Does Cosmic Work in China? Data Residency, PIPL & an Offshore Content API
Cosmic is a managed headless CMS: it stores your content and dashboard accounts on its own cloud and serves them through a content API and a global AWS CloudFront CDN, with no mainland-China region — so your content and any personal data in it sit offshore under PIPL, and the ICP filing lands on the public site you build on top. A compliance-first look at the two doors.
Does Cosmic work in China?
Whether you can use Cosmic in mainland China is a data-residency and cross-border-API question before it is a speed one. Cosmic is a fully managed, headless CMS: it keeps the content your site is built on — along with the dashboard accounts your team signs in with to edit it — and serves it through a content API and a global CDN. Where that content is stored, and where the API answers from, is what China's law responds to.
Cosmic's own changelog places delivery on “the global Cosmic CloudFront CDN,” with media served from cdn.cosmicjs.com — a global AWS CloudFront footprint, and no mainland-China region. So your content, and any personal data your content models or editor accounts hold about China users, is kept offshore: a cross-border transfer of personal information PIPL governs. And because Cosmic is a backend behind a frontend you build and host, the ICP filing question lands on the public mainland site you run, not on Cosmic itself. The table below pairs Cosmic's own wording with the rule each line triggers.
This is a risk picture, not a verdict — what applies turns on what your models hold, how much of it is personal, and who your users are. Our China team can map your Cosmic exposure with you →
What Cosmic's own documentation says about China
| Fact | Primary source |
|---|---|
Cosmic serves content through a global AWS CloudFront CDN, with no mainland-China region. Its own changelog states that “AWS CloudFront CDN asset delivery is now included … for all media assets delivered from the Cosmic JS API,” served from “the global Cosmic CloudFront CDN” at cdn.cosmicjs.com. That footprint is global and offshore; Cosmic documents no mainland-China region and no China data-residency option, so the content your site is built on is stored and served from outside the mainland. | Cosmic — CloudFront CDN now included (changelog, cosmicjs.com), retrieved 2026-10-07 |
| If your content models or dashboard accounts hold personal data, that data is held offshore. A headless CMS stores more than marketing copy — content models commonly carry author profiles, user-generated content, comments and form-style entries, and Cosmic's web dashboard also holds the names, emails and roles of the team members who sign in to edit. Gathered from people in China and kept on Cosmic's offshore infrastructure, that is a cross-border transfer of personal information under PIPL: the handler — you, Cosmic's customer, not Cosmic — must give notice, obtain separate consent, and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). | PIPL Chapter III, Articles 38–43 |
| There is no region setting that keeps the content on Chinese soil. For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Because Cosmic runs a single global managed service with no mainland-China region, keeping your China users' content and personal data in-country means running that storage on infrastructure inside the mainland — a separate arrangement from your Cosmic account, not a toggle in it. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| Reaching it is the easy half — the live API still crosses the border, and the ICP question is about your site. Cosmic's CDN can serve cached media from an edge near a visitor, but a headless CMS is dynamic by nature: draft and preview requests, personalized or uncached reads, every dashboard edit and every write still resolve against Cosmic's offshore service across the border — a round trip an edge cache in front of a foreign origin does not remove, and one that leaves a China-facing site depending on that offshore API staying reachable from inside the mainland. The ICP filing (State Council Order No. 292; MIIT Order No. 33) attaches to the public mainland website or app you build on top of Cosmic and its in-country hosting resource — not to the headless CMS itself. | Cosmic — CloudFront CDN now included (changelog, cosmicjs.com), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Cosmic is not how fast a page paints — it is where the content your site is built on is stored, and where the API that serves it answers from. Cosmic is a managed, API-first headless CMS: a live content backend your frontend calls on each request, and a web dashboard your team signs in to author it — not a bundle of files you can simply park at an edge. Its own changelog places delivery on a global AWS CloudFront CDN, and it documents no mainland-China region. Reaching Cosmic from inside China is rarely the whole problem; the licensing footing and the data residency are the exposure.
Cosmic in China at a glance
| What decides it | In Cosmic's own terms |
|---|---|
| Where your content lives | Cosmic is a fully managed SaaS CMS; your content and content models live on its own cloud infrastructure. It documents a global AWS CloudFront CDN and no mainland-China region, so the content your site is built on is stored offshore. |
| How it's delivered | “The global Cosmic CloudFront CDN,” with media served from cdn.cosmicjs.com. Cached reads can come from an edge near the visitor; draft, preview, personalized and write queries still resolve against Cosmic's offshore service across the border. |
| Who signs in to edit | Cosmic's web dashboard holds your team's editor accounts — names, emails, roles — on the same offshore infrastructure. For China-based editors, that is personal data kept outside the mainland. |
| Serving the public | The site you build on Cosmic and serve to mainland visitors needs an ICP filing tied to a mainland hosting resource. As a headless backend with no mainland region, Cosmic offers no ICP-filing footing of its own — the filing lands on your site. |
| Your data on Cosmic | Personal data in content models about Chinese users is stored offshore — a cross-border transfer PIPL governs, plus a data-localization duty for CIIOs and large-volume handlers that an offshore service cannot meet. |
No mainland region, so the licensing question lands on your site
Cosmic is a fully managed headless CMS, and its own changelog places delivery on “the global Cosmic CloudFront CDN,” with media served from cdn.cosmicjs.com. That footprint is global and offshore, and Cosmic documents no mainland-China region and no China data-residency option. A public-facing website delivered to mainland visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically inside the mainland. Because Cosmic is a backend reached over an API — and your frontend is a separate application you build and host — there is nothing on Cosmic to file against, and the filing lands on your public site, not on the CMS. “We already run on Cosmic” does not carry into China: querying an offshore content API from Shanghai is not the same as being cleared to operate a mainland site.
A live content API and dashboard, not a bag of static files
A headless CMS is dynamic by nature: your site asks Cosmic for content on request rather than shipping a fixed set of files, and your team reaches the same backend through Cosmic’s web dashboard to author it. Cosmic’s CloudFront CDN can answer cached media from an edge close to the user — but draft and preview content, personalized or uncached reads, every dashboard edit and every write still travel back to Cosmic’s offshore service across the border. That is a round trip an edge cache in front of a foreign origin does not remove, and it leaves a China-facing site depending on that offshore API staying reachable from inside the mainland. This is why “just put a CDN on it” under-answers the China question for a headless stack: caching the fast public reads leaves the dynamic path crossing the border — and leaves the ICP and data-residency facts untouched.
Your China users’ content — and your editors’ accounts — sit offshore
Model anything that holds personal data in Cosmic — author profiles, account records, user-generated content, comments, form entries — and for China users that personal information lives on Cosmic’s offshore infrastructure, outside the mainland. The same is true of the dashboard itself: the names, emails and roles of China-based team members who sign in to edit are personal data held offshore. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, Cosmic’s customer, not Cosmic — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty a single global service with no mainland region cannot satisfy.
This is a risk map, not a verdict: whether you need an ICP filing, in-country storage, or both depends on what your content models hold, how much personal data you keep, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building on Cosmic, and your content, content models and dashboard stay exactly as they are. We add the one piece a managed headless CMS with no mainland footprint leaves to you: compliant, ICP-filed delivery from inside the mainland, set in front of the public site you already run — no rebuild, no second codebase, and no move off Cosmic. Our China team weighs your ICP and PIPL data-residency obligations against your entity and the personal data your content and editor accounts hold, then stands up the in-country delivery — and, where the law requires it, the in-country storage — a lawful China presence needs, while your Cosmic account stays exactly where it is.
Related reading:
