Does CircleCI Work in China? Data Residency, Localization & PIPL Cross-Border

For a mainland-China audience, the deciding question about CircleCI is not whether a developer can reach it or whether a git push triggers a pipeline — both are routine. It is where the assets CircleCI handles are allowed to come to rest. A CI/CD platform holds some of your most sensitive material: the source code it checks out to build (a trade secret in itself, and routinely the credentials, keys and personal information that live in configs, fixtures and test data), the pipeline secrets and contexts it stores, and the build logs and artifacts it produces. CircleCI is primarily a cloud service, and its cloud runs offshore — on AWS and GCP, with no mainland-China region to select. So for a China team, that code, those secrets and those logs come to rest outside the country. CircleCI does offer self-hosted options — but they are not all equal, as the evidence below shows.

CircleCI in China at a glance

Where the data actually rests

CircleCI is, first and foremost, a cloud service. When your team connects a repository and runs a pipeline, CircleCI’s cloud checks out your source code into its build environment, reads and injects the secrets and contexts you have stored with it, and collects the logs and artifacts each job produces. That cloud runs offshore — on AWS and GCP — and it offers no mainland-China region to select. There is no data-residency control that pins a China team’s pipelines to the mainland, so on the default cloud the code, the secrets and the build state all come to rest outside the country.

CircleCI does offer self-hosted execution, but the two shapes are not equal — and the difference is the whole compliance story. Self-hosted runners let jobs run on machines you own: CircleCI’s documentation explains that the container-agent “polls CircleCI for jobs,” spins up ephemeral pods and runs each job inside one. That moves job execution in-country — but the runner still reaches back to CircleCI’s cloud for work, so your pipeline configuration, your encrypted contexts and your stored secrets stay on the offshore control plane. Runners in-country are not the same as the control plane and the stored secrets in-country.

The fuller lever is CircleCI Server, the fully self-hosted product. CircleCI describes it as “an on-premises CI/CD platform for enterprise customers” that “operates within your Kubernetes cluster” — and the Nomad control plane that schedules jobs “runs inside your Kubernetes cluster.” Run that cluster on mainland infrastructure and the control plane, the contexts and the secrets all stay in the country. That is the shape that can actually satisfy an in-country residency duty.

What it holds is personal information

A CI/CD platform is not a cache or an edge node — it handles your crown-jewel assets. The source code CircleCI checks out is a trade secret in its own right, and in practice it carries more: credentials, API keys and tokens embedded in configuration, and personal information sitting in fixtures, seed data and test datasets. The pipeline secrets and contexts CircleCI stores are, by definition, secrets. The build logs and artifacts it produces can capture both — printed environment values, test output built from real records, packaged data. Where you manage infrastructure as code, the state CircleCI touches maps your whole topology and often holds secrets in plaintext.

Two bodies of law bear on that. First, wherever commits, CI logs, contexts or fixtures carry the personal information of people in China — names, emails, identifiers, real customer records in test data — sending them to CircleCI’s offshore cloud is a cross-border transfer, and PIPL Articles 38–40 govern it: notice, separate consent, and one lawful transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. The security-assessment measures set when that assessment is mandatory rather than optional.

Second, a harder duty can sit on top. A critical-information-infrastructure operator or a high-volume handler must store China personal information inside the mainland — PIPL Article 40 and the data-localization rule in Cybersecurity Law Article 39 (formerly Article 37). A CI/CD cloud with no mainland-China region cannot satisfy an in-country storage duty, because the data is, by definition, not in the country. And the source-code and trade-secret exposure runs in parallel with the PIPL analysis — it does not wait for personal information to be in scope.

Running it on a no-China-region cloud doesn’t meet the residency duty — and what does

The fix is not to make an offshore CircleCI endpoint reachable from China. Reachability was never the problem; residency of the code, the secrets and the state is. If your obligations require China personal information — or your source-code and secrets governance requires the build system itself — to stay on the mainland, the lawful lever is to run CircleCI in-country: CircleCI Server on mainland infrastructure, where the control plane, contexts and secrets all stay in the country. Self-hosted runners alone do not get you there, because they move only job execution while the control plane and stored secrets remain on CircleCI’s offshore cloud — a partial measure, honestly labelled.

Crucially, this is not a migration project in the usual sense. You are not re-platforming your application or rebuilding your pipelines; you are placing a compliant, in-country CI/CD control plane where the code and secrets must live, and putting the China-facing surfaces that sit in front of it — the dashboards and developer portals your mainland users reach — on ICP-filed, in-country delivery in front of the stack you already run. Localize means an in-country deployment, not a tunnel back to an offshore endpoint.

This page maps exposure; it is not a legal ruling. Your actual duties turn on your entity, how you classify the data in your pipelines, your transfer volumes and whether you are a critical-information-infrastructure operator — so settle those specifics with qualified China counsel before you rely on any single path.

The lawful path — map, localize, deliver

21YunBox is a compliant overlay, not a migration — and a partner to CircleCI and to your platform team, not a competitor to them.

• Map. We read the PIPL cross-border, data-residency, data-localization (CII) and ICP obligations against your entity, your data volumes and the personal information that actually rides in your repositories, CI logs and contexts — so you know which duties bite before you move anything.
• Localize. We run the CI/CD control plane in-country so the code, secrets and build state stay on mainland soil — CircleCI Server (or another self-managed deployment) on mainland infrastructure, or a licensed in-country / sovereign option — and keep consented, in-country storage for what must stay. Localize means an in-country deployment, not a tunnel to an offshore endpoint; self-hosted runners alone move only execution.
• Deliver. Any China-facing surface in front of the platform — the dashboards, the developer and reporting portals your mainland users hit — runs over ICP-filed, in-country delivery (the 21YunBox Optimizer), in front of the stack you already run. No rebuild, no second codebase.

The result is a CI/CD setup that runs legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind.

Get a compliance assessment →

Related reading

• Cross-border data transfers under PIPL
• China’s Cybersecurity Law and data localization
• China’s data-export security assessment measures
• How to get an ICP license for a website in China

RELATED TECHNOLOGIES

Bitbucket

Bitbucket

GitHub

GitHub

GitLab

GitLab

HashiCorp Vault

HashiCorp Vault

Jenkins

Jenkins

Terraform

Terraform