Does BugHerd Work in China? PIPL, Cross-Border Data & an Offshore Feedback Tool
BugHerd runs no region inside mainland China — it hosts on AWS us-east-1 in Northern Virginia and stores every screenshot and reviewer identity there — so using it for China reviewers is a PIPL cross-border transfer of personal data, and the ICP filing sits on the site that embeds the widget, not on BugHerd. A compliance-first look.
Does BugHerd work in China?
Yes — you can embed BugHerd on a China-facing site and it will run, but whether you should is a personal-data question, not a speed one. BugHerd collects your reviewers' names, emails and session metadata and stores every bit of it in the United States — so using it for reviewers in mainland China is a cross-border transfer of personal information.
BugHerd's own security page states it "runs on Salesforce Heroku, hosted on Amazon Web Services (AWS) in the us-east-1 region (Northern Virginia, USA)," and that "Screenshots and attachments are stored in AWS S3 in the same region" — one offshore region, with no mainland-China location. BugHerd reaches your pages as an embedded widget, so the ICP filing attaches to the site you embed it in, not to BugHerd. But the reviewer identities and the browser, OS and URL it "captures and logs" leave the mainland the moment they are collected — a cross-border transfer under PIPL (notice, separate consent and a transfer mechanism, Articles 38–43), and a data-localization duty an offshore-only tool cannot meet (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). The table below is BugHerd's own wording and the rule each line triggers.
This is a risk map, not a verdict — whether PIPL's cross-border rules or a localization duty bind you turns on who your reviewers are, what your screenshots capture, and your role and data volumes. Our China team can map your exposure with you →
What BugHerd's own documentation says about China
| Fact | Primary source |
|---|---|
| BugHerd stores everything in one US region — there is no mainland-China option. On its own security page BugHerd states it "runs on Salesforce Heroku, hosted on Amazon Web Services (AWS) in the us-east-1 region (Northern Virginia, USA)," and that "Screenshots and attachments are stored in AWS S3 in the same region." Every reviewer identity, screenshot and log sits offshore — so personal information collected from China reviewers is a cross-border transfer under PIPL (Articles 38–43), and no amount of tuning puts it inside the mainland. | BugHerd — Security (bugherd.com/security), retrieved 2026-10-07; PIPL Articles 38–43 |
| BugHerd's widget captures reviewer identity and device metadata on every pin. BugHerd's product page says that when a client points and comments it "grabs a screenshot, saves technical details," and "captures and logs technical info such as browser, URL and operating system." For a reviewer in mainland China, that screenshot and metadata is personal information that leaves the country the instant it reaches BugHerd's servers — the trigger for PIPL's cross-border rules (Articles 38–43). | BugHerd — Bug Reporting Software (bugherd.com), retrieved 2026-10-07; PIPL Articles 38–43 |
| BugHerd records names, emails and IP addresses, and moves them offshore by design. Its privacy policy lists the personal data it holds — "First and Last names," "Email address," and "The IP address from which you access the Internet" — and tells users, "You agree to your data being transferred to other countries when you share your data with us," naming movement "to and from any country, including Australia, the United Kingdom and the United States of America." None is mainland China, so personal information from China reviewers cannot be kept in-country — the opposite of what PIPL localization (Article 40; Cybersecurity Law Article 39 (formerly Article 37)) asks of a CIIO or large-volume handler. | BugHerd — Privacy and Security Policy (bugherd.com/privacy), retrieved 2026-10-07; PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| The ICP filing sits on the site that embeds BugHerd, not on BugHerd. BugHerd reaches your pages as a "JavaScript embed" (its own term) — a third-party component loaded into an origin you already serve, not the public site operator — so the ICP filing (ICP 备案, under State Council Order No. 292 and MIIT Order No. 33) attaches to the mainland site that embeds it, and BugHerd needs none of its own. That makes BugHerd's China question a data question, not a licensing one. | BugHerd — Security (bugherd.com/security), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about BugHerd is not how quickly its widget paints — it is whose personal data it collects and where that data is allowed to live. BugHerd answers both in its own documentation. Its feedback widget embeds in your site and, the moment a reviewer points and comments, grabs a screenshot and logs their browser, OS and URL along with the name and email tied to the account; and all of it is stored in a single United States region, with nothing inside mainland China. Embedding BugHerd is the easy part. The exposure is the law that follows the data it ships offshore — not the network.
BugHerd in China at a glance
| What decides it | In BugHerd's own terms |
|---|---|
| What it is | A feedback widget embedded in your pages — a “JavaScript embed,” in BugHerd's words — not something you host. It “runs on Salesforce Heroku, hosted on Amazon Web Services (AWS) in the us-east-1 region (Northern Virginia, USA).” |
| What it collects | On each pin BugHerd “captures and logs technical info such as browser, URL and operating system,” alongside “First and Last names,” an “Email address,” “The IP address from which you access the Internet” and the screenshots themselves. |
| Where your data sits | “Screenshots and attachments are stored in AWS S3 in the same region.” Everything — reviewer identities included — stays in the US; no region is inside mainland China. |
| Serving the public | BugHerd is an embedded third-party component, so the ICP filing attaches to the site that embeds it, not to BugHerd. BugHerd offers no mainland footing of its own. |
| The rule it triggers | China reviewers' personal information stored offshore is a cross-border transfer under PIPL (Articles 38–43); a localization duty (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) cannot be met on an offshore-only store. |
An embedded widget, not a host — so the ICP filing isn’t BugHerd’s
BugHerd is not something you host; it is a third-party widget you drop into pages your own origin already serves — a “JavaScript embed,” in BugHerd’s own term. That distinction settles the licensing question. A public-facing site shown to mainland visitors turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33 — but that filing attaches to the site operator and the mainland hosting resource behind it, not to a component loaded in from elsewhere. So BugHerd needs no ICP filing of its own, and “is BugHerd ICP-able?” is the wrong question to ask of it. The right one is what its widget does with personal data once it is running — because that, unlike your host’s licence, is exposure you own.
The real exposure: reviewer data that crosses the border
BugHerd earns its keep by capturing people. The moment a reviewer points and comments, BugHerd “grabs a screenshot, saves technical details” and, in its own words, “captures and logs technical info such as browser, URL and operating system.” Tie that to the account and BugHerd is holding “First and Last names,” an “Email address,” “The IP address from which you access the Internet” and the screenshots themselves. For a reviewer sitting in mainland China, every one of those is personal information — and BugHerd’s security page is explicit about where it goes: the platform “runs on … Amazon Web Services (AWS) in the us-east-1 region (Northern Virginia, USA),” and “Screenshots and attachments are stored in AWS S3 in the same region.”
That is a cross-border transfer of personal information at the instant the data is collected. Under China’s Personal Information Protection Law the handler — you, not BugHerd — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). And because BugHerd “grabs a screenshot” of the page under review, whatever personal data happens to be on that screen travels offshore with it — widening the transfer well beyond the reviewer’s own details.
No mainland region, so no in-country storage
BugHerd keeps everything in one United States region, and it is built to move data across borders. Its operator is Australian — BugHerd “is built and operated by Splitrock Studio Pty Ltd, an Australian company” — and its privacy policy tells users plainly, “You agree to your data being transferred to other countries when you share your data with us,” naming movement “to and from any country, including Australia, the United Kingdom and the United States of America.” None of those is mainland China. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore-only tool cannot satisfy, however it is configured.
This is a risk map, not a verdict: whether PIPL’s cross-border rules bind you, and whether a localization duty applies, turns on who your reviewers are, what your screenshots capture, your role, and your data volumes — worth settling with counsel before you roll BugHerd out to a China team.
Where 21YunBox fits — a compliant overlay, not a migration
You keep using BugHerd exactly as you do now. We add the piece an offshore feedback tool cannot: compliant, ICP-filed delivery from inside the mainland, set in front of the origin that embeds your BugHerd widget — no rebuild, no second codebase, and no move off BugHerd. Our China team maps your PIPL cross-border and data-residency obligations against your entity, your reviewers and your data volumes, then stands up the in-country delivery and storage a lawful China presence needs, while BugHerd stays right where it runs.
Related reading:
