Does Elucidat Work in China? Learner Data, PIPL & the ICP Door
Elucidat runs no region inside mainland China — it hosts course content and learner data on offshore AWS — so learner personal data collected from the mainland is a PIPL cross-border transfer, and the site serving your courses still owes an ICP filing. A compliance-first look at the doors.
Does Elucidat work in China?
Elucidat courses may open in mainland China, but that was never the compliance question. Elucidat runs no region inside the mainland — in its own words it “hosts data on Amazon Web Services (AWS)” offshore — so every name, progress record and quiz result it collects from a mainland learner is personal data leaving the country, a transfer PIPL governs.
Elucidat’s own documentation sets this out. Its security page states “Elucidat hosts data on Amazon Web Services (AWS)” and that “Elucidat is a multi-tenant environment hosted on AWS servers”; its privacy policy records “specific learner information about use of some public and private elearning courses hosted on Elucidat (including pages accessed, answers to questions, and overall results of courses),” and says that for the courses you build it may be “deemed under applicable law to be your ‘data processor’… where we process personal information controlled by you, on your behalf.” So the learner data crosses the border, and the duty to clear that cross-border transfer under PIPL — notice, separate consent and a transfer mechanism — sits with you, the controller; separately, the site or LMS that serves those courses to mainland learners is what must carry an ICP filing. The table below pairs Elucidat’s own wording with the rule each line triggers.
This is a risk map, not a verdict — which rules bite depends on your entity, your data volumes and who your learners are. Our China team can map your exposure with you →
Compliance snapshot
- ✕ Elucidat runs no mainland-China region — courses and data sit on offshore AWS
- ! Learner personal data leaves the mainland — PIPL cross-border rules apply
- ! For learners you are the controller; the transfer duty falls on you
- ! The site serving the courses to mainland learners still needs an ICP filing
- ! ISO 27001 and GDPR are real — but neither satisfies PIPL or data residency
What Elucidat's own documentation says about China
| Fact | Primary source |
|---|---|
| Elucidat runs on offshore cloud, with no mainland-China region. Its security page states that “Elucidat hosts data on Amazon Web Services (AWS)” and that “Elucidat is a multi-tenant environment hosted on AWS servers,” with its only office a “business HQ in Brighton, England” and “no server infrastructure on site.” Confirm’s sub-processor list — which names the product “Create (formerly Elucidat)” — spreads that AWS hosting across “Multiple regions, depending on product,” and routes “Learner course usage details” to Intercom in the “USA, EEA, and UK.” None of the regions named is inside mainland China, so learner data is stored offshore from the moment it is collected. | Elucidat Security & Confirm Sub-processors (helpcenter.confirm.com; confirm.com), retrieved 2026-10-07 |
| Elucidat collects genuine learner personal data, not just anonymous stats. Its privacy policy records “specific learner information about use of some public and private elearning courses hosted on Elucidat (including pages accessed, answers to questions, and overall results of courses),” and notes that self sign-in courses and elearning files “send a ‘learner_id’, name and on occasions and email address to us.” Gathered from a mainland learner and stored offshore, that is a cross-border transfer of personal information under PIPL (Articles 38–43). | Elucidat Privacy Policy (helpcenter.confirm.com), retrieved 2026-10-07; PIPL Articles 38–43 |
| For the courses you build, you are the data controller — so the cross-border duty is yours. Elucidat’s privacy policy states that for your content it may be “deemed under applicable law to be your ‘data processor’… where we process personal information controlled by you, on your behalf.” Under PIPL the controller — you, the handler — must give notice, obtain separate consent and clear one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification) for the learner data Elucidat holds offshore. Its own safeguards cover transfers “from inside the EEA to third countries” under GDPR, which are not PIPL transfer mechanisms. | Elucidat Privacy Policy (helpcenter.confirm.com), retrieved 2026-10-07; PIPL Articles 38–43 & 40 |
| The site serving your courses to mainland learners still has to be ICP-filed — and offshore Elucidat gives it no footing. Elucidat’s privacy policy describes courses as “hosted on Elucidat” and delivered online through “content delivery networks… at ‘Edge’ locations around the world” — all offshore. A public site shown to mainland visitors turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, which can attach only to a hosting resource inside the mainland. For a CIIO or large-volume handler, learner data collected in China must also be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). | Elucidat Privacy Policy (helpcenter.confirm.com), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33; PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the real question about Elucidat is not whether a course loads — it is where your learners’ data is allowed to live, and what you owe once it leaves the country. Elucidat answers the first half in its own documentation: it runs no region inside mainland China and hosts everything on offshore AWS. A course you publish to Chinese learners may well be reachable, but each name, progress record and quiz result it collects travels out of the mainland — a cross-border transfer of personal information China’s law governs — while the site that delivers those courses still owes an ICP filing it cannot anchor offshore. The delivery is the straightforward half; the data residency and the licensing are the exposure.
Elucidat in China at a glance
| What decides it | In Elucidat's own terms |
|---|---|
| Where it runs | Elucidat “hosts data on Amazon Web Services (AWS)” and keeps “no server infrastructure on site” at its Brighton, England HQ — offshore cloud, with no region inside mainland China. |
| Where your learners' data lives | Confirm's sub-processor list (the product is named “Create (formerly Elucidat)”) places its AWS hosting across “Multiple regions, depending on product,” and sends “Learner course usage details” to Intercom in the “USA, EEA, and UK” — all outside the mainland. |
| What it collects | “Specific learner information… including pages accessed, answers to questions, and overall results of courses,” plus a “learner_id,” name and sometimes email address for self sign-in courses. |
| Who carries the duty | For courses you build, Elucidat acts as your “data processor… where we process personal information controlled by you, on your behalf” — so you are the controller, and the PIPL cross-border duty is yours. |
| Serving the public | A public site delivering your courses to mainland learners needs an ICP filing tied to a mainland host; offshore Elucidat provides no such footing. |
Offshore by design — no mainland region for your learners’ data
Elucidat runs entirely on offshore cloud. Its security page states plainly that “Elucidat hosts data on Amazon Web Services (AWS),” that “Elucidat is a multi-tenant environment hosted on AWS servers,” and that its only office is a “business HQ in Brighton, England” with “no server infrastructure on site.” Its UK parent, Elucidat Ltd, is registered in Reading. (Elucidat is now sold as Create within the Confirm / Learning Pool group, and its compliance pages sit under that umbrella — but the product, and the data flows, are unchanged.) Confirm’s own sub-processor list — where the product appears as “Create (formerly Elucidat)” — spreads that AWS hosting over “Multiple regions, depending on product,” and routes “Learner course usage details” to Intercom in the “USA, EEA, and UK.” Not one of the regions named sits inside mainland China. So the moment a Chinese learner opens one of your courses, the personal data Elucidat records about them is stored outside the country — before performance or reachability enters the picture at all.
The learner data crosses the border — and the duty is yours
Elucidat collects real personal data, not just anonymous counts. Its privacy policy lists “specific learner information about use of some public and private elearning courses hosted on Elucidat (including pages accessed, answers to questions, and overall results of courses),” and adds that self sign-in courses and elearning files “send a ‘learner_id’, name and on occasions and email address to us.” For the courses you build, Elucidat says it may be “deemed under applicable law to be your ‘data processor’… where we process personal information controlled by you, on your behalf” — which makes you the controller. Under China’s Personal Information Protection Law, moving that learner data offshore is a cross-border transfer, and the controller — you, not Elucidat — must give notice, obtain separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–43). Elucidat’s own transfer safeguards are built for Europe — it protects transfers “from inside the EEA to third countries” with adequacy decisions and contractual terms — and those are GDPR mechanisms, not PIPL ones. Meeting one is not meeting the other.
The ICP filing sits on the site that serves the courses
Publishing a course is not the same as being licensed to serve it inside China. Elucidat authors and hosts the content and, in its own words, delivers it online through “content delivery networks… at ‘Edge’ locations around the world” — all offshore. But the public site or LMS that presents those courses to mainland learners is the thing that turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing can attach only to a hosting resource physically inside the mainland. Offshore Elucidat has none, so there is nothing on Elucidat to file against. And if you are a critical information infrastructure operator or a large-volume handler, the learner data collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty no offshore region can satisfy.
This is a risk map, not a verdict: whether you owe a transfer mechanism, in-country storage, an ICP filing, or all three depends on what your courses collect, how many learners you have and who they are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep authoring and publishing in Elucidat exactly as you do now. What an offshore learning platform cannot provide, we add alongside it: compliant, ICP-filed delivery from inside the mainland, set in front of the site that serves your courses — no rebuild, no second codebase, and no move off Elucidat. Our China team traces where your learner data actually flows, works out which PIPL cross-border and data-residency duties fall on you as the controller, and stands up the in-country delivery and storage a lawful China presence needs, while your courses stay exactly where they already live.
Related reading:
Frequently Asked Questions
Is Elucidat blocked in mainland China?
Reachability is not the compliance question here. The issue is not whether a learner can open your course but what happens when they do: Elucidat records their personal data — a ‘learner_id’, name, sometimes email, plus pages accessed, answers and results — and stores it on offshore AWS. That is a cross-border transfer PIPL governs however fast or slow the page loads, and the public site serving the course still owes an ICP filing it cannot anchor offshore.
Elucidat is ISO 27001 certified and GDPR-compliant — isn't that enough for China?
No. Elucidat states it is “ISO 27001:2022 certified” and that it “fully adhere[s] to the General Data Protection Regulation (GDPR),” and both are genuine. But neither answers China's regime. PIPL sets its own cross-border rules — notice, separate consent and a transfer mechanism — and a mainland-facing site needs an ICP filing. EU adequacy decisions and standard contractual clauses are GDPR instruments, not PIPL ones, so China is a separate assessment best worked through with counsel.
Can 21YunBox help us run Elucidat courses compliantly in China?
Yes. Our China team can map where your learner data flows and which PIPL cross-border and data-residency duties fall on you as the controller, then stand up ICP-filed, in-country delivery and storage in front of the site that serves your Elucidat courses — without moving you off Elucidat or rebuilding your content. Get in touch to work through your specific setup.
