Does Deno Work in China? Data Residency, ICP & Cross-Border Rules
Deno's open-source runtime runs fine on a mainland server, so the China question is compliance, not reachability: where you deploy owes an ICP filing and MLPS, the China personal information you process owes PIPL and data-residency rules, and the hosted Deno Deploy service keeps data offshore.
Does Deno work in China?
Yes — the open-source Deno runtime runs fine on a mainland server, so the real question is not whether Deno works but whether your deployment and its data are allowed to sit where they sit.
A Deno app serving mainland users puts its host on the hook for an ICP filing and MLPS duties, and the China personal information it processes falls under PIPL; wiring it to an offshore database or API is a cross-border transfer. The hosted Deno Deploy service is a separate offshore product that keeps your data abroad. 21YunBox stands up an ICP-filed, MLPS-ready in-country footing with China data kept resident, in front of your existing app — no rebuild.
What Deno's own documentation says about China
| Fact | Primary source |
|---|---|
| Deno's own homepage describes it as an "open-source, fully Node-compatible JS runtime" — software you run on your own servers, in any region, including a mainland data centre. | Deno homepage, deno.com, retrieved 2026-10-14 |
| The project's GitHub README calls Deno "a JavaScript, TypeScript, and WebAssembly runtime with secure defaults," built on V8, Rust, and Tokio — a self-contained binary you deploy wherever you choose. | denoland/deno README, GitHub, retrieved 2026-10-14 |
| Under the Personal Information Protection Law, providing personal information collected in China to a recipient outside the mainland is a cross-border transfer requiring a lawful basis, separate consent, and an approved transfer mechanism — obligations borne by the data handler, i.e. the app operator. | Personal Information Protection Law (PIPL), Articles 38–39, effective 2021-11-01, retrieved 2026-10-14 |
| For critical information infrastructure operators and large-volume handlers, personal information collected in China must be stored within the mainland under the Cybersecurity Law, Article 39 (formerly Article 37). | Cybersecurity Law of the PRC, Article 39 (formerly Article 37), retrieved 2026-10-14 |
Sources verified by the 21YunBox compliance team on 2026-10-14.
The honest answer starts by narrowing the question. Deno is open-source software you compile to a single binary and run on your own servers. It does not phone home for your application data, it stores nothing offshore on its own, and it behaves the same in a Shanghai data centre as in a Frankfurt one. There is no “Deno region” to get wrong. So “Does Deno work in China?” is not really a question about the runtime at all — the runtime runs fine. It is a question about where you deploy it and what data it handles, and those are governed by China’s compliance regime, not by whether the binary executes.
That distinction matters because the usual test — can I install it, does my site load — answers the wrong question. A Deno service can load quickly for users in Shanghai and still be out of compliance. The exposure is not latency; it is whether the deployment and its data were allowed to sit where they sit.
What actually makes this a China question
Three deployment and data questions carry the entire compliance weight — and they are the second half a reachability check can never answer for you:
1. Where the server runs. If your Deno app serves mainland users, its host owes an ICP filing (备案) on a mainland hosting resource, and the system carries MLPS (等级保护) obligations with you as the operator. An offshore VM that mainland users reach is the real exposure — and that is a deployment choice, not a property of Deno.
2. What data it processes. The database behind your app and the personal information it collects from China users are what PIPL governs. A Deno backend wired to an offshore database, or forwarding China users’ personal information abroad, performs a cross-border transfer (数据出境): you need notice, a lawful basis, and a transfer mechanism. For a critical information infrastructure operator or a large-volume handler, China personal information must be stored in the mainland under the Cybersecurity Law, Article 39 (formerly Article 37).
3. Its outbound dependencies. Deno resolves modules and npm packages, and ships crash and usage telemetry, to endpoints that sit offshore by default. Those build-time and run-time pulls are a supply-chain and residency concern that rides along with the runtime, independent of where you host the app itself.
One product to separate out: Deno Deploy. Deno Deploy is Deno’s own hosted, serverless platform — “use our infrastructure,” in Deno’s words — not the self-hosted runtime. It runs your code on Deno’s managed infrastructure, which names no mainland-China region, so for a China-facing application it keeps execution and data offshore with no ICP filing on the mainland. This page is about the self-hostable runtime, which has a clean in-country path; Deno Deploy is simply the offshore-hosted option to keep off a China-facing deployment.
| Layer in a Deno deployment | What actually governs it in China |
|---|---|
| The open-source Deno runtime | Runs identically on a mainland server. It is self-hosted software — nothing here is blocked, and it is not the residency question. |
| Where the app is hosted | If it serves mainland users, the host owes an ICP filing (备案) on a mainland resource and carries MLPS (等级保护) duties, with you as the operator. |
| The database and user PII | China personal information falls under PIPL. CIIO and large-volume handlers must keep it in the mainland (Cybersecurity Law, Article 39, formerly Article 37). |
| Offshore database or API calls | Sending China users' personal information abroad is a regulated cross-border transfer: lawful basis, separate consent, and a transfer mechanism. |
| npm / module pulls and telemetry | Resolve to offshore endpoints at build and run time — a supply-chain and residency item that rides along with the runtime. |
| Deno Deploy (hosted service) | A separate offshore product that runs your code and holds data on Deno's own infrastructure, with no mainland ICP filing. Avoid it for a China-facing app; self-host the runtime instead. |
Why a reachability check misses all of this
Run a check that only asks whether Deno installs and whether the page renders, and every answer comes back green — while the two things regulators actually look at go unmeasured. Whether the binary executes tells you nothing about whether the host is ICP-filed, whether MLPS duties were met, or whether China users’ personal information crossed a border without a lawful basis. Reachability is a property of the network path; compliance is a property of where the deployment and its data come to rest, and on what legal basis. That second half is exactly what an answer leading on speed or “does it load” cannot settle for you.
The compliant path: map, localize, deliver
Map. We inventory every point where your Deno app and its data touch China — host location, database, the personal information you collect, cross-border API calls, and outbound package and telemetry endpoints — against ICP, MLPS, PIPL, and the data-localization rules.
Localize. We run the Deno runtime in-country on ICP-filed, MLPS-appropriate infrastructure, keep China user data resident, and move offshore database, API, and telemetry paths onto compliant in-country equivalents. This is lawful placement of your workload, never a workaround of any control.
Deliver. 21YunBox stands up that in-country footing and the China-facing surface in front of your existing Deno app — no rebuild, no re-platform.
Deno’s runtime is not what stands between your application and China. Your deployment location, your data, and your dependencies are — and those are fixable with the right in-country footing rather than a change to your code. Get a compliance assessment and we will map where your Deno app and its data stand today and what a lawful China-facing deployment looks like.
