Does Harness Work in China? Data Residency, ICP & Cross-Border Rules
Harness keeps your pipeline definitions, deploy metadata, logs, secrets and connectors — plus contributor PII — in a control plane that on SaaS runs offshore (no mainland-China region). A self-hosted delegate only runs jobs; the fix is its Self-Managed Enterprise Edition run in-country — a PIPL residency matter, not speed.
Does Harness work in China?
Yes — but whether Harness "works" in China is a data-residency question, not a speed one, and the answer turns on how you run it. Harness SaaS holds your pipeline definitions, deployment metadata, build and deploy logs, pipeline secrets and connectors — plus contributor identities — in its own offshore control plane; a self-hosted delegate only runs jobs in your network and does not move any of that in-country.
Harness's own documentation says its Self-Managed Enterprise Edition is "an on-premises solution that allows you to install and run Harness on your own infrastructure," running "within your environment" and keeping "data within your own network perimeter." That is the lever: run the self-managed edition on in-country infrastructure and the store of pipelines, secrets, logs and metadata can stay resident. Left on offshore SaaS — Harness documents clusters in us-west1 and us-west2 (the US), with no mainland-China region — that concentrated store of secrets and contributor personal information rests abroad and crosses the border, a cross-border transfer under PIPL, with in-country storage duties for a CIIO or high-volume handler under Cybersecurity Law Article 39 (formerly Article 37).
This is a risk map, not a verdict — which duties bite turns on your entity, your role and your data volumes. Our China team can map your residency and the self-host path with you →
What Harness's own documentation says about China
| Fact | Primary source |
|---|---|
| Harness ships a self-hostable, on-premises edition. Harness's own docs state that "Harness Self-Managed Enterprise Edition is an on-premises solution that allows you to install and run Harness on your own infrastructure," that it "runs within your environment alongside existing services," and that it offers "Offline & Air-Gapped Capabilities" — "keeping data within your own network perimeter." Run on in-country infrastructure, it keeps your pipelines, secrets, logs and build metadata resident. | Harness Developer Hub — Self-Managed Enterprise Edition overview (developer.harness.io), retrieved 2026-10-12 |
| Harness SaaS is offshore, and a self-hosted delegate does not change that. Harness documents its SaaS infrastructure as running "across two regions, us-west1 and us-west2" — both in the United States — with no mainland-China region. The Harness Delegate is "a service you run in your local network or VPC" that only executes jobs; it "connects to Harness Manager over an outbound HTTPS/WSS connection," so the control plane that holds your pipelines, secrets and audit data stays wherever the server runs — offshore unless you self-host it in-country. | Harness Developer Hub — SaaS architecture & Delegate overview (developer.harness.io), retrieved 2026-10-12 |
| Holding a China team's pipelines, secrets and contributor PII offshore is a cross-border transfer. Any personal information in commits, issues, deploy logs and contributor accounts that rests on an offshore control plane leaves the mainland — a cross-border transfer under PIPL Articles 38–40, on top of the Article 13/23 notice and separate consent for the overseas transfer. The duty lands on you, the handler, not on Harness. | Personal Information Protection Law of the PRC, Articles 13, 23 and 38–40 (retrieved 2026-10-12) |
| For a CIIO or high-volume handler, that data must stay in the mainland. China's Cybersecurity Law Article 39 (formerly Article 37) — the 2025 amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, its substance unchanged — requires personal information generated in China to be stored in-country for critical information infrastructure operators and high-volume handlers. Offshore SaaS cannot meet that; running the Self-Managed Enterprise Edition on in-country infrastructure can. | Cybersecurity Law of the PRC, Article 39 (formerly Article 37); 2025 amendment in force 2026-01-01 (retrieved 2026-10-12) |
Sources verified by the 21YunBox compliance team on 2026-10-12.
For an enterprise running Harness for a mainland-China engineering team, the question that matters is not whether the Harness UI paints quickly from Shanghai. Harness is the control plane for how you ship software: it holds your pipeline definitions, your deployment metadata and release history, the build and deploy logs of every run, and the pipeline secrets and connectors that reach into your clusters, clouds and registries — together with the identities of every contributor and whatever personal data rides along in commits, issues and approvals. That is a concentrated store of secrets and a map of exactly how your organization builds and deploys. Where it lives decides the compliance question, and Harness gives you two very different answers. Its Self-Managed Enterprise Edition is, in Harness’s own words, an “on-premises solution that allows you to install and run Harness on your own infrastructure” — run it on in-country infrastructure and that whole store can stay resident. Its managed SaaS, by contrast, runs offshore: Harness documents clusters in us-west1 and us-west2, both in the US, with no mainland-China region. And one nuance decides more than it appears to: a self-hosted Harness delegate runs jobs inside your network, but it is only a worker — the control plane that holds the pipelines, secrets and audit data sits wherever the server runs, so making the delegate local does not move any of that in-country. The axis here is data residency and cross-border transfer, not latency.
Harness in China at a glance
| What decides it | In Harness's own terms — and China's law |
|---|---|
| What it holds | Your software-delivery core: pipeline definitions, deployment metadata and release history, build and deploy logs, and the pipeline secrets and connectors that reach into your clusters, clouds and registries — plus the identities of every contributor (names, emails, accounts) and any personal data in commits, issues and approvals. Concentrated secrets and a map of how you ship, in one control plane. |
| In-country option vs offshore SaaS (the premise) | Harness ships a Self-Managed Enterprise Edition — in Harness's words an “on-premises solution that allows you to install and run Harness on your own infrastructure,” air-gapped capable, “keeping data within your own network perimeter.” Run it on in-country infrastructure and the pipelines, secrets, logs and metadata stay resident. Harness SaaS, by contrast, runs in us-west1 and us-west2 (the US) with no mainland-China region. |
| A delegate is not the control plane — the distinctive second half | The half a reachability check never sees. A self-hosted delegate is, per Harness, “a service you run in your local network or VPC” that only executes jobs — it connects outbound to the Harness Manager, and the control plane still holds your pipelines, secrets, connectors and audit data wherever the server runs. Making the delegate local does not move any of that in-country; only running the self-managed edition in-country does. |
| Residency & cross-border | Holding a China team's pipelines, secrets and contributor PII on an offshore control plane is a cross-border transfer (数据出境) under PIPL Articles 38–40, on top of the Article 13/23 notice and separate consent for the overseas transfer. The duty lands on you, the handler, not on Harness. |
| Data localization & the ICP door | For a critical information infrastructure operator or a high-volume handler, Cybersecurity Law Article 39 (formerly Article 37) requires China-collected personal information to be stored in the mainland — which offshore SaaS cannot satisfy and a self-hosted, in-country deployment can. And any public, China-facing surface tied to the platform — a developer portal or status page served to mainland users — is an internet information service carrying an ICP filing (备案) duty bound to mainland hosting. |
| Reachability is not the axis | Whether the Harness UI loads from the mainland is operational, not the compliance question. What decides it is where the pipelines, secrets, logs and PII live and under what consent. 21YunBox helps you run the self-managed edition in-country, keep the regulated store resident, file the ICP for any China-facing surface, and deliver compliantly — the 21YunBox Optimizer — in front of what you already run. Never circumvention of any kind. |
What it actually holds — your pipelines, secrets and the people who ship
Harness is not a marketing site; it is the control plane for your software delivery, and it holds a remarkably complete picture of it. Every pipeline definition describes how your code becomes a release. Every run leaves deployment metadata, approval records and build and deploy logs. The pipeline secrets and connectors it stores are live credentials into your clusters, clouds, registries and third-party systems — a concentrated set of keys to your estate. And the platform carries the identities of everyone who ships: contributor names, emails and accounts, plus whatever personal data appears in commit messages, issue threads, approvals and deploy notes. Wherever those records name or describe a person they are personal information under China’s Personal Information Protection Law. Taken together, the pipelines, secrets and logs are both a security-sensitive asset and a map of exactly how your organization builds and deploys — and whether that store lives in the mainland or offshore is decided entirely by where the Harness control plane runs.
The doors: residency, cross-border, localization and ICP
Leave a China team’s work on Harness’s offshore SaaS and the first door opens. The pipelines, secrets, logs and contributor identities in that control plane rest abroad, which makes it a cross-border transfer (数据出境). The duty lands on you, the handler, not on Harness: PIPL Articles 13 and 23 require notice and a basis to collect the data, and Articles 38–40 require a transfer mechanism to send it offshore — a CAC security assessment, the CAC standard contract, or certification — with separate consent for the overseas transfer.
For a critical information infrastructure operator or a high-volume handler, the Cybersecurity Law’s Article 39 (formerly Article 37 — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, its substance unchanged) requires personal information generated in China to be stored in the mainland. Offshore Harness SaaS cannot satisfy that duty — but here the premise turns in your favor, because Harness ships a self-managed edition. Running the Self-Managed Enterprise Edition on in-country infrastructure keeps the pipelines, secrets, logs and contributor PII resident, which is the lawful way to meet a localization duty rather than route data abroad.
A common misconception deserves its own door. Teams assume that installing a self-hosted delegate (runner) keeps their data in China. It does not. The delegate is, in Harness’s words, “a service you run in your local network or VPC” that only executes jobs; it connects outbound to the Harness Manager over an HTTPS/WSS connection, and the control plane on the other end still holds the pipeline definitions, the secrets, the connectors and the audit record. Making the delegate local changes where jobs run, not where the regulated store lives. Only moving the control plane itself in-country — the self-managed edition — moves the data.
And the moment you expose a public, China-facing surface tied to the platform — a developer portal, a status page, or the self-managed UI served to mainland users — that surface is an internet information service and carries an ICP filing (备案) duty bound to a mainland hosting resource. A purely internal control plane may not trigger ICP on its own; a public surface served to users in China does.
Why a reachability check misses this
A probe from inside China can watch the Harness login screen paint and conclude “it works.” That answer is beside the point. The compliance exposure is not on the screen — it is in the data at rest and how it moves: the pipeline definitions, the deployment metadata, the build and deploy logs, the pipeline secrets and connectors, and the contributor identities, all sitting in a control plane that, on SaaS, Harness documents as running in us-west1 and us-west2 — never mainland China. A page-load test measures none of that. It cannot see which region the control plane lives in, whether separate consent was taken, whether a transfer mechanism is in place, or that a self-hosted delegate leaves every one of those records offshore. That is the competitor-proof second half of the question — and it is exactly why making an offshore Harness control plane merely reachable from the mainland, or merely running a delegate locally, is not the answer. Running the self-managed edition in-country, so the pipelines and secrets stay resident, is.
The lawful path — map, localize, deliver
There is a compliant way to run Harness for a mainland-China engineering team, and because Harness ships a self-managed edition it does not require leaving Harness — no rebuild, no migration off the platform, and never a route that ships data offshore by stealth.
First, map: our China compliance team inventories what your Harness footprint holds — the pipeline definitions, deployment metadata, build and deploy logs, pipeline secrets and connectors, any infrastructure-as-code state, and the contributor identities and personal data in commits and issues — establishes where the control plane runs today (offshore SaaS in us-west1/us-west2, or a self-managed instance), the ICP status of any China-facing surface, and the consent and residency basis each flow relies on. We build the technical picture; the legal conclusions are settled with counsel.
Then localize: run the Self-Managed Enterprise Edition on in-country infrastructure so the pipelines, secrets, logs and metadata stay resident, obtain the Article 13/23 notice and separate consent for any contributor personal data, and minimize the personal data that goes into commits, issues and deploy notes in the first place. Localize means keeping the regulated store on an in-country path — never a route, of any kind, that ships it offshore or reaches back across the border to retrieve it, and never any form of circumvention.
Then deliver: your mainland developers still need fast, reliable access to the in-country control plane, and any public, China-facing surface is an internet information service carrying an ICP filing duty. 21YunBox delivers it in-country — the 21YunBox Optimizer — in front of the self-managed instance and surfaces you run, so they run legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind — we keep in-country what the law says must stay, deliver the rest compliantly from inside the mainland, and never move personal information across the border by stealth. 21YunBox is a compliance overlay and partner to the delivery platform you already run, not a competitor to it.
None of this is a verdict that Harness is “blocked” or “illegal” in China; it is a risk-and-residency map. Which duties bite your case turns on your entity, your role under Chinese law, your data volumes, and what your pipelines, secrets and logs actually hold — worth settling the specifics with counsel before your organization’s software-delivery control plane depends on it.
Related reading:
- How to get an ICP filing for China
- Cross-border data transfers under PIPL
- China’s Personal Information Protection Law (PIPL)
- China’s Cybersecurity Law (data localization, Article 39)
