Does Brevo Work in China? Data Residency, PIPL & Your Contact Data
Brevo stores your contacts' personal data on servers inside the European Union — Google Cloud in Belgium, OVH in France — with no mainland-China region, so holding Chinese users' data there is a cross-border transfer under PIPL. A compliance-first look at the data-residency door.
Does Brevo work in China?
Brevo is reachable from mainland China — but that was never the question. Brevo keeps your contacts' personal data on servers inside the European Union, with no mainland-China region, so for every Chinese contact you hold, that storage is itself a cross-border transfer China's law governs.
Asked point-blank where data lives, Brevo's own team says "the servers of our hosting providers (GCP and OVH) are all located in the European Union (Belgium and France)" — Google Cloud in Belgium, OVH in France, and nothing inside the mainland. So the contact lists, subscriber profiles and engagement history you load for Chinese users sit offshore by design: a cross-border transfer of personal information under PIPL that needs notice, separate consent and a lawful transfer mechanism (Articles 38–43), and for a CIIO or large-volume handler a China-storage duty (Article 40) that EU hosting cannot meet. The table below is Brevo's own wording and the rule each row triggers.
This is a risk map, not a verdict — what you owe turns on your entity, how much personal data you hold and who your contacts are. Our China team can map your exposure with you →
Compliance snapshot
- ! Your mainland contacts' personal data sits on Brevo's EU servers
- ! Holding it there is a cross-border transfer under PIPL
- ✕ Brevo runs no mainland-China region — in-country residency isn't offered
- ! CIIO or high-volume? A China-storage duty EU hosting can't meet
- ✓ The platform is reachable; the exposure is legal, not the network
What Brevo's own documentation says about China
| Fact | Primary source |
|---|---|
| Brevo stores your data in the EU, and runs no mainland-China region. Asked directly where customer data lives, Brevo's own team states that "the servers of our hosting providers (GCP and OVH) are all located in the European Union (Belgium and France)" — Google Cloud in Belgium and OVH in France. The contact lists, subscriber profiles and campaign data you hold for Chinese users are therefore stored offshore, which makes their storage a cross-border transfer of personal information under PIPL. | Brevo staff reply, official Brevo community (community.brevo.com), retrieved 2026-10-07; PIPL Articles 38–43 |
| This is Brevo's standing data-residency policy, not a one-off. Brevo's own "Data storage location" help article describes the hosting servers on which it processes and stores its databases as all located within the European Union — on Brevo's own servers and on Google Cloud — and names OVH and Google Cloud as its providers. Brevo documents no Asian or mainland-China data region anywhere; for a China-facing sender, the data never comes to rest inside the mainland. | Brevo — "Data storage location" (help.brevo.com), retrieved 2026-10-07 |
| Under PIPL the obligation is yours, not Brevo's. When you send mainland contacts' personal information to Brevo's EU platform, you are the personal-information handler and Brevo is a processor acting for you. PIPL puts the cross-border transfer duties on the handler: give notice, obtain separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). "We use a GDPR-compliant EU vendor" answers European law, not Chinese law. | PIPL Articles 38–43 (Personal Information Protection Law of the PRC) |
| Reachability and deliverability are the easy half — and still don't fix it. Any public page Brevo hosts for you — a landing page, a sign-up or preference form — is served to mainland visitors from offshore, so it carries no ICP filing of its own (State Council Order No. 292; MIIT Order No. 33), and actually landing email in Chinese inboxes is a separate, well-known operational hurdle. But neither question decides whether you may use Brevo for Chinese contacts; the data-residency and cross-border rules do. | State Council Order No. 292; MIIT Order No. 33 (ICP filing regime) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Brevo is not whether your campaigns go out — it is where your contacts’ personal data is allowed to live. Brevo is an email, marketing and CRM platform, and everything it does runs on personal information: the contact lists you upload, the subscriber profiles it builds, the opens, clicks and journeys it records. Brevo keeps all of it on infrastructure inside the European Union, with no region inside mainland China. The platform is reachable from China, so this is not a connectivity story — it is that holding your Chinese users’ personal information offshore is, under China’s law, a cross-border transfer you must be able to account for.
Brevo in China at a glance
| What decides it | In Brevo's own terms |
|---|---|
| Where your data lives | Brevo's team places its hosting providers’ servers — Google Cloud and OVH — “all located in the European Union (Belgium and France).” Google Cloud in Belgium, OVH in France; no region inside mainland China. |
| Your mainland contacts' data | Every Chinese contact you load — name, email address, engagement history — is personal information held offshore: a cross-border transfer PIPL governs. |
| In-country residency | With no mainland region, there is no way to keep Chinese users' data inside China on Brevo — so a CIIO or large-volume handler's localization duty cannot be met there. |
| Public Brevo-hosted pages | A Brevo landing page or sign-up form shown to mainland visitors is served from offshore, carrying no ICP filing of its own. |
| Is it reachable? | Generally yes — the platform loads from China. Getting email to land in Chinese inboxes is a separate operational problem; neither changes the data-residency question. |
Your contacts’ data lives in the EU — and that is the door
Brevo’s hosting providers are Google Cloud and OVH, and Brevo’s own team puts their location plainly: “the servers of our hosting providers (GCP and OVH) are all located in the European Union (Belgium and France).” Brevo’s “Data storage location” documentation says the same — processing and storage inside the EU, on Brevo’s own servers and on Google Cloud — and it describes no Asian or mainland-China region at all. So the moment you load a Chinese contact into Brevo, their name, email address and behavioural history come to rest in Belgium or France.
That geography settles the compliance question before deliverability ever enters it. A China-facing email programme on Brevo is run entirely on offshore personal data, and that is not something you tune away on the sending side. Reaching your Chinese audience through Brevo is not the same as being cleared to hold their data the way China’s law expects — and the gap is about where the data sits, not how the mail is sent.
What China’s law asks once the data is offshore
Under China’s Personal Information Protection Law, sending mainland users’ personal information to an EU platform is a cross-border transfer, and the duty sits with you — the handler — not with Brevo, which processes the data on your behalf. You have to give affected users notice, obtain their separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). If you are a critical information infrastructure operator, or you handle personal information above the regulated volumes, a second layer applies — personal information collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)), a residency duty an EU-only platform structurally cannot satisfy. “We use a GDPR-compliant European vendor” is a genuine answer to European law; it is not an answer to this one.
Reachable, and the email mostly sends — but that was never the test
Brevo itself is not blocked: the dashboard loads and the API answers from inside mainland China. Two things get raised at this point, and neither settles the compliance question. First, actually delivering marketing and transactional email into Chinese inboxes is a separate, well-known operational hurdle — a deliverability problem, not a legal clearance. Second, any public page Brevo hosts for you — a landing page, a sign-up or preference-centre form — is served to mainland visitors from offshore, so it carries no ICP filing of its own (State Council Order No. 292; MIIT Order No. 33). Both are real, and both sit downstream of the fact that decides everything: your Chinese contacts’ personal data is held outside the mainland.
This is a risk map, not a verdict: whether you need a transfer mechanism, in-country storage, an ICP-filed presence, or some combination depends on what you collect, how much of it, and who your contacts are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Brevo for what it does well — your global list, your campaigns, your automations. What Brevo cannot give a China-facing programme is the thing China’s rules actually turn on: a lawful home for your mainland users’ personal data. We add that layer without a move off Brevo — ICP-filed delivery from inside the mainland, set in front of your existing origin, plus a compliant path for the China data Brevo would otherwise hold offshore, with no rebuild and no second codebase. Our China team maps your PIPL cross-border and data-residency obligations against your entity and data volumes, then stands up the in-country delivery and storage a lawful China presence needs, while your Brevo account stays exactly where it already runs.
Related reading:
Frequently Asked Questions
Does storing our Chinese contacts in Brevo break China's data rules?
Treat it as a risk to assess with counsel, not a flat yes or no. Because Brevo keeps data on EU infrastructure, loading mainland contacts sends their personal information across the border, which PIPL governs as a cross-border transfer — you must give notice, obtain separate consent, and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). If you are a critical information infrastructure operator or handle personal information above the regulated volumes, a data-localization duty can apply on top (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)), and an EU-only platform cannot meet it.
Can we host Brevo data inside mainland China?
No. Brevo's hosting providers are Google Cloud and OVH, and Brevo's own team places their servers in the European Union (Belgium and France); Brevo publishes no mainland-China region, so there is no setting that pins your Brevo storage inside China. The realistic paths are to clear a lawful cross-border transfer mechanism for the data Brevo holds, and to stand up compliant, in-country delivery and storage for the China-facing parts of your stack separately — which is the layer Brevo itself does not provide.
Can 21YunBox help make our Brevo setup work in China?
Yes. Our China team can map which obligations apply — assessing your PIPL cross-border and data-residency exposure for your entity, data volumes and contacts — and stand up the ICP-filed, in-country delivery and storage a compliant China presence requires, in front of the Brevo-powered stack you already run. Get in touch to work through your specific case.
