
On top of the transfer rules sits a harder duty. A critical-information-infrastructure operator or high-volume handler must store China personal information inside the mainland — PIPL Article 40 and the data-localization rule in Cybersecurity Law Article 39 (formerly Article 37). A Bitbucket Cloud instance in the United States cannot satisfy an in-country storage duty, because the data is, by definition, not in the country.
Running it on a no-China-region managed service doesn’t meet the residency duty — and what does
The fix is not to make an offshore Bitbucket Cloud endpoint reachable from China. Reachability was never the problem; residency is. If your obligations require China personal information — and the source code and secrets wrapped around it — to stay on the mainland, the lawful lever is to run Bitbucket in-country: Bitbucket Data Center, self-managed on mainland infrastructure, so repositories, Pipelines secrets, build logs and artifacts rest inside the country. This is exactly the path Atlassian points strict-residency customers toward.
Crucially, this is not a migration off Bitbucket. You keep Bitbucket; you place the self-managed edition where the law says the data must live, and put the China-facing surfaces your developers reach — the Bitbucket web UI, developer portals, CI dashboards and artifact endpoints — on ICP-filed, in-country delivery in front of the stack you already run. Localize means an in-country deployment, not a tunnel back to an offshore endpoint.
This page maps exposure; it is not a legal ruling. Your actual duties turn on your entity, how you classify the data in your repositories, your transfer volumes and whether you are a critical-information-infrastructure operator — so settle those specifics with qualified China counsel before you rely on any single path.
The lawful path — map, localize, deliver
21YunBox is a compliant overlay, not a migration — and a partner to Atlassian and to your platform team, not a competitor to them.
- Map. We read the PIPL cross-border, data-residency, data-localization (CII) and ICP obligations against your entity, your data volumes and whose personal information actually sits in your repositories, tickets and pipelines — so you know which duties bite before you move anything.
- Localize. We run Bitbucket in-country so the code, secrets and logs stay on mainland soil — Bitbucket Data Center self-managed on mainland infrastructure — and keep consented, in-country storage for what must stay. For a managed service with no China region, localize means standing up a lawful in-country equivalent, not a tunnel to the offshore endpoint.
- Deliver. Any China-facing surface in front of your repositories — the Bitbucket web UI, developer portals, CI dashboards and artifact endpoints your mainland developers hit — runs over ICP-filed, in-country delivery (the 21YunBox Optimizer), in front of the stack you already run. No rebuild, no second codebase.
The result is a source-control and CI setup that runs legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind.
Related reading
- Cross-border data transfers under PIPL
- China’s Cybersecurity Law and data localization
- China’s data-export security assessment measures
- How to get an ICP license for a website in China
