Does Contentstack Work in China? Data Residency, PIPL & the ICP Question
Contentstack is an enterprise headless CMS running in seven regions — AWS, Azure and GCP across North America, Europe and Australia — with none in mainland China, so your content and any personal data in it sit offshore under PIPL, and the ICP filing attaches to the public site you run on top of it. A compliance-first look at where your content lives and who files for the site.
Does Contentstack work in China?
Whether you can use Contentstack in mainland China is first a data-residency question, not a speed one. Contentstack is an enterprise, API-first headless CMS: it stores the content your site is built on — and any personal data your content models hold — and serves it through a content API. Where it keeps that content is what China's law responds to.
Contentstack “currently supports seven regions: AWS North America, AWS Europe, AWS Australia, Azure North America, Azure Europe, GCP North America, and GCP Europe” — and not one is in mainland China. The choice is made once for the whole organization — “You cannot store your organization's content in multiple regions” — so every piece of your content, and any personal data in it about China users, lives in a single offshore region: a cross-border transfer of personal information PIPL governs. And because Contentstack is a backend behind a frontend you build and host, the ICP filing question lands on the public mainland site you run, not on Contentstack. The table below is Contentstack's own wording and the rule each line triggers.
This is a risk picture, not a verdict — what applies turns on what your models hold, how much of it is personal, and who your users are. Our China team can map your Contentstack exposure with you →
What Contentstack's own documentation says about China
| Fact | Primary source |
|---|---|
| Contentstack runs in seven regions, and every one of them is offshore. Its own regions documentation states it “currently supports seven regions: AWS North America, AWS Europe, AWS Australia, Azure North America, Azure Europe, GCP North America, and GCP Europe.” None is in mainland China — the nearest, AWS Australia, is still outside it — so the content your site is built on is stored offshore wherever you host. | Contentstack — About Regions (contentstack.com), retrieved 2026-10-07 |
| Your whole organization's content lives in one region, and you cannot split it. Contentstack states that “Each region is a separate, independent region” and that “You cannot store your organization's content in multiple regions.” Because the region is chosen once for the entire organization and every region is offshore, there is no in-product way to keep your China users' content and personal data on the mainland while the rest sits elsewhere. | Contentstack — About Regions (contentstack.com), retrieved 2026-10-07 |
| If your content models hold personal data, that data is held offshore. An enterprise headless CMS does not only store marketing copy — content models routinely carry author profiles, user-generated content, personalization and form-style entries, which can be personal information. Gathered from people in China and kept in an offshore Contentstack region, that is a cross-border transfer of personal information under PIPL: the handler — you, Contentstack's customer, not Contentstack — must give notice, obtain separate consent, and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). | PIPL Chapter III, Articles 38–43 |
| There is no way to keep the content on Chinese soil inside Contentstack. For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Because Contentstack publishes no mainland-China region and keeps all of an organization's data in one offshore region, meeting that duty means running the storage on infrastructure inside the mainland — a separate arrangement from your Contentstack organization, not a region setting. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| The ICP filing attaches to your public site, not to the headless backend. Contentstack is a content API a frontend queries; the ICP filing (State Council Order No. 292; MIIT Order No. 33) attaches to the public mainland website or app you build on top of it and the in-country hosting resource it runs on — not to the CMS. With no mainland region, Contentstack gives that site no footing to file against. | Contentstack — About Regions (contentstack.com), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the question to ask about Contentstack is not how fast a page paints — it is where the content behind your site is stored, and whether the personal data your content models hold is allowed to live there. Contentstack is an enterprise, API-first headless CMS: it keeps your content and serves it through a content API, and it answers the residency question in its own documentation. It runs in seven regions, and all of them are offshore — your whole organization’s content lives in the single one you choose, with no mainland-China option and no way to split it. The API is reachable; the exposure is that your content, and any personal data in it, sits outside the mainland — and that the public site you build on Contentstack is the thing that has to be cleared to operate there.
Contentstack in China at a glance
| What decides it | In Contentstack's own terms |
|---|---|
| Where content is stored | Seven regions, all offshore: AWS North America, AWS Europe, AWS Australia, Azure North America, Azure Europe, GCP North America, GCP Europe. None is in mainland China, and the nearest — AWS Australia — is still outside it. |
| One region per organization | “Each region is a separate, independent region,” and “You cannot store your organization's content in multiple regions.” The region is chosen once, for the whole organization, so all of your content lives in the single offshore region you pick. |
| How it is served | A content API a frontend you build queries. Cached reads can be served from edge locations near the visitor, but the content store — and any uncached, preview, management or write query — resolves against the offshore region. |
| Your China users' data | Content models that hold personal data — author profiles, user-generated content, personalization or form-style entries — keep it in the offshore region. For data gathered in China, that is a cross-border transfer of personal information PIPL governs. |
| The ICP question | A public mainland site turns on an ICP filing tied to an in-country hosting resource. As a headless backend, Contentstack is not what gets filed — the public site you build on it is, and Contentstack gives it no mainland footing. |
Seven regions, all offshore — and your whole org lives in one
Contentstack “currently supports seven regions: AWS North America, AWS Europe, AWS Australia, Azure North America, Azure Europe, GCP North America, and GCP Europe.” Not one of them is in mainland China, and the closest — AWS Australia — is still outside it. The choice is made once, for the whole organization: “Each region is a separate, independent region,” and “You cannot store your organization’s content in multiple regions.” So every piece of content your site is built on — and any personal data your models hold — lives in the single offshore region you picked, with no in-product way to keep the China slice of it on the mainland.
That settles the residency question before performance is ever in frame. If your content models hold personal data about people in China — author profiles, user-generated content, comments, or form-style and personalization entries — that data is written to and kept in an offshore region. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, not Contentstack — has to give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty none of Contentstack’s seven regions can meet, and one its single-region model makes impossible to meet even partially.
The content API still answers from outside the mainland
A headless CMS is only half a system: Contentstack holds the content, and a frontend you build and host queries its content API. Reads your delivery layer has already cached can be served from an edge location near the visitor — but an edge cache in front of an offshore store does not move the store. The content itself, and any request the cache cannot serve — a preview, an editor’s change, a management-API call, or a query it has not seen before — resolves against the region you chose, which is offshore.
How much a China visitor feels that depends on how your frontend renders. Publish a fully static build and the per-visitor API crossing mostly disappears; render at request time instead — server-side rendering, incremental regeneration, or client-side calls to the content API — and each of those queries makes the round trip to the offshore region. Caching static files is not the same as giving a dynamic content API a lawful, in-country path.
Who gets ICP-filed — your site, not the backend
Because Contentstack is a backend reached over an API, the licensing question does not attach to it the way it attaches to a host. It attaches to the public-facing site or app you run on top of it. A website delivered to mainland visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically located in the mainland. Contentstack publishes no mainland region, so it offers nothing to file against — the filing is yours to arrange for the site you build on it.
So “we already run on Contentstack” does not carry the site into China: calling an offshore content API from Shanghai is not the same as being licensed to operate a public site there.
This is a risk map rather than a verdict: whether an ICP filing, in-country storage for the personal data in your content, or both apply to you depends on what you publish, the volume of personal information you handle, and who your users are — settle it with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep shipping on Contentstack, and your content models and region settings stay as they are. We supply the one piece an enterprise headless CMS with no mainland footprint leaves to you: compliant, ICP-filed delivery from inside the mainland, placed in front of the site you already run — no rebuild, no parallel codebase, and no move off Contentstack. Our China team weighs your ICP and PIPL data-residency obligations against your entity and the personal data your content holds, then stands up the in-country delivery — and, where the law demands it, the in-country storage — a lawful China presence requires, while your Contentstack organization stays exactly where it is.
Related reading:
