Does Hygraph Work in China? Data Residency, the Content API & the ICP Question
Hygraph is a headless CMS: it stores each project's content in one offshore region — Australia, Brazil, Canada, Germany, India, Japan, US East, US West or the United Kingdom — with none in mainland China, so your content and any personal data in it sit offshore under PIPL, and the ICP filing attaches to the public site you run on top of it. A compliance-first look at where your content lives and who files for the site.
Does Hygraph work in China?
Whether you can use Hygraph in mainland China is first a data-residency question, not a speed one. Hygraph is a headless CMS: it stores the content your site is built on — and any personal data your content models hold — and answers it through a GraphQL content API. Where it keeps that content is what China's law responds to.
Hygraph's own “Choice of Data Centers” lets you store a project's content in one region, and the nine it offers out of the box — “Australia, Brazil, Canada, Germany, India, Japan, US East, US West, United Kingdom” — are all offshore, with enterprise plans able to “around 77+ locations.” None is in mainland China. So any content you model that holds personal data about China users is kept outside the mainland: a cross-border transfer of personal information PIPL governs. And because Hygraph is a backend behind a frontend you build and host, the ICP filing question lands on the public mainland site you run, not on Hygraph itself. The table below is Hygraph's own wording and the rule each line triggers.
This is a risk picture, not a verdict — what applies turns on what your models hold, how much of it is personal, and who your users are. Our China team can map your Hygraph exposure with you →
What Hygraph's own documentation says about China
| Fact | Primary source |
|---|---|
| Hygraph stores each project's content in one region you pick, and every region it offers is offshore. Under its own “Choice of Data Centers,” the regions available out of the box are “Australia, Brazil, Canada, Germany, India, Japan, US East, US West, United Kingdom,” with enterprise plans able to “around 77+ locations.” None is in mainland China — the nearest, Japan and India, are still outside it — so the content your site is built on is stored offshore. | Hygraph — Scalability: Choice of Data Centers (hygraph.com), retrieved 2026-10-07 |
| If your content models hold personal data, that data is held offshore. A headless CMS does not only store marketing copy — content models routinely carry author profiles, user-generated content, comments, and personalization or form-style entries, which can be personal information. Gathered from people in China and stored in an offshore Hygraph region, that is a cross-border transfer of personal information under PIPL: the handler — you, Hygraph's customer, not Hygraph — must give notice, obtain separate consent, and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). | PIPL Chapter III, Articles 38–43 |
| There is no way to keep the content on Chinese soil inside Hygraph. For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Because Hygraph publishes no mainland-China region, the only way to keep your China users' content and personal data in-country is to run that storage on infrastructure inside the mainland — a separate arrangement from your Hygraph project, not a region toggle. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| Reachability is the easy half, and the ICP question is about your site, not Hygraph. Hygraph is a backend API: “All Content APIs are served via our globally distributed edge cache,” so cached reads come from edge locations — but the content store and any uncached, preview or write query still resolve against the offshore region. The ICP filing (State Council Order No. 292; MIIT Order No. 33) attaches to the public mainland website or app you build on top of Hygraph and its in-country hosting resource — not to the headless CMS itself. | Hygraph — Scalability (hygraph.com), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Hygraph is not how quickly a page paints — it is where the content your site is built on is stored, and where any personal data inside it is allowed to live. Hygraph is a headless CMS: it keeps your content and answers it through a GraphQL content API, and it settles the residency question in its own documentation — every region it hosts in sits offshore, with none in mainland China. The API is reachable; the exposure is that your content lives outside the mainland, and that the public site you build on top of Hygraph is the thing that has to be cleared to operate there.
Hygraph in China at a glance
| What decides it | In Hygraph's own terms |
|---|---|
| Where content is stored | One region, chosen when the project is created. The regions offered out of the box are Australia, Brazil, Canada, Germany, India, Japan, US East, US West, United Kingdom; enterprise plans can “around 77+ locations.” None is in mainland China. |
| How it is served | “All Content APIs are served via our globally distributed edge cache.” Cached reads come from edge locations, but the content store — and any uncached, preview or write query — stays in the offshore region you picked. |
| Your China users' data | Content models that hold personal data — author profiles, user-generated content, personalization or form-style entries — keep it in the offshore region. For data gathered in China, that is a cross-border transfer of personal information PIPL governs. |
| Data-residency duty | For a CIIO or large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). No Hygraph region is in the mainland, so this cannot be met on Hygraph. |
| The ICP question | A public mainland site turns on an ICP filing tied to an in-country hosting resource. As a headless backend, Hygraph is not what gets filed — the public site you build on it is, and Hygraph gives it no mainland footing. |
No mainland region, so your content is stored offshore
Hygraph stores each project’s content in a single region, chosen when the project is created. Under its own “Choice of Data Centers,” the regions available out of the box are “Australia, Brazil, Canada, Germany, India, Japan, US East, US West, United Kingdom,” and enterprise plans can “around 77+ locations.” Not one of them is in mainland China, and the closest — Japan and India — are still outside it.
That settles the residency question before performance is ever in frame. If your content models hold personal data about people in China — author profiles, user-generated content, comments, or form-style and personalization entries — that data is written to and kept in an offshore region. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, not Hygraph — has to give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty none of Hygraph’s offshore regions can satisfy.
A headless content API still crosses the border
A headless CMS is only half a system: Hygraph holds the content, and a frontend you build and host queries it. Hygraph states that “All Content APIs are served via our globally distributed edge cache,” which means cached reads can come from an edge location close to the visitor. But a globally distributed cache in front of an offshore store does not move the store: the content itself, and any query the cache cannot serve — a preview, an editor’s write, or a request it has not seen before — resolves against the region you picked, which is offshore.
How much of that a visitor feels depends on how your frontend renders. Bake everything at build time and publish a fully static site, and the per-visitor API crossing largely disappears. Render at request time instead — server-side rendering, incremental regeneration, or client-side GraphQL — and each of those queries makes the round trip to the offshore region. This is the half a plain asset cache cannot close on its own: caching static files is not the same as giving a dynamic content API a lawful, in-country path.
The ICP question lands on your site, not the headless backend
Because Hygraph is a backend reached over an API, the licensing question does not attach to it the way it attaches to a host. It attaches to the public-facing site or app you run on top of it. A website delivered to mainland visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically located in the mainland. Hygraph has no mainland region, so it offers nothing to file against — the filing is yours to arrange for the site you build.
So “we already run on Hygraph” does not carry the site into China on its own: calling an offshore API from Beijing is not the same as being cleared to operate a public site there.
This is a risk map, not a verdict: whether you need an ICP filing, in-country storage for the personal data your content holds, or both, depends on what you publish, how much personal information you handle, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building on Hygraph, and you keep your content models exactly as they are. We add the piece a headless platform with no mainland presence leaves to you: compliant, ICP-filed delivery from inside the mainland, set in front of the site you already run — no rebuild, no second codebase, and no move off Hygraph. Our China team maps your ICP and PIPL data-residency obligations against your entity and the personal data your models hold, then stands up the in-country delivery and, where the law requires it, the in-country storage a lawful China presence needs — while your Hygraph project stays right where it is.
Related reading:
