Does Imperva Work in China? Offshore Inspection, Cross-Border Data & ICP
Imperva is a security edge (WAF/CDN/DDoS) that decrypts and inspects your traffic at its global PoPs — and by its own docs none sit inside mainland China, so even its Premium China Network routes mainland users to Hong Kong and Tokyo. That carries your visitors' IP and request data across the border (a PIPL cross-border transfer), and the site behind it still needs ICP. A compliance-first look at the two doors.
Does Imperva work in China?
Whether you can put a mainland-China site behind Imperva is first a data-residency question, not a speed one. Imperva is a security edge — a WAF, CDN and DDoS layer that sits in front of your site and terminates, decrypts, inspects and filters every request at its global points of presence (PoPs).
By Imperva's own documentation, none of those PoPs is inside mainland China: its network reaches only as far as Hong Kong, Taipei, Tokyo, Osaka, Seoul and Singapore, and even its Premium China Network routes mainland users to data centers "in neighboring Hong Kong and Tokyo." So a mainland visitor's traffic — their IP address and request data included — is carried across the border and inspected offshore. Under China's Personal Information Protection Law that is a cross-border transfer of personal information, and the public site behind the edge still needs its own ICP filing. The table below is Imperva's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on what you serve, your data volumes and your role. Our China team can map your Imperva exposure with you →
Compliance snapshot
- ! Reachable, but mainland traffic is served from offshore PoPs — a cross-border round trip (nearest: Hong Kong, Taipei, Tokyo)
- ✕ No data center inside mainland China — even Imperva's Premium China Network routes mainland users to Hong Kong and Tokyo
- ! The edge decrypts and inspects your visitors' traffic offshore — their IP addresses and request data cross the border
- ! That export of mainland visitors' personal data is a cross-border transfer PIPL governs; the public site also still needs its own ICP filing
- ✓ A compliant, ICP-filed in-country delivery path exists — no rebuild, no migration
What Imperva's own documentation says about China
| Fact | Primary source |
|---|---|
| No point of presence inside mainland China. Imperva's own data-center list places its network's closest APAC PoPs in Hong Kong, Taipei, Tokyo, Osaka, Seoul and Singapore — none inside mainland China. A mainland-facing site behind Imperva is therefore served, and its traffic inspected, from offshore. | Imperva (a Thales company) — Imperva Data Centers (PoPs), retrieved 2026-10-07 |
| Even the Premium China Network stays offshore. Imperva's China-optimized add-on improves routing but, in its own words, does so "by utilizing premium China routes to Imperva data centers (PoPs) in neighboring Hong Kong and Tokyo" — not a mainland PoP. Imperva itself notes that "users in mainland China who access websites hosted outside of China may experience availability issues and slow response times." | Imperva (a Thales company) — Premium China Network (PCN), retrieved 2026-10-07 |
| The edge decrypts and inspects traffic — and there is no mainland-China option for it. Imperva documents that "session termination, cryptographic processing, and application-level inspection" happen at its PoPs. Its isolated-network configurations for regulatory restrictions cover only the European Union, Europe, North America, Australia and India — China is not among them — so no setting keeps a mainland visitor's decrypted traffic inside China. | Imperva (a Thales company) — Global PoP Network and Traffic Processing, retrieved 2026-10-07 |
| Because the edge carries mainland visitors' IP addresses and request data offshore to be inspected, that flow is a cross-border transfer of personal information under PIPL. The handler — you, Imperva's customer, not Imperva — must give notice, obtain separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 |
| A security edge does not supply an ICP filing: a public site shown to mainland visitors still needs its own, tied to a hosting resource inside the mainland (State Council Order No. 292; MIIT Order No. 33). And a CIIO or large-volume handler must keep personal information collected in China inside the country (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a duty an offshore edge cannot meet. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the question that decides Imperva is not how fast it is — it is where your visitors’ traffic is decrypted and inspected, and where their data has to travel to get there. Imperva is a security edge: a web application firewall, CDN and DDoS layer that sits in front of your site, terminates and decrypts each connection, inspects and filters it at its global points of presence, then passes clean traffic to your origin. That design is exactly what turns the China question into a compliance one. By Imperva’s own documentation none of those points of presence is inside mainland China, so a mainland visitor’s request — and the IP address and request data that travel with it — is carried across the border to be inspected offshore. The inspection is real and useful; the exposure is that it happens on the wrong side of the border, and that the public site behind it still owes an ICP filing of its own.
Imperva in China at a glance
| What decides it | In Imperva's own terms |
|---|---|
| Where it inspects traffic | At its global PoPs. The nearest to the mainland are Hong Kong, Taipei, Tokyo, Osaka, Seoul and Singapore — none inside mainland China, so inspection happens offshore. |
| Its China option | The Premium China Network improves routing for mainland users but still terminates at PoPs “in neighboring Hong Kong and Tokyo,” and Imperva notes mainland users reaching offshore-hosted sites “may experience availability issues and slow response times.” |
| What crosses the border | The edge performs “session termination, cryptographic processing, and application-level inspection” at its PoPs. For a mainland visitor that means their IP address and decrypted request data are processed offshore. |
| Data residency / PIPL | Sending mainland visitors' personal data offshore to be inspected is a cross-border transfer PIPL governs — notice, separate consent, a transfer mechanism — and CIIOs and large-volume handlers owe in-country storage an offshore edge cannot provide. |
| ICP filing | Not supplied by the edge. A public site shown to mainland visitors still needs its own ICP filing, tied to a hosting resource physically inside the mainland. |
An offshore edge — even in its China configuration
Imperva’s data-center list spreads its network across the Americas, EMEA and APAC; in APAC the closest points to the mainland are Hong Kong, Taipei, Tokyo, Osaka, Seoul and Singapore. Not one of them is inside mainland China. Its Premium China Network — the add-on built specifically for mainland users — improves the route, but in Imperva’s own words it does so “by utilizing premium China routes to Imperva data centers (PoPs) in neighboring Hong Kong and Tokyo,” and Imperva itself cautions that mainland users reaching offshore-hosted sites “may experience availability issues and slow response times.” So reaching China from Imperva’s edge is on the table; being inside it is not — and clearing traffic through an offshore edge is not the same as being cleared to operate from within the country.
Inspecting your visitors’ traffic sends their data across the border
A security edge earns its keep by terminating and decrypting connections so it can read them — Imperva documents that “session termination, cryptographic processing, and application-level inspection” occur at its PoPs. When those PoPs sit offshore, a mainland visitor’s IP address and decrypted request data are carried out of the country to be processed there. China’s Personal Information Protection Law treats that movement of personal information abroad as a cross-border transfer, with duties that attach to you as the handler: notice, separate consent, and one cleared transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. The pull offshore is structural, not incidental: Imperva keeps DDoS scrubbing global — traffic “may still be routed and scrubbed globally” — and its regulatory-isolation configurations extend only to the European Union, Europe, North America, Australia and India, with no mainland-China region among them. There is, in short, no Imperva setting that keeps a Chinese visitor’s decrypted traffic on Chinese soil.
The site behind the edge still needs its own ICP
Putting a security edge in front of your origin changes how traffic is filtered, not whether the site is licensed to operate in China. A public-facing website delivered to mainland visitors turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically inside the mainland. Imperva’s edge provides no such resource, so it cannot carry the filing for you — and it cannot satisfy the data-localization duty that falls on a critical information infrastructure operator or a large-volume handler to keep personal information collected in China inside the country (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Those are licensing and residency facts, and no amount of edge tuning closes them.
This is a risk map, not a verdict: whether your cross-border inspection needs a transfer mechanism, whether you must keep data in-country, and whether your site is properly filed depend on what you serve, how much personal data you handle, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep Imperva doing what it does well. What we add is the piece an offshore security edge cannot: compliant, ICP-filed delivery from inside the mainland, placed in front of your existing origin — no rebuild, no second codebase, and no change to how your application is built. Our China team maps your ICP and cross-border obligations against your entity and your data volumes, then stands up the in-country delivery and, where the law requires it, the in-country handling that keeps your mainland visitors’ data on the right side of the border — while your origin stays exactly where it already runs.
Related reading:
Frequently Asked Questions
Does Imperva have a data center inside mainland China?
No. By Imperva's own documentation, its points of presence reach only as far as Hong Kong, Taipei, Tokyo, Osaka, Seoul and Singapore in APAC — none inside mainland China. Even its Premium China Network, the add-on built for mainland users, routes their traffic to Imperva data centers in neighboring Hong Kong and Tokyo rather than to a mainland PoP.
Is it against the law to put a China-facing site behind Imperva?
Not inherently. The exposure is that the edge decrypts and inspects your mainland visitors' traffic offshore, carrying their IP addresses and request data out of the country — a cross-border transfer of personal information that PIPL permits only with notice, separate consent and a cleared transfer mechanism — and that the public site behind it still needs its own ICP filing. Whether you also face a data-localization duty turns on your role and data volumes. Treat it as a risk to assess with counsel, not a blanket prohibition.
Can 21YunBox help make our Imperva setup compliant in China?
Yes. Our China team can map your cross-border and ICP exposure for your data volumes and role, and stand up compliant, ICP-filed in-country delivery in front of your existing origin — and, where the law requires your mainland visitors' data to stay in China, in-country handling — without a rebuild or a move off your current stack. Get in touch to work through your specific case.
