Does Directus Work in China? Data Residency, PIPL & the In-Country Self-Hosting Path
Directus is reachable from mainland China, so the real question isn't speed — it's where the database behind it lives and whether that's lawful. On Directus Cloud your admin app, editor accounts and the personal data in your collections sit in an offshore region (the US, Europe or Asia Pacific — none in mainland China), making that storage a PIPL cross-border transfer, while any China-facing site it serves needs an ICP filing. Because Directus is self-hostable, the clean in-country path is a self-hosted Directus and database on China-resident, ICP-filed infrastructure.
Does Directus work in China?
Reachability isn't the obstacle — Directus is callable from mainland China, whether you self-host it or run it on Directus Cloud. What decides the China question is where the database behind it lives, and whether that is lawful.
Directus is a headless CMS and data platform that layers over your SQL database, so it holds whatever your collections contain — often real application data and personal information (user records, form submissions) plus editor accounts. On Directus Cloud those sit in one region fixed at project creation; the Cloud docs' Datacenter Region choices span the United States, Europe (Frankfurt) and Asia Pacific (Singapore), with none inside mainland China. Keeping that data offshore is a cross-border transfer under PIPL (notice, a separate consent and one transfer mechanism, Articles 38–40), with an in-country storage duty for a CIIO or large-volume handler (PIPL Article 40; Cybersecurity Law Article 39, formerly Article 37), and any China-facing site it powers needs an ICP filing.
Because Directus is self-hostable, the clean in-country answer is a self-hosted Directus and database on China-resident, ICP-filed infrastructure — the data stays in the mainland by design. 21YunBox maps, localizes and delivers in-country, and never uses or suggests circumvention of any kind. Treat the specifics as a risk to confirm with counsel. Our China team can map your exposure with you →
What Directus's own documentation says about China
| Fact | Primary source |
|---|---|
| Directus Cloud runs your project in one offshore region — none inside mainland China. Its own Cloud documentation lists the Datacenter Region choices as “United States, East”, “Europe, Frankfurt” or “Asia Pacific, Singapore”, notes the enterprise tier adds more locations across the US, Europe, Asia Pacific, Canada, Africa and South America, and says “the location you choose to host your project in can have a measurable impact.” Not one of those regions is in mainland China, so a Cloud project — admin app, database and data API — is hosted offshore. | Directus, “Create a Project” — Cloud documentation (directus.com), retrieved 2026-10-09 |
| Directus is self-hostable, which is the lever that keeps China data in-country. Its own docs state that “Self-hosting Directus means running the Directus software on your own infrastructure,” that “As Directus is provided as a Docker image, you can deploy it on many different platforms,” and that doing so gives “full control over your data, hardware, and deployment configuration.” (Directus is source-available under its Monospace Sustainable Core License, not an unrestricted open-source license.) So a self-hosted Directus and database can sit on China-resident, ICP-filed infrastructure by design. | Directus, “Self-Hosting Overview” and “Licensing Overview” (directus.com), retrieved 2026-10-09 |
| China-collected records held in an offshore Directus are a PIPL cross-border transfer. Moving personal information collected from users in mainland China to a database hosted outside the mainland — a Directus Cloud region, or any self-managed instance abroad — triggers PIPL Articles 38–40: notice, a separate consent distinct from any general product agreement, and one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). The duty falls on you as the handler, not on Directus. | Personal Information Protection Law of the PRC, Articles 38–40 (cac.gov.cn), retrieved 2026-10-09 |
| For some handlers the data must stay in China — and serving a public site from inside the mainland triggers an ICP filing. Where the handler is a critical information infrastructure operator or moves personal information at volume, data collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39, formerly Article 37) — which no offshore region satisfies. And any public site actually served from inside China must carry an ICP filing (State Council Order No. 292; MIIT Order No. 33) bound to an in-country hosting resource a hosted offshore backend cannot provide. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37); State Council Order No. 292; MIIT Order No. 33, retrieved 2026-10-09 |
Sources verified by the 21YunBox compliance team on 2026-10-09.
For a site or product aimed at mainland China, the deciding question about Directus is not how quickly its admin panel paints or whether its API answers from Shanghai — it usually does. Directus is a headless CMS and data platform that sits as a thin layer over your SQL database, so what matters is where that database lives and whether the personal information inside it is allowed to live there. Under Chinese law that is a data-residency and licensing question, and it is settled before performance ever enters the picture. Directus can give you a clean answer — but which answer depends entirely on which of its two deployment models you run.
Directus in China at a glance
| What decides it | In Directus's own terms — and China's law |
|---|---|
| What it is | Directus is a self-hostable headless CMS and data platform — a layer over your SQL database, with an admin app, authentication and a content/data API. It holds whatever your collections contain: often real application data and personal information (user records, form submissions), plus admin and editor accounts. |
| Where it runs | Two deployment models decide where that data lives. Self-hosted, it runs on infrastructure you control. On Directus Cloud it runs in one region fixed at project creation; the Cloud docs' Datacenter Region choices span the US, Europe (Frankfurt) and Asia Pacific (Singapore) — the nearest being Singapore — with none inside mainland China. |
| Your China users' data | Records about people in China are personal information. Held in an offshore Cloud region, their storage is a cross-border transfer PIPL governs (Articles 38–40): notice, a separate consent, and one transfer mechanism — with an in-country storage duty for a CIIO or large-volume handler no offshore region can meet. |
| Serving the public | Any China-facing site or app Directus powers, served from inside the mainland, needs an ICP filing bound to an in-country hosting resource. A hosted backend with no mainland region is not what gets filed — the public surface you run on it is. |
| The in-country path | Because Directus is self-hostable, a self-hosted Directus and database on China-resident, ICP-filed infrastructure keep the data in the mainland by design, while you keep Directus Cloud for your other markets. |
Reachable — so the real test is where your database lives
Whether the Directus API can be reached from the mainland is rarely the hard part; self-hosted or on Directus Cloud, it is callable from China and is not a service blocked at the border. For that reason this page publishes no first-party China latency figure for Directus — speed is not the axis for a decision that turns on residency, consent and licensing. One operational temptation is worth naming only to set it aside: when a cross-border connection to an offshore instance is inconsistent, the instinct is to force it through a network workaround. 21YunBox neither uses nor suggests any form of circumvention — it is both a compliance risk and beside the point. The productive question is where your China-collected data sits, and whether it had a lawful basis to be there.
Door one — on Directus Cloud, your database and accounts sit offshore
Directus Cloud is the managed home for the whole Directus application: the admin app your editors sign in to, the content database, the file library and the data API your frontend calls, all in one region chosen when the project is created. In its own Cloud documentation those Datacenter Region choices are “United States, East”, “Europe, Frankfurt” or “Asia Pacific, Singapore”, with the enterprise tier adding more locations across the US, Europe, Asia Pacific, Canada, Africa and South America — and Directus notes that “the location you choose to host your project in can have a measurable impact.” Not one of those regions is inside mainland China, and the region is fixed at creation, so there is no later toggle that brings the backend onto Chinese soil.
Because Directus layers directly over your database, what sits in that offshore region is rarely just published copy — it is the user records, form submissions, author profiles and editor accounts your collections hold, often the real personal data behind a live application. For people in China, that storage location is the whole question. Keeping their personal information in an offshore region is a cross-border transfer under China’s Personal Information Protection Law, and the duty lands on you as the handler, not on Directus: notice, a separate consent, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–40). Above certain volume or sensitivity thresholds that transfer can also require China’s data-export security assessment before anything leaves. And if you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) — the data-localization provision was renumbered by the 2025 amendment that took effect on January 1, 2026, its substance unchanged) — a residency duty no offshore Cloud region can satisfy.
Door two — the public surface Directus powers needs an ICP filing
A headless CMS is only ever half of what a visitor touches; the other half is the site or app you build on top of its API. When that public surface is served to mainland visitors from inside China, it turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, bound to a hosting resource physically inside the mainland. A hosted backend with no mainland region is not the thing that gets filed — the public application you run on it is. So “we already run Directus” does not carry into China on its own: reaching the data API from Shanghai is not the same as being cleared to operate a mainland site.
The strong card — Directus is self-hostable, so the data can stay in-country
Here is where Directus sits in a better position than a cloud-only backend. It does not have to run on someone else’s offshore region. Its own docs are plain that “Self-hosting Directus means running the Directus software on your own infrastructure,” that “As Directus is provided as a Docker image, you can deploy it on many different platforms,” and that doing so gives you “full control over your data, hardware, and deployment configuration.” (Directus is source-available under its Monospace Sustainable Core License and self-hostable; it is not an unrestricted open-source project, so confirm your license footing for your organization.)
That control is exactly the lever China compliance needs. A self-hosted Directus and its database, standing on China-resident, ICP-filed infrastructure, keep the personal data in your collections inside the mainland by design — no cross-border transfer to clear for that data, and a hosting resource an ICP filing can actually attach to — while you keep Directus Cloud for the markets where it already serves you. Whether you owe in-country storage, a transfer mechanism, an ICP filing, or some combination is a risk that turns on your entity, what your collections actually hold and at what volume, your role as handler, and who your users are — worth settling with counsel before you build on it.
The lawful path — map, localize, deliver
There is a compliant way to run Directus for China, and it follows the shape of the product. First, map: our China team works through your PIPL and residency exposure — which collections hold personal information gathered in China, what must stay in the country, what may lawfully leave, where a data-export assessment or an Article 39 storage duty bites, and where an ICP filing is owed. The legal conclusions are settled with counsel; we build the technical picture that feeds them.
Then localize: we stand up and integrate a self-hosted Directus and database on China-resident, ICP-filed infrastructure for the China entity, so the data the mainland requires to stay, stays — by design, not by workaround — while your other markets keep running on Directus Cloud or your existing instance.
Then deliver: the China-facing site or app built on that Directus is itself a public service in the mainland, so it carries the ICP duty and needs compliant, in-country delivery. 21YunBox delivers it in-country — the 21YunBox Optimizer — set in front of what you already run, with no rebuild and no re-platform. The result is a Directus stack that runs legally and compliantly for your users in China. What we never do — and what no one lawfully can — is hand you a route around China’s data-export rules or around any network restriction: we localize what must stay and deliver in-country, and we never move personal information out of China by stealth.
Related reading:
- How to get an ICP filing for China
- Cross-border data transfers under PIPL
- China’s Cybersecurity Law (data localization, Article 39)
- China’s data-export security assessment
