Does Coveo Work in China? Data Residency, PIPL & an Offshore Search Index
Coveo stores your index and the queries and behavior it captures only in offshore regions — US East, Canada, Ireland or Australia, with no mainland-China option — so your China users' search data sits abroad under PIPL and every query is answered across the border. A compliance-first look at the exposure.
Does Coveo work in China?
Whether you can use Coveo in China is first a data-residency and cross-border-data question, not a speed one. Coveo powers on-site search and recommendations by indexing your content and capturing what your visitors type and click — the queries and behavioral signals its AI learns from — and where it keeps that data is what China's law responds to.
By Coveo's own deployment documentation, when you create an organization you pick a primary region that "holds all your Coveo data," and "the currently available regions are" US East, Canada, Ireland and Australia — none in mainland China. Coveo even frames its built-in data residency option as choosing a non-US region, never a Chinese one. So the index, the query logs and the usage analytics gathered from your China users are stored offshore: a cross-border transfer of personal information that PIPL governs, needing notice, separate consent, a transfer mechanism, and for a CIIO or large-volume handler, in-country storage. And because the Search API that answers each query lives in those same offshore regions, every search your China users run crosses the border too. The table below is Coveo's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on your data volumes and your role. Our China team can map your Coveo exposure with you →
Compliance snapshot
- ! On-site search & recommendations are answered from an offshore region (US East, Canada, Ireland or Australia) — every query crosses the border
- ✕ No mainland-China deployment region: the index, ML models and analytics all sit offshore by design
- ! The queries and behavior Coveo captures are personal data held offshore — a PIPL cross-border transfer
- ! Coveo's own "data residency" option means a non-US region, not a mainland-China one
- ✓ A compliant in-country delivery path exists — no rebuild, no migration off Coveo
What Coveo's own documentation says about China
| Fact | Primary source |
|---|---|
| In Coveo's own words: when you create an organization you select a primary deployment region — "the physical center of your organization, which hosts all services and data required for your organization to function" — and "your primary deployment region holds all your Coveo data." The "currently available regions are" US East, Canada, Ireland and Australia — none is in mainland China. | Coveo — Deployment regions and strategies, retrieved 2026-10-07 |
| The data held in that offshore region is the search workload itself. Coveo's primary region runs "the Coveo indexing pipeline, Coveo Analytics service, and main Coveo Platform services," and the analytics stream is, in Coveo's words, "always sent to your primary main region." That analytics is what Coveo's relevance and recommendation models learn from — the queries your visitors type and the actions they take — which routinely carries personal data such as IP addresses and user identifiers. Whatever your China users search and click is therefore recorded and stored offshore. | Coveo — Deployment regions and strategies, retrieved 2026-10-07 |
| Coveo's built-in "data residency" option does not reach China. Coveo defines it as "a deployment strategy that aims at storing all your Coveo data in a single region" for "companies based outside of the United States that don't want their data to be stored in the United States," offering "Canada, Ireland or Australia" as the alternatives. The infrastructure underneath is Amazon's — "many AWS availability zones (AZ) are used" — so there is no native way to keep a China audience's search data on Chinese soil. | Coveo — Deployment regions and strategies, retrieved 2026-10-07 |
| Data collected from users in China and stored in a US East, Canada, Ireland or Australia region leaves the country. PIPL governs that cross-border transfer: the personal-information handler (you, Coveo's customer — not Coveo) must give notice, obtain separate consent, and satisfy one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside mainland China (PIPL Article 40; CSL Article 39 (formerly Article 37)). Coveo publishes no mainland-China region, so the only way to keep your China users' search and behavioral data on Chinese soil is to run that collection, indexing and storage on infrastructure inside the mainland — and standing that up legally is what brings an ICP filing into the picture. | PIPL Article 40; CSL Article 39 (formerly Article 37); Coveo — Deployment regions and strategies (no mainland region), retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Coveo is not how quickly its search box responds — it is where your searchable index lives, where the queries and behavior it captures are stored, and across which border each search has to travel. Coveo answers all three in its own deployment documentation: it runs no region inside mainland China. That makes a China-facing Coveo deployment reachable but entirely offshore, which leaves the personal data inside your users’ searches sitting outside the mainland under China’s data law, and routes every query across the border to be answered. The search works; the data residency and the cross-border transfer are the exposure.
Coveo in China at a glance
| What decides it | In Coveo's own terms |
|---|---|
| Where it runs | A primary deployment region in one of four offshore locations — US East, Canada, Ireland or Australia. No region is inside mainland China; the nearest options are still offshore, on “many AWS availability zones (AZ).” |
| What is stored there | “Your primary deployment region holds all your Coveo data” — the index, ML models, “the Coveo indexing pipeline, Coveo Analytics service, and main Coveo Platform services.” The analytics traffic is “always sent to your primary main region.” |
| Its “data residency” option | Coveo's own data-residency strategy means choosing Canada, Ireland or Australia instead of the US — framed for “companies… that don't want their data to be stored in the United States.” Mainland China is not on the list. |
| Your China users' data | The queries typed and actions taken — personal data such as IP addresses and user identifiers — are recorded and stored offshore. That is a cross-border transfer PIPL governs, with an in-country storage duty for CIIOs and large-volume handlers that offshore regions cannot meet. |
| Serving each search | The Search API answers from the primary region, or a satellite region that holds “duplicates of the content and services required… to perform Search API queries.” With none in mainland China, every query from China is answered across the border. |
No mainland region — your index and the queries it learns from sit offshore
Coveo’s search runs on infrastructure it places in one region of your choosing, and in its own deployment documentation “the currently available regions are” US East, Canada, Ireland and Australia. That region, Coveo says, is “the physical center of your organization, which hosts all services and data required for your organization to function,” and it “holds all your Coveo data” — your searchable index, the machine-learning models, “the Coveo indexing pipeline, Coveo Analytics service, and main Coveo Platform services.” Even the usage analytics is “always sent to your primary main region.” None of the four regions is in mainland China.
Coveo does offer a setting it calls “data residency,” but its own definition shows how far that is from China. It is “a deployment strategy that aims at storing all your Coveo data in a single region,” meant for “companies based outside of the United States that don’t want their data to be stored in the United States,” with the alternatives named as “Canada, Ireland or Australia.” The hardware underneath is Amazon’s — “many AWS availability zones (AZ) are used.” So there is no built-in way to keep a China audience’s search data on Chinese soil; the choice Coveo gives you is which offshore country, not whether to stay in the mainland.
Your China users’ searches are a cross-border transfer
What Coveo stores is not just your catalog. To rank results and drive recommendations, it captures what your visitors type into the search box and what they click afterward — the query text and behavioral signals its relevance models learn from. Those routinely carry personal information: IP addresses, user identifiers, session context. Collected from users in China and written to a US East, Canada, Ireland or Australia region, that information leaves the country.
Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, Coveo’s customer, not Coveo — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty none of Coveo’s four regions can satisfy. Standing up that in-country collection and storage legally is where an ICP filing enters the picture.
Reachable, but every search is answered across the border
Coveo is a hosted API, not a page you can simply cache. Each query your China users run is answered by the Search API in your primary region, or, if you deploy them, in a satellite region that holds only “duplicates of the content and services required for your end users to perform Search API queries.” With no deployment inside mainland China, that request and its response cross the border every time. So the delivery exposure on a China-facing Coveo deployment is not a licensing gap in the search box itself — it is that the one endpoint your on-site search and recommendations depend on sits offshore, exposed to the same congestion and interruption that affects any cross-border call from China, where a disruption to that path takes your search experience down with it.
This is a risk map, not a verdict: whether you need a transfer mechanism, in-country storage, in-country delivery, or all three depends on what your index holds, how much personal data your queries carry, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building on Coveo. We add the piece Coveo leaves to you: compliant, ICP-filed delivery from inside the mainland, placed in front of your existing Coveo endpoints — no rebuild, no second search platform, and no move off Coveo. Our China team maps your PIPL cross-border and data-residency obligations against your entity and the personal data your queries carry, then stands up the in-country delivery and, where the law requires your China users’ search data to stay on the mainland, the in-country storage a lawful China presence needs — while your index and relevance models stay exactly where they already run.
Related reading:
Frequently Asked Questions
Does Coveo store Chinese users' search and behavioral data in China?
No. By Coveo's own deployment documentation, your data lives in the primary region you choose — US East, Canada, Ireland or Australia — which "holds all your Coveo data," and there is no mainland-China region. The index, the query logs and the usage analytics of your China users are held offshore.
Is it against the law to use Coveo in China?
Not inherently. The issue is the cross-border transfer of the personal data inside those queries and analytics, which PIPL permits if you give notice, obtain separate consent and meet one of its transfer mechanisms. Whether you also face an in-country storage obligation depends on your role (for example, whether you are a CIIO) and the volume of personal information you handle. And under the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification. Treat this as a risk to assess with counsel, not a blanket prohibition.
Can 21YunBox help make our Coveo setup compliant in China?
Yes. Our China team can help you assess the cross-border and data-residency exposure for your data volumes and role, and stand up compliant, ICP-filed in-country delivery — and, where the law requires your China users' search data to stay on the mainland, in-country storage — without moving you off Coveo. Get in touch to work through your specific case.
