Does Gitea Work in China? Data Residency, ICP & Cross-Border Rules
Gitea is open-source, self-hosted Git software you can run on mainland-China infrastructure — the lawful lever. The question isn't whether it loads but where the repositories, secrets and build state it holds rest: hosted offshore, your source code and any China PII sit abroad, a PIPL cross-border transfer.
Does Gitea work in China?
Yes — Gitea runs in China; the compliance question is where the repositories, secrets and build state it holds are allowed to rest, not whether it loads.
Gitea is open-source, self-hosted Git software, so it is residency-neutral: hosted offshore — including on its vendor-managed cloud — your source code (a trade secret), CI secrets and any China personal information in commits, issues or fixtures sit abroad, a PIPL cross-border transfer (Articles 38–40). A critical information infrastructure operator or high-volume handler also owes an in-country storage duty an offshore host cannot meet (Cybersecurity Law Article 39 (formerly Article 37)). Because Gitea is self-hosted by design, the lawful lever is to run the identical instance on mainland infrastructure, where code and secrets stay resident; any China-facing surface in front of it still needs an ICP filing.
What Gitea's own documentation says about China
| Fact | Primary source |
|---|---|
| Gitea's documentation describes it as "a painless, self-hosted, all-in-one software development service" — the software has no region of its own, so where your code rests is set by where you host the instance. | Gitea Documentation, "What is Gitea?" (retrieved 2026-10-14) |
| The same documentation states Gitea is "an open-source project based on the MIT license," so the identical software can be self-hosted on mainland-China infrastructure without any vendor tenant or managed cloud. | Gitea Documentation, "What is Gitea?" (retrieved 2026-10-14) |
| Source code, CI secrets and any China personal information in commits, issues or fixtures held on an offshore Gitea instance are a cross-border transfer — requiring notice, separate consent and one transfer mechanism (Articles 38–40). | Personal Information Protection Law of the PRC, Articles 38–40 (retrieved 2026-10-14) |
| A critical information infrastructure operator or high-volume handler must store mainland personal information and important data in-country — a duty an offshore code host structurally cannot meet (PIPL Article 40; CSL Article 39 (formerly Article 37)). | Cybersecurity Law of the PRC, Article 39 (formerly Article 37) (retrieved 2026-10-14) |
Sources verified by the 21YunBox compliance team on 2026-10-14.
For a team serving mainland China, the useful question about Gitea was never whether it installs or reaches the network. It does: Gitea is, by its own documentation, “a painless, self-hosted, all-in-one software development service” — a lightweight Git service written to run on your own server, as readily in Shanghai as in Frankfurt. What turns Gitea into a compliance question is not reachability but what it concentrates and where that comes to rest: your source code — itself a trade secret, and routinely where credentials, keys and real data end up embedded in configs, fixtures and tests — the CI secrets and tokens the instance stores, the build logs and artifacts each run produces, and the repository data that carries contributors’ names and emails. Gitea itself is residency-neutral. It is open-source software, not a hosting location; where all of that rests is decided entirely by where you run the instance — self-hosted in-country, it stays on mainland soil; on an offshore host, including Gitea’s own managed cloud, it sits abroad.
Gitea in China at a glance
| What decides it | In Gitea's own terms — and China's law |
|---|---|
| Where the code, secrets and state physically rest | Gitea is residency-neutral: its own documentation calls it "a painless, self-hosted, all-in-one software development service" and "an open-source project based on the MIT license." The software has no region of its own — where your repositories, CI secrets and build state rest is set by where you run the instance: self-hosted on mainland infrastructure, or offshore. Gitea's vendor-managed cloud is the offshore variant of the same product; there your repositories rest on infrastructure the vendor operates with your chosen provider and region, not a deployment you control in-country. |
| What it holds, and why it's personal information | A source-code host concentrates a company's most sensitive assets: source code (a trade secret), the CI secrets, API tokens and deploy keys the instance stores, build logs and artifacts, and the repository data a run produces. Where commits, issues, test fixtures or CI logs carry names, emails or customer data, that is personal information under PIPL — and a single fixture or log can hold Article 28 sensitive personal information (financial, government-ID, precise-location or health fields). |
| Your mainland data in the system | Source code, secrets and any China personal information collected in the mainland and held on an offshore Gitea instance are a cross-border transfer PIPL governs: notice, a separate consent, and one transfer mechanism (PIPL Articles 38–40). The handler on the hook is you, the operator — not the open-source project. |
| In-country storage duty | A critical information infrastructure operator or high-volume handler owes an in-country storage duty an offshore host cannot meet — mainland personal information and important data must stay in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged. |
| Is it reachable? | Treat reachability as the delivery half, not the question — the server runs fine in-country; only pulling the binary, container image or any offshore CI dependency is a delivery matter. The lawful lever is to run the instance in-country (self-hosted, or a licensed/sovereign option), and any China-facing surface in front of it — a developer dashboard, a deployed app — needs an ICP filing tied to a mainland hosting resource (State Council Order No. 292; MIIT Order No. 33). |
Where the code, secrets and state actually rest
Gitea does not have a region; your instance does. The software is the same bits whether it runs in Frankfurt, Singapore or Shanghai, so the residency question is entirely about the host you put the instance on.
On an offshore host — a server you run on an offshore cloud, or Gitea’s vendor-managed cloud operated on infrastructure outside the mainland — that host is abroad. Point your repositories there and your source code, the secrets the instance stores, your build logs and your artifacts all come to rest offshore; wherever any of it is China personal information, the Personal Information Protection Law treats that as a cross-border transfer, and the handler responsible is you. A managed cloud lets you “choose your provider and region,” but choosing a region is not the same as a lawful in-country deployment you control — unless the instance genuinely rests on compliant mainland infrastructure, the offshore residency exposure still applies.
In-country options genuinely exist, and they are the lawful lever. Because Gitea is open-source and self-hosted by design, you can run the identical instance on mainland infrastructure, where it behaves exactly as it does abroad. And the large foreign clouds reach China only through separate sovereign partitions — AWS China (the Beijing region operated by Sinnet and the Ningxia region operated by NWCD) and Azure China (operated by 21Vianet) are distinct clouds with their own accounts, their own ICP, and their own feature and availability gaps — on which you can stand up the instance in-country. An in-country host is not automatic compliance; it is the starting point for it.
What it holds is personal information — and trade secrets
A source-code host earns this scrutiny because of what it concentrates. Unlike a tool that touches one slice of your data, a Gitea instance is where several of your most sensitive assets sit together: your source code — itself a trade secret, and routinely the place credentials, API keys and real data end up embedded in configuration, fixtures and test data — and the CI secrets, tokens and deploy keys the instance stores. Add the build logs and artifacts a run produces and the repository metadata of every contributor, and the instance becomes a single place where code, secrets and identities converge.
Much of that is personal information under PIPL the moment it identifies a person — the names and emails in commit metadata, issues and pull requests, the customer rows that find their way into test fixtures and CI logs — and some of it is Article 28 sensitive personal information (financial records, government-issued IDs, precise location, biometric or health data), which carries a higher bar of specific purpose, strict necessity, and separate consent.
That is why residency is not merely good hygiene here. For a critical information infrastructure operator, and for a handler whose volumes cross the regulators’ thresholds, personal information and important data collected in the mainland must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). An offshore instance structurally cannot satisfy that duty — the code, logs and secrets are, by definition, in the wrong country. And where an export is permitted at all, crossing a volume or sensitivity threshold can trigger a CAC-led data-export security assessment before any of it lawfully leaves.
Why a reachability check misses this
A connectivity test answers a different question than the one that matters. Point a probe at your Gitea instance and it will tell you the page loads and a clone completes — and it will tell you nothing about where your source code, your CI secrets and your repository data are allowed to rest, which is the only question China’s data law asks here. A check that Gitea is reachable cannot see that the repositories sit on an offshore host, that commits and fixtures carry China personal information, or that a critical information infrastructure operator owes an in-country storage duty. Reachability is the delivery half; residency is the legal one. That gap — between “it loads” and “the data is lawfully allowed to live here” — is exactly what a speed-or-uptime framing misses, and exactly where the exposure sits.
The lawful path — map, localize, deliver
You do not have to drop Gitea to run it lawfully for mainland China. 21YunBox is a compliant overlay, not a migration — and, for an open-source Git service you already run, a partner that sits alongside your stack, not a competitor to it. There are three moves, and they fit together.
Map. Our China compliance team reads your PIPL cross-border, data-residency and data-localization (CII) obligations against your actual entity, your data volumes, and whose personal information sits in your repositories, logs and secret store — so the exposure is written down before anything moves.
Localize. Because the risk is where the code, secrets and state rest, we run the instance in-country — self-hosted on mainland infrastructure, or on a licensed domestic or sovereign-cloud host — so the source code, CI secrets and build state China requires to stay on mainland soil do. Localize means a lawful in-country deployment of the same Gitea, never a reach back to an offshore instance; only the minimized, lawfully transferable subset ever crosses.
Deliver. For any China-facing surface in front of the system — the developer dashboard your in-country teams reach, the application your pipeline ships to mainland users — the 21YunBox Optimizer provides ICP-filed, in-country delivery, in front of the stack you already run. No rebuild, no second codebase. 21YunBox never uses or suggests circumvention of any kind; the entire point is a lawful, filed, in-country path.
The goal is plain: your Gitea repositories and pipelines run legally and compliantly for your users in China.
Related reading:
- How to get an ICP filing for China
- Cross-border data transfers under PIPL
- China’s Cybersecurity Law and data localization
- China’s data-export security assessment measures
