Does Delinea Work in China? Data Residency, ICP & Cross-Border Rules

For a security team running privileged access management across its China systems, the instinct is to ask whether the Delinea console answers from inside the mainland. It does — and that is not the question that decides anything. Delinea pulls the single most dangerous dataset you hold into one control plane: the encrypted vault of privileged credentials and secrets, the inventory of privileged accounts, and the recording and audit trail of every privileged session. Whether you can run it for China turns on where that vault comes to rest, and whether placing it there was lawful. That is a data-residency and cross-border question, not a performance one — and Delinea’s own documentation answers the first half.

Delinea offers the vault two ways. Secret Server Cloud and the Delinea Platform are the managed, Azure-hosted editions; Secret Server On-Premises is the self-managed edition you run on infrastructure you control. The cloud editions are where the China question bites, because Delinea publishes exactly where they run — and none of it is the mainland.

Delinea in China at a glance

The vault is the control plane for your China estate

Delinea’s purpose is to pull the most dangerous data in your environment into one hardened place: the privileged credentials and secrets that unlock your systems, and the recording and audit trail of what every administrator did in each privileged session. For your China systems, that store is not just another SaaS dataset — it is the control plane, the single thing an attacker or an auditor would care about most. Two consequences follow, and only the first is obvious.

The obvious one is cross-border transfer. The credentials, secrets and session recordings Delinea holds for identifiable administrators and systems in China are personal information, and keeping them in an Azure region outside the mainland is a cross-border transfer (数据出境) of personal information under China’s Personal Information Protection Law. PIPL puts the duty on the handler — you, not Delinea the processor: Articles 38–40 require a transfer mechanism (a CAC security assessment, the CAC standard contract, or certification), and Articles 13 and 23 require a lawful basis, notice, and a separate consent for the transfer distinct from any general use agreement. The detail of the cross-border mechanics is set out in our note on cross-border data transfers.

The exposure a reachability check never sees

The less obvious consequence is the one that makes a PAM vault different from an ordinary offshore app, and it is invisible to any test that only asks whether the console loads. The vault is a concentrated inventory of the privileged accounts, secrets and access paths into your China estate, and the session logs are the record of exactly who can touch what, and who did. Concentrated security data of that kind can rise to “important data” (重要数据) under China’s data rules — a category whose export faces a heightened security-assessment bar — and the authentication-and-vaulting system that guards critical China systems is the sort of control plane that falls within the Multi-Level Protection Scheme (MLPS / 等级保护), China’s graded cyber-security protection regime. A latency probe, a ping, a “does the page open from Shanghai” check — none of these can see a residency obligation, a cross-border consent gap, an important-data classification, or an MLPS grading. Those are governance facts about where the data lives and what it is, not network facts about whether a packet arrives. Which of them bite your specific deployment is a question to settle with counsel against what you actually vault, record and secure.

Hong Kong is on the list; the mainland is not

The tempting move is to pick the nearest region and call residency solved. Delinea’s hosting list reaches East Asia (Hong Kong) and Southeast Asia (Singapore), and either looks close enough. Neither is in mainland China. Hong Kong operates under its own legal system, and for the mainland’s PIPL and data-localization rules, data held there is still outside the country — so placing a China tenant in Hong Kong relocates the cross-border transfer; it does not end it. Proximity is not residency, and a nearer Azure region is still not a China region.

The deployment choice is a compliance choice

Here is where Delinea differs from a cloud-only vault, and it is the lawful path rather than a workaround. Delinea does not force the managed cloud: Secret Server On-Premises is the self-managed edition — the vault you run on infrastructure you control. Deployed on China-resident infrastructure for your China estate, it keeps the credential-and-secret vault, the privileged-account inventory and the session recordings inside the country, with consented in-country processing — while you keep Secret Server Cloud or the Delinea Platform for the regions where they already serve you. Keeping the China vault in China is therefore a deployment-model decision you are entitled to make with the product as sold; it is a legal design choice before it is a technical one. And for a critical information infrastructure operator, the Cybersecurity Law’s Article 39 (formerly Article 37 — the data-localization provision renumbered by the 2025 amendment that took effect on January 1, 2026, its substance unchanged) makes in-country storage of China-generated personal information a duty an offshore region cannot satisfy in any case.

None of this makes Delinea “blocked” or “illegal” in China — it is reachable and widely used. It is a risk-and-residency map: which obligations bite turns on your entity, the systems you secure, what you vault and record, and who your administrators are — worth settling with counsel before your privileged-access data depends on it.

The lawful path — map, localize, deliver

There is a lawful shape to running privileged access management for a China estate, and it starts with the data, not the network.

First, map. Our China team inventories what Delinea holds for your China systems — which privileged credentials, secrets, vault entries, account records and session recordings were collected or generated in the mainland and must stay there, what (if anything) may lawfully leave, whether what you secure makes that data “important data” or brings a critical-information-infrastructure duty and an MLPS grading into play, and what your notice and separate-consent flow has to cover. The legal conclusions are settled with your counsel; we build the technical picture that feeds them.

Then localize. For the China estate we stand up and integrate Secret Server On-Premises — Delinea’s self-managed vault — on China-resident infrastructure, with consented in-country processing and storage, so the privileged-access data stops leaving the country by default. You keep the Delinea cloud editions for the regions where they already serve you; what changes is that the mainland’s crown-jewels data stays in the mainland, and the control plane that guards it is governed under the rules that apply to it.

Then deliver. Any China-facing console, portal or administrative surface that must be reachable from inside the mainland is itself a service delivered in China, so it carries an ICP filing duty and needs compliant, in-country delivery. 21YunBox delivers it in-country — the 21YunBox Optimizer — in front of what you already run, with no rebuild and no re-platform, so privileged access management runs legally and reliably for your users in China. What we never do — and what no one lawfully can — is hand you a way around China’s data-export rules or any network restriction; we localize what must stay and deliver in-country, and we never move personal information out of China by stealth.

Get a compliance assessment →

Related reading:

• Cross-border data transfers under PIPL
• China’s Personal Information Protection Law
• China’s Cybersecurity Law (data localization, Article 39)
• How to get an ICP filing for China

RELATED TECHNOLOGIES

BeyondTrust

BeyondTrust

Cisco Duo

Cisco Duo

ForgeRock

ForgeRock

Keycloak

Keycloak

Saviynt

Saviynt