Does Hyland OnBase Work in China? Data Residency, Localization & PIPL Cross-Border

For an organization serving mainland China, the question about Hyland OnBase was never whether it installs or whether users can reach it. It does, and they can. OnBase is a content-services and workflow platform — in Hyland’s own words it “orchestrates the capture and governance of enterprise documents” — and the system of record for an organization’s most sensitive material: patient and clinical records, insurance claims, account and loan files, government case files, contracts and HR files. It does not touch a thin slice of data; it holds the actual content — the files themselves, versioned, with access-control lists and audit trails — content that is routinely Article 28 sensitive (health, financial, government-ID) and often legally privileged. So the real question is a residency one: where are those documents allowed to come to rest? Hyland Cloud has no mainland-China region; OnBase, however, still ships on-premises — the lawful in-country lever.

Hyland OnBase in China at a glance

Where the documents actually rest

Hyland does not operate a region inside mainland China. It delivers its hosted offering — the Content Innovation Cloud, formerly the Hyland Cloud — on AWS, adding capacity one region at a time: the US West (Oregon) region, the AWS Frankfurt Region for Europe (announced October 2025, “while meeting regional data residency requirements”), Sydney for Asia-Pacific, Tokyo for Japan, and São Paulo for Latin America. In its own 2021 count the network reached “19 geographically diverse locations.” Not one of them is in mainland China. Select any region for your OnBase tenant and the content it holds — the files themselves, their versions, the metadata and the audit trail — comes to rest outside China.

This matters because OnBase is one of several Hyland content products (OnBase, Alfresco, Nuxeo, Perceptive Content, Saperion ECM and more), and the residency question is specific to where your OnBase repository lives. The honest counterweight is that OnBase has not gone cloud-only: Hyland still documents an on-premises deployment model alongside its hosted and Content Innovation Cloud options, so OnBase can run on infrastructure you place on mainland soil. Hyland markets the cloud first, but the on-premises product is a genuine, current lever — and it is the one that keeps the documents in-country.

What it holds is personal information — and often privileged

OnBase earns this scrutiny because of what it holds. This is not telemetry or a thin index; it is the content itself. A hospital’s OnBase holds clinical and patient records; an insurer’s holds policy, claims and medical-underwriting files; a bank’s holds account, loan and KYC files; a government agency’s holds case files and citizen records. Each of those is personal information under China’s Personal Information Protection Law the moment it identifies a person, and most of it is Article 28 sensitive personal information — health, financial and government-ID data — which carries a higher bar of specific purpose, strict necessity and separate consent. Much of the same content is legally privileged or confidential: contracts, legal matters, board materials and HR files whose confidentiality is itself a reason not to let them come to rest in the wrong jurisdiction.

So what an offshore OnBase cloud concentrates abroad is the organization’s actual record of its most sensitive dealings in China. For a critical information infrastructure operator, and for a handler whose volumes cross the regulators’ thresholds, personal information and important data collected in the mainland must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). An offshore repository structurally cannot satisfy that duty — the documents are, by definition, in the wrong country — and where an export is permitted at all, crossing a volume or sensitivity threshold can trigger a CAC-led data-export security assessment before any of it lawfully leaves.

Running it on a no-China-region cloud doesn’t meet the residency duty — and what does

The honest summary is narrow and important: nothing about OnBase is “blocked” in China, and the exposure is not the software. The exposure is a hosted deployment that parks your mainland’s most sensitive documents and records — the contracts, the case files, the health and financial records — outside the mainland, on a cloud with no in-country region to select.

Because OnBase still ships on-premises, the lawful lever is real and does not require abandoning the product. You run OnBase in-country — on mainland infrastructure you control, or on a licensed sovereign-cloud equivalent — so the documents, versions and audit trails China requires to stay on mainland soil do. Pointing a mainland OnBase client back at an offshore Hyland Cloud tenant is not localization and does not meet the storage duty; standing the repository up in-country is. Where a minimized subset of content may lawfully cross the border, you keep that transfer consented and backed by a transfer mechanism, while any China-facing surface in front of the repository — the web client, the admin console, the self-service portal your mainland users hit — earns its own ICP filing. No rebuild and no migration to a different product are needed to put the content in the right country.

This is a risk map, not a verdict. Whether you owe in-country storage, a transfer mechanism, a separate consent, a data-export security assessment, an ICP filing, or some combination turns on your entity, your data volumes, how much of what your OnBase repository holds is personal or sensitive, and whose data it is — and it is worth settling with counsel before you decide where a single case file lives.

The lawful path — map, localize, deliver

You do not have to drop Hyland OnBase to run it lawfully for mainland China. 21YunBox is a compliant overlay, not a migration — and, for a platform you already run, a partner that sits alongside your stack, not a competitor to it. There are three moves, and they fit together.

Map. Our China compliance team reads your PIPL cross-border, data-residency and data-localization (CII) obligations against your actual entity, your data volumes, and whose personal information your OnBase repository holds — the patient records, the claims files, the contracts, the HR files — so the exposure is written down before anything moves.

Localize. Because the risk is where those documents rest, we keep the repository in-country — OnBase on-premises on mainland infrastructure where you deploy it, or a licensed in-country / sovereign-cloud equivalent — so the content China requires to stay on mainland soil does. Localize means a lawful in-country deployment of the repository, never a tunnel back to an offshore endpoint; only the minimized, lawfully transferable subset ever crosses.

Deliver. For any China-facing surface in front of the repository — the OnBase web client, the admin console, the portal or self-service page your mainland users hit — the 21YunBox Optimizer provides ICP-filed, in-country delivery, in front of the stack you already run. No rebuild, no second codebase. 21YunBox never uses or suggests circumvention of any kind; the entire point is a lawful, filed, in-country path.

The goal is plain: your Hyland OnBase deployment runs legally and compliantly for your users in China.

Get a compliance assessment →

Related reading:

• Cross-border data transfers under PIPL
• China’s Cybersecurity Law and data localization (Article 39)
• China’s data-export security assessment measures
• How to get an ICP filing for China

RELATED TECHNOLOGIES

Bynder

Bynder

OpenText Documentum

OpenText Documentum

iManage

iManage

M-Files

M-Files

NetDocuments

NetDocuments

OpenText

OpenText