Does Crownpeak Work in China? Data Residency, PIPL & an Offshore DXP Cloud
Crownpeak is a digital experience platform whose FirstSpirit CMS is a cloud Crownpeak runs and locates — it holds your content, project source and editor accounts, serves published output from AWS (Amazon S3 and CloudFront), and documents no mainland-China region, so your content and any personal data in it sit offshore under PIPL, and the ICP filing falls on the public site you build on top. A compliance-first look at the two doors.
Does Crownpeak work in China?
Whether you can run Crownpeak for a mainland-China audience is first a data-residency question, not a page-speed one. Crownpeak is a digital experience platform whose CMS, FirstSpirit, is delivered as a cloud Crownpeak runs and locates — it holds the content your site is built on, your project source, and your editors' accounts. Where it keeps all of that is what China's law responds to.
Crownpeak's own Cloud documentation says “Crownpeak manages the servers for Cloud customers” and that “your source code must be uploaded to Crownpeak's cloud repository,” and its reference architecture serves published output from Amazon S3 and CloudFront — infrastructure Crownpeak documents outside mainland China. So your content, and any personal data in it about China users, lives and is served offshore: a cross-border transfer of personal information PIPL governs. And because Crownpeak is the platform behind a public site you deliver, the ICP filing lands on that mainland site, not on Crownpeak. The table below pairs Crownpeak's own wording with the rule each line triggers.
This is a risk picture, not a verdict — what applies turns on what your content and consent tooling hold, how much of it is personal, and who your users are. Our China team can map your Crownpeak exposure with you →
What Crownpeak's own documentation says about China
| Fact | Primary source |
|---|---|
| FirstSpirit Cloud is a Crownpeak-managed cloud, and the content behind your site lives inside it. Crownpeak's own Cloud documentation states that “Crownpeak manages the servers for Cloud customers,” that a Cloud customer “can't adjust server properties via the ServerManager,” and that “your source code must be uploaded to Crownpeak's cloud repository.” Crownpeak runs and locates that cloud and documents no mainland-China region, so the content, templates and project source your site is built on are held offshore. | Crownpeak — FirstSpirit Cloud, Cloud-Specific Processes (docs.crownpeak.com), retrieved 2026-10-08 |
| Published output is served from AWS, reached across the border. Crownpeak's FirstSpirit reference architecture states that in its static delivery setup your generated files are “synced to Amazon S3” and “delivered via CloudFront,” and that “Amazon handles scalability and performance.” That is an offshore origin and CDN a China visitor reaches across the border; dynamic, headless and editor requests resolve against the managed cloud the same way. An edge cache in front of an offshore origin does not move the origin. | Crownpeak — FirstSpirit Reference Architecture, Static content delivery (docs.crownpeak.com), retrieved 2026-10-08 |
| If your content, consent records or editor accounts hold personal data, that data is held offshore. A DXP does not only store marketing copy — content models carry author profiles, user-generated content and form entries, Crownpeak's digital-quality and consent tooling handles visitor identifiers and consent records, and its Cloud “uses Keycloak for user management,” holding your editors' names and emails. Gathered from people in China and kept in an offshore cloud, that is a cross-border transfer of personal information under PIPL: the handler — you, Crownpeak's customer, not Crownpeak — must give notice, obtain separate consent, and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). | PIPL Chapter III, Articles 38–43 |
| There is no in-product way to keep the China slice of your data on Chinese soil. For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Because Crownpeak runs a managed cloud with no mainland-China region and the customer cannot choose where it sits, meeting that duty means running the storage on infrastructure inside the mainland — a separate arrangement from your Crownpeak environment, not a setting. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| The ICP filing attaches to your public site, not to the DXP. Crownpeak is the platform behind the site; the ICP filing (State Council Order No. 292; MIIT Order No. 33) attaches to the public mainland website or app you deliver to visitors and the in-country hosting resource it runs on — not to Crownpeak. With no mainland region, Crownpeak gives that site no footing to file against. | State Council Order No. 292; MIIT Order No. 33 — ICP filing portal (beian.miit.gov.cn) |
Sources verified by the 21YunBox compliance team on 2026-10-08.
For a mainland-China audience, the question worth asking about Crownpeak is not how quickly a page paints — it is where the content behind your site is kept and who decides that location. Crownpeak is a digital experience platform whose CMS, FirstSpirit, is offered as a managed cloud: in Crownpeak’s own documentation it runs the servers, your project source lives in its cloud repository, and your editors sign in through its identity service. Crownpeak runs and locates that cloud, and its documentation describes no mainland-China region. So a China-facing site built on Crownpeak is reachable but served from offshore — which is where the licensing footing and the data residency become the exposure, long before performance does.
Crownpeak in China at a glance
| What decides it | In Crownpeak's own terms |
|---|---|
| Where your content lives | FirstSpirit Cloud is a cloud Crownpeak runs: “Crownpeak manages the servers for Cloud customers,” and “your source code must be uploaded to Crownpeak's cloud repository.” Crownpeak locates that cloud, and documents no mainland-China region. |
| How it's delivered | Published output is “synced to Amazon S3” and “delivered via CloudFront,” with “Amazon handles scalability and performance.” Cached reads can come from an edge near the visitor; dynamic, headless and editor requests still resolve against the offshore managed cloud across the border. |
| Who signs in to edit | The Cloud “uses Keycloak for user management,” with usernames required to match email addresses — so your editors' names and emails are personal data held in the same offshore cloud. |
| Serving the public | A site served to mainland visitors from inside China needs an ICP filing tied to a mainland hosting resource. As an offshore DXP with no mainland region, Crownpeak offers no ICP-filing footing of its own — the filing lands on your site. |
| Your data on Crownpeak | Personal data in your content models, digital-quality and consent records, and editor accounts about Chinese users sits offshore — a cross-border transfer PIPL governs, plus a data-localization duty for CIIOs and large-volume handlers an offshore cloud cannot meet. |
A managed cloud Crownpeak runs — so the licensing question lands on your site
FirstSpirit, the CMS at the center of Crownpeak’s DXP, is offered as a cloud Crownpeak operates for you. In its own documentation, “Crownpeak manages the servers for Cloud customers,” a Cloud customer “can’t adjust server properties via the ServerManager,” and “your source code must be uploaded to Crownpeak’s cloud repository.” The practical effect is that Crownpeak, not you, decides where the servers sit — and its published documentation describes no mainland-China region or in-country option.
That settles the licensing question before performance is ever in frame. A public-facing website delivered to mainland visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically inside the mainland. Because Crownpeak is the platform behind a public site you deliver — the site is a separate application you ship to visitors — there is nothing on Crownpeak to file against, and the filing lands on your site, not on the DXP. “We already run on Crownpeak” does not carry a site across the border: operating an offshore DXP from Shanghai is a world away from being cleared to run a public mainland site.
Static output on AWS, dynamic calls across the border
Crownpeak’s FirstSpirit reference architecture pre-generates pages and then deploys them: in the static setup, your generated files are “synced to Amazon S3” and “delivered via CloudFront,” and “Amazon handles scalability and performance.” That is an offshore origin and CDN. Cached public reads can be answered from an edge close to the visitor — but an edge cache in front of an offshore origin does not move the origin, and draft, preview, personalized, headless and editor traffic still travels back to the managed cloud your environment lives in.
A China-facing Crownpeak site therefore leans on reaching that offshore infrastructure from inside the mainland. Whether a given Amazon S3 or CloudFront endpoint resolves cleanly from China varies and is worth testing against your own domains — but reachability is not the deciding question here. Even when the page loads, it loads from offshore, which leaves the ICP filing and the data-residency duty exactly where they were. Speeding up the cacheable reads under-answers the China question for a platform whose store, editor layer and dynamic calls all sit across the border.
Your China users’ data — and your editors’ accounts — sit offshore
Model anything that holds personal data in Crownpeak — author profiles, account records, user-generated content, form entries — and for China users that personal information lives in the offshore cloud. The same is true of Crownpeak’s digital-quality and consent tooling, which handles visitor identifiers and consent records, and of the editor layer itself: the Cloud “uses Keycloak for user management,” so the names and emails of China-based team members who sign in to author are personal data held offshore. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, Crownpeak’s customer, not Crownpeak — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty a managed offshore cloud, whose location you cannot choose, cannot satisfy.
None of this is a verdict on your build: whether an ICP filing, in-country storage for the personal data your platform holds, or both apply to you depends on what you publish, how much personal information you handle, and who your users are — a question to settle with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep authoring in Crownpeak, and your content, project source and editor accounts stay exactly where they are. We add the one piece a managed DXP with no mainland footprint leaves to you: compliant, ICP-filed delivery from inside the mainland, set in front of the public site you already run — no rebuild, no second codebase, and no move off Crownpeak. Our China team weighs your ICP and PIPL data-residency obligations against your entity and the personal data your content, consent tooling and editor accounts hold, then stands up the in-country delivery — and, where the law requires it, the in-country storage — a lawful China presence needs, while your Crownpeak environment stays exactly where it is.
Related reading:
