Does HubSpot Work in China? Data Residency, PIPL & an Offshore CRM
HubSpot keeps your contacts, forms and marketing data on AWS regions in the US, EU, Canada and Australia — none in mainland China — so your Chinese users' personal data is a cross-border transfer under PIPL, and a public site on HubSpot CMS has no ICP-filing path of its own. A compliance-first look at the two obligations.
Does HubSpot work in China?
Whether you can use HubSpot for a mainland-China audience is first a data-residency question, not a speed one. HubSpot holds the contacts, companies, forms and marketing records your team runs on — and China's law responds to where that personal data is kept, not to how quickly a form paints.
By HubSpot's own infrastructure documentation, "HubSpot's product infrastructure is hosted on Amazon Web Services (AWS)," in data-center regions across the European Union (Germany), the United States (Virginia and Oregon), Canada (Montreal) and Australia (Sydney) — none in mainland China. So the contact and form data you collect from Chinese users is held offshore: a cross-border transfer of personal information that PIPL governs, needing notice, separate consent and a transfer mechanism. HubSpot adds that even on a regional account, for analytics and usage data "This data will be transferred from the hosting location to the United States." And a public site published on HubSpot CMS is served from that same offshore infrastructure, with no ICP-filing path of its own. The table below is HubSpot's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on your data volumes and your role. Our China team can map your HubSpot exposure with you →
What HubSpot's own documentation says about China
| Fact | Primary source |
|---|---|
| In HubSpot's own words: "HubSpot's product infrastructure is hosted on Amazon Web Services (AWS)," and its data-center regions are the European Union (Germany), the United States (Virginia and Oregon), Canada (Montreal) and Australia (Sydney). None is in mainland China — the nearest, Australia, is still offshore. The contacts, companies, deals and form submissions you collect from Chinese users are held in whichever of those regions your account sits in. | HubSpot — Cloud Infrastructure and Data Hosting FAQ, retrieved 2026-10-07 |
| Even a regional account routes analytics to the US. Choosing EU (Germany) hosting narrows where your records sit, but HubSpot states that for analytics and usage data, "This data will be transferred from the hosting location to the United States." So some personal data leaves the chosen region regardless of where the account is hosted — a cross-border flow in its own right. | HubSpot — Cloud Infrastructure and Data Hosting FAQ, retrieved 2026-10-07 |
| Because that data is held outside the mainland, PIPL governs it as a cross-border transfer: the personal-information handler — you, HubSpot's customer, not HubSpot — must give notice, obtain separate consent, and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). | PIPL Chapter III, Articles 38–43 |
| The exposure scales with volume and role, not merely with using the tool: under the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024 |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside mainland China (PIPL Article 40; CSL Article 39 (formerly Article 37)) — which HubSpot's US, EU, Canada and Australia regions cannot do. And if you publish a public website on HubSpot CMS, it is served from that same offshore infrastructure, so it has no ICP-filing path of its own — the filing must attach to a hosting resource inside the mainland. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37); HubSpot — Cloud Infrastructure and Data Hosting FAQ (regions), retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about HubSpot is not how quickly a form or landing page paints — it is where the personal data behind it is allowed to live. HubSpot runs your contacts, companies, forms and marketing records, and it keeps them on cloud regions outside mainland China. That geography, not performance, is what China’s data-protection and licensing rules respond to: the personal data of your Chinese users becomes a cross-border transfer, and a public site published on HubSpot’s own CMS has nowhere in the mainland to be filed. The reachability is a delivery matter; the data residency and the licensing are the exposure.
HubSpot in China at a glance
| What decides it | In HubSpot's own terms |
|---|---|
| Where your data lives | “HubSpot's product infrastructure is hosted on Amazon Web Services (AWS),” in the European Union (Germany), the United States (Virginia and Oregon), Canada (Montreal) and Australia (Sydney). No region is inside mainland China; the nearest, Australia, is still offshore. |
| What HubSpot holds | Contacts, companies, deals, email and form submissions — the personal information you collect from your Chinese users, kept in whichever offshore region your account sits in. |
| Analytics routed to the US | Even on a regional (e.g. EU) account, HubSpot states that for analytics and usage data “This data will be transferred from the hosting location to the United States.” |
| Serving the public (CMS) | A public website published on HubSpot CMS is delivered from this offshore infrastructure; with no mainland region, HubSpot offers no ICP-filing path for it. |
| Your China users' data | Personal data held offshore is a cross-border transfer PIPL governs; for CIIOs and large-volume handlers it must be stored in the mainland — which HubSpot's four countries cannot do. |
No mainland region — your CRM data lives offshore
HubSpot runs on Amazon Web Services, and in its own infrastructure documentation the regions it offers are the European Union (Germany), the United States (Virginia and Oregon), Canada (Montreal) and Australia (Sydney). Not one of them is in mainland China, and the nearest — Australia — is still outside it. Whichever region your account sits in, that is where your contacts, companies, deals, email and form submissions are kept.
That settles the data-residency question before performance is ever in frame. The personal information you collect from Chinese users is held offshore, so under China’s Personal Information Protection Law it is a cross-border transfer: the handler — you, HubSpot’s customer, not HubSpot — has to give notice, obtain separate consent, and clear one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty none of HubSpot’s four countries can meet.
Choosing EU hosting narrows the problem, it doesn’t remove it
HubSpot lets some accounts be hosted in its EU (Germany) data center, which keeps most records in Europe rather than the US. It does not make that data domestic to China, and it does not stop every flow out of the region: for analytics and usage data HubSpot states plainly that “This data will be transferred from the hosting location to the United States.” So even an EU-hosted HubSpot account moves some personal data across borders by design — and the residency question for China is about where your Chinese users’ data ends up, which on HubSpot is never the mainland.
A public site on HubSpot CMS has no ICP footing
If you publish a public-facing website on HubSpot CMS, it is served from the same offshore infrastructure. Delivering a public site to mainland visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically located in the mainland. HubSpot operates none, so there is nothing on HubSpot to file against — reaching China is not the same as being cleared to publish there. If you use HubSpot only for CRM and marketing behind your own site, this door may not apply to you; the data-residency one still does.
Reachable or slow is the delivery half — not the half that decides it
HubSpot’s forms, tracking scripts and CMS pages are all delivered from offshore, so how they load for a mainland visitor is a delivery question that varies with the network. But whether you may use HubSpot for China turns on where the personal data lives and whether a public site can be ICP-filed — not on paint time. Those are compliance facts, and no amount of network tuning changes them.
This is a risk map, not a verdict: whether you face a cross-border-transfer obligation, a data-localization duty, an ICP filing, or some combination depends on what you serve, how much personal data you hold, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building on HubSpot. We add the piece a platform with no mainland presence cannot: compliant, ICP-filed delivery from inside the mainland, set in front of the HubSpot assets your visitors already load — and, where the law requires your Chinese users’ data to stay on Chinese soil, in-country storage — with no rebuild, no second codebase, and no move off HubSpot. Our China team maps your PIPL cross-border and data-residency obligations against your entity and data volumes, then stands up the in-country delivery and storage a lawful China presence needs, while your HubSpot account stays exactly where it already runs.
Related reading:
