Does Cypress Work in China? Data Residency, ICP & Cross-Border Rules
Cypress is an open-source test runner you run yourself, so the question is residency, not reachability. A run carries your app build, test data and run recordings; executed offshore or sent to the optional Cypress Cloud, that data crosses the border under PIPL. Running it in-country is the lever.
Does Cypress work in China?
Whether you can use Cypress in China is a data-residency question, not a reachability one. Cypress is an open-source test runner you install and run yourself, so it runs wherever you put it — the mainland included. What matters is where you run it and where the run's recordings go.
Each run exercises your application build, executes your test code and feeds in fixtures that are routinely production-like and can contain personal information, then produces artifacts — screenshots and videos of your app rendering that data, plus console and network logs. Run Cypress in offshore CI and that app build, those fixtures and those recordings live abroad; send recordings to the optional, offshore Cypress Cloud and that is a cross-border transfer of personal information PIPL governs — notice, separate consent, a transfer mechanism, and for a CIIO or large-volume handler, in-country storage.
This is a risk picture, not a verdict — your obligations turn on what your fixtures and recordings contain and your role as handler. Our China team can map where your test runs actually live →
What Cypress's own documentation says about China
| Fact | Primary source |
|---|---|
| In Cypress's own words, the product comes in two parts: "Cypress App, a free, open source, locally installed app for writing and running tests," and "Cypress Cloud, a paid service for recording tests, surfacing test results, and providing test analytics." So the runner that executes your tests is software you install and operate yourself — it runs wherever you put it, the mainland included, with no vendor-fixed region. | Cypress Docs — Why Cypress? (Products), retrieved 2026-10-13 |
| Recording a run is a separate, optional step, not part of executing tests. Cypress describes Cypress Cloud as "the companion service to the open-source Cypress app," where "Each test run is stored in Cypress Cloud." So your app build, fixtures and the screenshots and videos a run produces stay on the infrastructure you run — unless you choose to send recordings to that offshore service, which puts them abroad. | Cypress Docs — Cypress Cloud introduction, retrieved 2026-10-13 |
| Test fixtures routinely hold production-like or real records, and a run's screenshots and videos capture your app rendering them — personal information under the Personal Information Protection Law. Produced in China and executed in offshore CI or sent to the offshore recording service, that is a cross-border transfer PIPL governs: the handler (you, not Cypress) owes notice, separate consent, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–40). | PIPL, Chapter III (Articles 38–40) — 21YunBox translation, retrieved 2026-10-13 |
| If you are a critical information infrastructure operator or a large-volume handler, personal information gathered in China must be stored inside the mainland (Cybersecurity Law Article 39 (formerly Article 37), renumbered by the 2025 amendment effective January 1, 2026; PIPL Article 40), and a test-report dashboard you expose to users inside China needs an ICP filing tied to mainland hosting. Running Cypress in-country answers residency; it does not by itself answer consent, transfer or filing. | Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40 — 21YunBox translation, retrieved 2026-10-13 |
Sources verified by the 21YunBox compliance team on 2026-10-13.
For a team serving mainland China, the useful question about Cypress is almost never whether it runs — it is an open-source test runner you install and operate yourself, so it runs wherever you put it, the mainland included. The question is where your test runs live. A single Cypress run exercises your application build — your proprietary front- and back-end code — executes your test code, feeds in test data and fixtures that are routinely production-like (real-looking names, emails and payment fields, sometimes copies of real records), and produces artifacts: screenshots and video recordings of your app rendering that data, plus console and network logs. Whether a test can reach a page is the delivery half; where your app build, your fixtures and those recordings come to rest is the exposure.
That second half is the part a connectivity test never sees. Because Cypress is software you run, the residency outcome is decided by two choices you make: where you execute the run — a developer’s machine, a self-managed CI runner, or someone else’s cloud — and whether you send the run’s recordings to Cypress Cloud, the optional, hosted companion service that records tests. Run Cypress in an offshore CI pipeline and your app build, your production-like fixtures and the screenshots and videos of each run already live abroad; opt in to the hosted recording service and those artifacts are uploaded offshore on top. Nothing about Cypress forces that — which is exactly why the residency decision is yours to get right.
Cypress in China at a glance
| What decides it | In Cypress's own terms — and China's law |
|---|---|
| Where you run Cypress | An open-source runner you install and operate yourself. It runs wherever you put it — your own machines or CI — so there is no vendor-fixed region, and nothing sits in the mainland by default unless you choose to run it in-country. |
| What a test run carries | Your application build (proprietary code), your test code, and test data or fixtures that are routinely production-like — real-looking names, emails and payment fields, sometimes copies of real records. That is personal information, not synthetic noise. |
| The artifacts it produces | Screenshots and video recordings of your app rendering that data, plus console and network logs. Those recordings capture identifiable data exactly as your app displays it. |
| The optional offshore pull | Cypress Cloud is a separate, optional hosted service that records runs. Sending recordings there ships those artifacts out of China — but running tests never requires it. |
| Your China runs executed or stored offshore | Run in offshore CI, or recorded to the hosted service, the app build, fixtures and recordings leave the mainland — a cross-border transfer PIPL governs; a CIIO or large-volume handler also owes an in-country storage duty. |
| The residency lever | Because you operate Cypress, running it in your in-country CI and keeping recordings in-country keeps the app build, test data and artifacts resident — though the PIPL consent, transfer and ICP duties then fall to you. |
| Is it reachable? | Treat reachability as the delivery half, not the question. The exposure is where your app build, test data and recordings live, not whether the test can reach a page. |
Cypress is yours to run — and so is where your test runs live
Because Cypress is open-source software you operate, there is no vendor region to accept or regret — the execution location is entirely yours. Its documentation describes the product in two parts: “Cypress App, a free, open source, locally installed app for writing and running tests,” and, separately, “Cypress Cloud, a paid service for recording tests, surfacing test results, and providing test analytics.” The part that actually runs your tests is the one you install and operate; the hosted service only records what the runner produces. So run Cypress on infrastructure physically in the mainland — a developer’s machine or a self-managed CI runner in-country — and your app build, your fixtures and the artifacts each run captures can stay resident; run it in an offshore pipeline, and every run you execute for China is leaving the country. (Fully hosted, offshore test clouds that run your app on their own devices are a separate matter; this page is about the open-source runner you execute yourself.)
The data a Cypress run carries is personal information
A test run is not anonymous machine traffic. It exercises your application build against data, and test fixtures are routinely production-like — real-looking names, emails and payment fields, sometimes straight copies of real records. The run then produces artifacts that photograph exactly what your app shows: screenshots and video recordings of your pages rendering that data, plus console and network logs. A mainland user’s identifier sitting in a fixture, or visible in a run recording, is already personal information under China’s Personal Information Protection Law. Teams reach for masking — synthetic fixtures, redacted recordings — and it is worth doing. But it answers the wrong half: masking a field changes what a run carries, not where the run executes or where its recordings come to rest. A redacted-but-still-identifiable recording uploaded to an offshore service is still a cross-border transfer; masking lowers exposure, it does not make an offshore destination lawful.
Cross-border transfer, in-country storage, and the China-facing report
Execute a run inside the mainland and ship its app build, fixtures or recordings to CI or a recording service hosted abroad and you have a cross-border transfer the law governs. Under the Personal Information Protection Law the handler — you, not the Cypress project — must give notice, obtain a separate consent for the export, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–40). If you are a critical information infrastructure operator or a large-volume handler, personal information gathered in China must also be stored in the mainland (Cybersecurity Law Article 39 (formerly Article 37), renumbered by the 2025 amendment that took effect on January 1, 2026; PIPL Article 40). And a test-report or results dashboard you expose publicly to users inside China needs an ICP filing tied to a mainland hosting resource. Running Cypress in-country answers the residency question; it does not, on its own, answer consent, transfer or filing.
This is a risk map, not a verdict. Whether you owe a transfer mechanism, a separate consent, in-country storage, an ICP filing, or some combination turns on what your fixtures and recordings actually contain, how much of it is personal, your role as handler, and who your users are — worth settling with counsel before you point a CI pipeline or a recording service at any run.
Why a reachability check misses this
A speed-or-reachability test asks whether Cypress can install, fetch its browser and open a page from Shanghai. All of that usually passes — the runner starts, the browser launches, the test steps through. What that check never sees is where your application build executed, where your production-like fixtures were fed in, and where the screenshots and videos of each run came to rest. The exposure is not latency; it is proprietary code, personal-information fixtures and run recordings produced in China and executed or stored offshore, plus a residency duty that no amount of masking can satisfy. That is the half a reachability probe structurally cannot measure — and the half that decides whether your testing is compliant.
The lawful path — map, localize, deliver
You do not have to give up Cypress to run it compliantly for mainland China. There are three moves, and they fit together.
Map. Our China compliance team inventories your test runs — which carry your proprietary application build, which fixtures hold production-like or real personal information, where each run actually executes, and where its screenshots, videos and logs are stored. We separate the offshore runs from what you already run yourself, so the exposure is written down before anything is rewired.
Localize. Where runs must stay resident, we put the execution in-country — the open-source runner in your in-country CI, on a self-managed grid of browsers and runners you control — so the app build, the test data and the artifacts stay in the mainland, and only what is lawful to export ever leaves.
Deliver. In front of or in place of an offshore test cloud, 21YunBox stands up the compliant in-country test grid and execution footing — no rebuild, no second codebase, no move off Cypress — and provides ICP-filed, in-country delivery for any China-facing results dashboard. 21YunBox never uses or suggests circumvention of any kind; the entire point is a lawful, filed, in-country path.
The goal is plain: your tests run legally and compliantly for the app your users reach in China.
Related reading:
- How to get an ICP filing for China
- Cross-border data transfers under PIPL
- China’s Personal Information Protection Law
- China’s Cybersecurity Law and data localization
