Does Crowdin Work in China? PIPL Cross-Border Data Transfer & Content Residency

The question about Crowdin for mainland China was never whether the platform loads or whether your localization team can sign in. They can. Crowdin is a cloud translation-management platform, and the compliance question is about the content you hand it. Every source string, document, and screenshot you upload — and everything your Git and CMS integrations sync on each push — is copied to Crowdin’s offshore servers to be translated, carrying whatever personal, sensitive, or confidential information is inside it. A translation-management system does not translate-and-forget: the content accumulates permanently as a translation memory, glossary, and project store, alongside the translator and member accounts that work on it. Crowdin runs on Amazon Web Services in the United States by default, with a US-or-EU choice for Crowdin Enterprise and no mainland-China region. So the real question is cross-border and residency: strings describing people in China are a transfer under PIPL (Articles 38–40), sensitive content triggers Article 28, and the permanent corpus raises a content-residency and in-country-storage duty for a critical information infrastructure operator or high-volume handler.

Crowdin in China at a glance

What you actually send — and where it goes

Crowdin is the system of record for your localization: it holds the source strings and documents you upload, their translations, the translation memory and glossaries that accumulate across projects, and the screenshots and visual context translators use to do the work — plus the accounts of the translators, vendors, and members who touch it. It holds the actual content, not a pointer to it. And a localization pipeline pulls from the places your content already lives: Crowdin connects to GitHub, GitLab, and Bitbucket, to CMSes and design tools, and to your own code through its CLI and API — so content flows in continuously, and each sync is another copy leaving your systems for Crowdin’s.

Where does it land? Crowdin’s own data-residency page is explicit: “customer data is stored in the US Data Center by default,” and “Data center selection is not available in Crowdin.” Crowdin Enterprise lets an organization choose, at creation, a US data center (“hosted on AWS in the US-east-1 region (N. Virginia)”) or an EU one (“hosted on AWS in the EU-west-1 region (Ireland)”); the choice is fixed once set, migration between regions is not supported, and — critically — there is no mainland-China region to select. The chosen region stores your files, strings and their metadata, translation memories and glossaries, screenshots and visual context, and user profiles and team membership info, with backups in the same region. Crowdin also notes that some operational data — authentication data, the Global Translation Memory, store-app and integration data — may be processed outside your selected region, so even the EU choice does not keep everything in one jurisdiction. None of these jurisdictions is China.

It’s a cross-border data transfer — under PIPL

The moment your source content describes people in China — names and emails in support tickets, HR or customer records in documents, ID or financial details in legal and compliance text, unreleased product copy, user-generated strings — sending it to Crowdin to be translated is a cross-border transfer of personal information (数据出境). Under China’s Personal Information Protection Law, that transfer needs three things before it is lawful: clear notice to the individuals, a separate consent for the cross-border leg specifically, and one statutory transfer mechanism — a CAC-led security assessment, the CAC standard contract with filing, or certification (PIPL Articles 38–40). Because a translation-management system syncs, the transfer is not a one-time event: every push from your Git or CMS integration re-exports whatever changed.

Sensitive personal information raises the bar. Translated content frequently includes health, financial, legal, biometric, religious, or government-ID data — and you cannot anonymize a document you need rendered in full. Processing sensitive personal information under PIPL Article 28 requires its own separate consent and a prior personal-information protection impact assessment (PIPIA).

Residency is the second duty. Crowdin’s corpus — translation memory, glossaries, project store, screenshots, and member accounts — persists on its offshore AWS region and grows with every job. For a critical information infrastructure operator or a handler whose volumes cross the regulators’ thresholds, China-collected personal information and important data must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)), and where an export is permitted at all, crossing a volume or sensitivity threshold can trigger a CAC data-export security assessment before anything lawfully leaves.

Reaching the platform isn’t the question — keeping the content in-country is

Nothing about Crowdin is blocked in the mainland — the web app, the API, the CLI, and the Git, CMS, and design integrations all connect. So reachability is the delivery half, not the compliance question. The exposure is that your localization content, and the personal and sensitive information inside it, rests on an offshore service with no mainland-China region.

Here the honest lever is narrower than it is for some vendors. Crowdin does offer a residency choice — a US or EU data center for Crowdin Enterprise — but neither is in China, and Crowdin offers no customer-hosted, on-premises, or private-cloud deployment of the platform itself. Its “self-hosted” support refers to connecting self-hosted Git servers — GitHub Enterprise, GitLab Self-Managed, Bitbucket Server — which changes where your source repository lives, not where Crowdin stores the strings, translation memory, glossaries, and screenshots it extracts; those still rest in Crowdin’s US or EU region. So you cannot keep the corpus in China by configuring Crowdin.

What you can do is keep China-origin content’s translation off the offshore path in the first place: route it through a licensed in-country machine-translation / localization service that holds the data in China, minimize or pseudonymize the personal information in strings before any string that must go abroad does, and keep Crowdin’s AI and machine-translation features — which call further offshore providers — turned off for China content. That is localization, not a tunnel that ships the content offshore anyway; you keep Crowdin for your other markets, and only the minimized, lawfully transferable subset ever crosses the border.

This is a risk map, not a verdict: whether you owe a transfer mechanism, a separate consent, an Article 28 impact assessment, a data-export security assessment, in-country storage, or an ICP filing turns on your entity, your volumes, how much of your content is personal or sensitive, and whose data it is — settle the specifics with counsel before you route a single project through an offshore region.

The lawful path — map, localize, deliver

You do not have to drop Crowdin to run localization lawfully for mainland China. 21YunBox is a compliant overlay, not a migration — and, for a platform you already run, a partner alongside your stack, not a competitor to it. There are three moves, and they fit together.

Map. Our China compliance team inventories what content flows to Crowdin — which projects, which strings, which uploaded documents and screenshots — what personal, sensitive, or confidential information it carries, where Crowdin stores it, whether your AI and machine-translation features route it on to further offshore providers, and where you lack a lawful basis for the cross-border leg, so the exposure is written down before anything else moves.

Localize. Because Crowdin offers no mainland-China region and no customer-hosted deployment, we keep China-origin content’s translation in-country on a licensed in-country machine-translation / localization path that holds the data in China — with personal information minimized or pseudonymized in strings before any offshore call, and offshore AI/MT features kept off for China content. Localize means keeping that content’s translation on an in-country path, never a tunnel that ships the content offshore anyway; you keep Crowdin for your other markets, and only the minimized, lawfully transferable subset ever crosses.

Deliver. The China-facing site or app that consumes the translations is a public internet service with an ICP filing duty; the 21YunBox Optimizer provides ICP-filed, in-country delivery in front of the stack you already run — no rebuild, no second codebase. 21YunBox never uses or suggests circumvention of any kind; the entire point is a lawful, filed, in-country path.

The goal is plain: your localization runs legally and compliantly for your users in China.

Get a compliance assessment →

Related reading:

• Cross-border data transfers under PIPL
• China’s Cybersecurity Law and data localization (Article 39)
• China’s data-export security assessment measures
• How to get an ICP filing for China

RELATED TECHNOLOGIES

Amazon Translate

Amazon Translate

DeepL

DeepL

Google Cloud Translation

Google Cloud Translation

Lokalise

Lokalise

Microsoft Translator

Microsoft Translator

Phrase

Phrase

Smartling

Smartling