Does ForgeRock Work in China? Data Residency, ICP & Cross-Border Rules
ForgeRock (now part of Ping Identity) is the login gate and identity graph for your China users — workforce and consumer (CIAM) identities, entitlements, MFA factors and access logs. Its PingOne Advanced Identity Cloud SaaS has no mainland-China region, so that identity data sits offshore: a PIPL cross-border and data-residency matter. ForgeRock also ships as self-managed software you can run in-country. A compliance-first look at residency, ICP and the identity control plane.
Does ForgeRock work in China?
Whether ForgeRock works in mainland China is first a data-residency and access-governance question, not a speed one. ForgeRock (now part of Ping Identity) is the login gate and identity graph for your China users — it authenticates every workforce and consumer (CIAM) identity and holds the entitlement map of who-can-access-what across your China operation.
Its PingOne Advanced Identity Cloud SaaS lists data regions across the Americas, Europe, the Middle East, Asia (Hong Kong, Singapore, Jakarta, Mumbai) and Australia — none in mainland China — so that identity data comes to rest offshore: a cross-border transfer of personal information PIPL governs, and, because the identity graph is the concentrated blueprint of your China access, a security-governance exposure (MLPS / 重要数据) a reachability check never sees. A China-facing login or registration surface also needs an ICP filing.
ForgeRock also ships as self-managed software you can run in-country, which is the lawful lever. Our China team can map your ForgeRock exposure with you →
What ForgeRock's own documentation says about China
| Fact | Primary source |
|---|---|
| In Ping's own "Data regions" documentation: "Ping Identity provides PingOne Advanced Identity Cloud capabilities at worldwide geographic locations, or regions." The listed regions span Canada, the United States, Brazil, Europe, the Middle East, Asia — Hong Kong, Singapore, Jakarta and Mumbai — and Australia, with no mainland-China region. So a China operation's workforce and consumer identities, MFA factors, sessions and access logs come to rest offshore. | Ping Identity — PingOne Advanced Identity Cloud, Data regions, retrieved 2026-10-12 |
| ForgeRock also ships as self-managed software — PingAM, PingDS and PingIDM (formerly ForgeRock Access Management, Directory Services and Identity Management) that you install and run on your own infrastructure. Ping's deployment docs state the platform "offers maximum extensibility and flexibility in self-managed deployments," presenting the hosted SaaS only as an alternative. That self-managed path is the residency lever: run it on China-resident infrastructure and the identity data can stay in the mainland. | Ping Identity — ForgeRock Identity Platform, self-managed deployment, retrieved 2026-10-12 |
| ForgeRock holds personal information — workforce and consumer identities, authentication and MFA factors, sessions, and access/audit logs. Collecting it in China needs PIPL Article 13/23 notice and separate consent; sending it offshore is a cross-border transfer under Articles 38–40 needing a transfer mechanism. Biometric or ID-document MFA factors are sensitive personal information (Articles 28–29), and risk-based or automated access decisions that profile individuals engage Article 24 on automated decision-making. | PIPL Articles 13, 23, 24, 28–29, 38–40 |
| For a critical information infrastructure operator or a high-volume handler, personal information generated in China must be stored inside the mainland — Cybersecurity Law Article 39 (formerly Article 37); the 2025 amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39 with its substance unchanged. An offshore-only SaaS region list cannot meet this; a self-managed, in-country deployment can. | Cybersecurity Law of the PRC, Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-12.
Whether a ForgeRock login screen renders quickly from Shanghai is an operations detail, not the thing that decides whether it works in China. ForgeRock — now part of Ping Identity — is the single access gate and identity graph for your China users: it authenticates every workforce employee and, through its customer identity (CIAM) side, every consumer who registers or logs in, and it holds the entitlement map of who may reach what across your China operation. What decides it is a compliance-risk question — where those identities, MFA factors and access logs are stored, under what consent, whether the identity control plane is governed, and whether a China-facing login surface is ICP-filed.
ForgeRock can run two ways, and under Chinese law they land in very different places. As PingOne Advanced Identity Cloud (the hosted SaaS, formerly ForgeRock Identity Cloud) it has no mainland-China region — Ping’s own Data regions documentation lists hosting across Canada, the United States, Brazil, Europe, the Middle East, Asia (Hong Kong, Singapore, Jakarta and Mumbai) and Australia, but nothing in mainland China — so a China operation’s identity data is held and processed offshore. ForgeRock also ships as self-managed software — PingAM, PingDS and PingIDM that you install and run on your own infrastructure — and that is the lever that opens a lawful in-country path. So the honest answer is not a flat “no”: it is offshore SaaS is the exposure; in-country self-managed deployment is the fix.
What ForgeRock actually holds — the identity graph and the access gate
An access-management and CIAM platform concentrates the most sensitive dataset you have, and ForgeRock holds several layers of it at once. First, the identity directory: your workforce accounts and, on the CIAM side, the consumer identity graph at scale — every China customer who registers or signs in, with their profile and account data. Second, the authentication and MFA factors: passwords, device-trust signals, push tokens, and any biometric or ID-document factors used to verify a person. Third, the entitlements and roles — the map of who-can-access-what across your China systems. Fourth, the sessions, tokens and access/audit logs that record who reached what, when. Held offshore, that is the concentrated blueprint of your China identity estate and the one gate standing in front of everything else.
The doors: residency, the identity-graph second half, automated decisions, sensitive factors and ICP
Workforce and consumer identity data, offshore. Running the SaaS for a China operation puts your employees’ and — through CIAM — your consumers’ personal information on an offshore cloud. Collecting it needs the PIPL Article 13/23 notice and separate consent; sending it abroad is a cross-border transfer under Articles 38–40, which needs a transfer mechanism. For a critical information infrastructure operator or a high-volume handler, the Cybersecurity Law’s Article 39 (formerly Article 37 — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, with its substance unchanged) requires personal information generated in China to be stored in the mainland, which an offshore-only region list cannot do.
The identity graph and entitlement map are a concentrated security-governance exposure — the half a reachability check never sees. This is not only a privacy matter. The directory, the entitlement/role map and the access logs together are the blueprint of who-can-access-what across your China operation, and the identity provider is the single control plane guarding everything behind it. Sitting in one offshore record, that is both a cross-border data issue and, for a sensitive operation, may raise the “important data” (重要数据) question and the Multi-Level Protection Scheme (MLPS / 等级保护) duties that attach to the system that authenticates and authorizes your China estate. Treat that as a risk to confirm with counsel rather than a settled classification — but it is exactly the risk that “does the login page load?” testing is blind to.
Automated and risk-based access decisions. ForgeRock’s adaptive/risk-based authentication and automated access or certification decisions act on the data above, and where they profile or decide about individuals they engage PIPL Article 24 on automated decision-making — the individual may refuse a decision made solely by automation, and profiling must offer an option not targeted at their personal characteristics.
Biometric and ID-document factors are sensitive personal information. Where your flows use biometric verification or ID-document capture as an authentication factor, those are sensitive personal information under PIPL Articles 28–29 — handled only for a specific purpose, with demonstrated necessity and separate consent, and moving them across the border raises the bar rather than lowering it.
ICP filing for the China-facing login or registration surface. A login or registration page served to mainland visitors — the CIAM front door especially — is an internet information service and needs an ICP filing bound to mainland hosting (State Council Order No. 292; MIIT Order No. 33). Making an offshore identity service merely reachable does not satisfy this.
ForgeRock in China at a glance
| What decides it | In ForgeRock's own terms — and China's law |
|---|---|
| Where it runs | As PingOne Advanced Identity Cloud (SaaS), ForgeRock has no mainland-China region — Ping's Data regions documentation lists Canada, the United States, Brazil, Europe, the Middle East, Asia (Hong Kong, Singapore, Jakarta, Mumbai) and Australia. For a China operation those regions are all offshore. ForgeRock also ships as self-managed software (PingAM, PingDS, PingIDM), which is the in-country alternative. |
| What it holds | Your workforce directory and, on the CIAM side, the consumer identity graph at scale — every China user who registers or logs in — plus authentication and MFA factors, entitlements and roles, and the sessions, tokens and access/audit logs of who reached what. The most security-sensitive dataset you have, and the gate in front of everything else. |
| The security-governance second half | The identity graph and entitlement map are the blueprint of who-can-access-what across your China operation, concentrated in one offshore control plane. That is both a cross-border data issue and, for a sensitive operation, may raise the "important data" (重要数据) question and MLPS (等级保护) duties on the identity provider — a risk to confirm with counsel, and the half a reachability review never sees. |
| Automated & sensitive factors | Adaptive/risk-based and automated access or certification decisions that profile individuals engage PIPL Article 24 (the right to refuse decisions made solely by automation). Biometric or ID-document authentication factors are sensitive personal information under PIPL Articles 28–29, held to a higher bar. |
| Residency, consent & ICP | Workforce and consumer identity PII offshore is a cross-border transfer (PIPL Articles 13/23 and 38–40); for a CIIO or high-volume handler, personal information generated in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). A China-facing login or registration surface needs an ICP filing bound to mainland hosting. |
| The in-country lever | Because the ForgeRock Identity Platform is self-managed software, you can run PingAM, PingDS and PingIDM on China-resident infrastructure and keep the identity data, MFA factors and access logs in the mainland — the lawful path, not a delivery workaround. |
| Reachability is not the axis | Whether a ForgeRock login loads quickly from the mainland is operational, not the compliance question. What decides it is where your identities and access logs live, that the identity control plane is governed, and that the login surface is ICP-filed. 21YunBox keeps the data in-country, helps with the Article 24 and sensitive-factor duties, and ICP-files the China-facing surface — in front of what you already run. |
Loading fast isn’t the answer — in-country identity data is
A reachability check confirms one thing: that the login screen renders from the mainland. It cannot see where your workforce and consumer identities live, it cannot see that the entitlement map and access logs — the blueprint of who can reach what across your China estate — are sitting offshore, and it cannot see whether the China-facing login or registration surface is ICP-filed. Making an offshore ForgeRock tenant merely reachable leaves the identity data offshore and the control plane ungoverned; it changes the latency, not the compliance position. That is why the answer is residency, not delivery tricks: keep the identity data in-country and govern the gate.
The lawful path — map, localize, deliver
Map. Inventory what your ForgeRock estate holds — workforce and consumer identities, authentication and MFA factors (including any biometric or ID-document factors), entitlements and roles, sessions and access/audit logs, and any China-facing login or registration surface — where each runs today, your ICP status, whether the identity control plane is MLPS-relevant, and the consent and residency basis you rely on.
Localize and govern. Keep the regulated identity data and access logs in-country. Because the ForgeRock Identity Platform is self-managed software, you can deploy PingAM, PingDS and PingIDM on China-resident infrastructure and keep that data in the mainland; pair it with the Article 13/23 notice and separate consent, an Article 24 opt-out for automated access decisions, sensitive-PI handling for biometric or ID-document factors, and the MLPS / 重要数据 controls the identity control plane warrants.
Deliver. ICP-file any China-facing login or registration surface, and put compliant, in-country delivery in front of what you already run. 21YunBox stands this up in front of your existing ForgeRock deployment — no rebuild, and no migration of the product itself.
21YunBox never uses or suggests circumvention of any kind — we keep in-country what the law says must stay, deliver the rest compliantly from inside the mainland, and never move identity data across the border by stealth.
To scope your ForgeRock China setup and get a quote for the in-country path, reach out to our China compliance team.
Related reading:
- Cross-border data transfers under PIPL
- China’s Cybersecurity Law (data localization, Article 39 / formerly 37)
- China’s Personal Information Protection Law (PIPL)
- How to get an ICP filing for China
