Does Jira Service Management Work in China? Data Residency, ICP & Cross-Border Rules

For a mainland-China IT team, the first instinct is to ask whether the service desk opens quickly from Shanghai or Shenzhen. That is the wrong gate. Jira Service Management is Atlassian’s IT service management platform — the service desk, incident, change and problem management, and the CMDB and asset management behind them — and what decides whether you can run it for China is not reachability or speed. It is where the personal information it holds comes to rest, and where the record of your entire China IT estate is kept. It ships two ways: Jira Service Management Cloud, a SaaS tenant Atlassian hosts in its own regions, and the self-managed Data Center edition you run yourself. By Atlassian’s own account, Cloud has no mainland-China region — and, as we will come to, the self-managed edition that could sit in-country is being retired. To be unambiguous from the outset: there is no lawful way around China’s network controls, and 21YunBox never uses or suggests circumvention of any kind.

Jira Service Management in China at a glance

The data a service desk holds is personal information — and it sits offshore

A Jira Service Management instance is not just workflow — it is the system of record for your China IT estate, and two kinds of data inside it are what China’s law responds to. The first is personal information: the directory of your China IT staff, and every requester who files a ticket — names, work emails, phone numbers, org unit, and sometimes device or location detail. All of it lives in your Atlassian Cloud tenant, and by Atlassian’s own data-residency documentation that tenant sits outside mainland China. So the ordinary act of a Beijing-based employee raising a ticket places personal information collected in China onto storage outside the country. That is a cross-border transfer of personal information under the Personal Information Protection Law, and the duty lands on you, the handler — not on Atlassian. PIPL Articles 38–40 require notice, a separate consent distinct from a user’s agreement to use the tool, and one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. None of that turns on how fast the portal paints.

The CMDB and tickets — the half a reachability check never sees

Here is the exposure a speed test can never surface. Beyond the people, a Jira Service Management instance holds your configuration management database and your tickets — and together they are the concentrated, security-sensitive map of how your China operation is built and run. The CMDB carries hostnames, network topology, asset inventory and service maps; incident and change tickets routinely carry internal system detail, configuration, and sometimes embedded credentials or secrets. Held on an offshore tenant, that blueprint of your China IT estate is two things at once: a cross-border data transfer, and — for sensitive operations — a matter that may implicate China’s handling duties for sensitive or “important data” (重要数据) and its broader data-security obligations.

A reachability check confirms the portal loads; it says nothing about the fact that your estate’s operational secrets are being processed and stored abroad. We frame this as a risk to confirm with counsel, not a settled classification — but it is precisely the half of the question that decides whether an offshore service desk is safe to run for China, and it is the half a competitor who only measures speed can never answer.

No mainland-China region — residency, the portal, and automated triage

With some vendors the fix is to move onto a mainland instance the vendor runs. Atlassian Cloud is not one of them: as its own documentation shows, the locations you can pin data to are Australia, Canada, the EU, Germany, India, Japan, Singapore, South Korea, Switzerland, the United Kingdom and the USA, with a “Global” default — and not one is in mainland China. That settles several questions before performance ever enters the picture.

First, residency. If your organization is a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 — formerly Article 37 in the 2016 text, renumbered by the amendment in force January 1, 2026, the obligation unchanged). An offshore Jira Service Management Cloud tenant cannot satisfy that, whichever residency region you pick. Second, licensing. A public self-service or ticket portal actually served to mainland visitors from inside China is an internet information service, so it carries an ICP filing (备案) duty bound to a mainland hosting resource — and Atlassian Cloud offers none of its own to file against. Third, automated handling. Where auto-triage, predictive routing or agentic workflows profile or decide about individuals, PIPL Article 24 adds automated-decision-making duties: transparency, fairness, and an opt-out of decisions made solely by automated means. Which of these actually bite on your data is a risk to confirm with counsel against what you collect, your volumes, and who your users are.

The self-managed in-country option is closing

It is fair to ask the obvious question: can’t you simply run the self-managed Data Center edition on a server inside China and keep the data in-country? In principle that is one lawful shape — but it is a shape that is closing, and it would be dishonest to point you at it as a durable answer. Atlassian’s own licensing states that “On March 30, 2026 at 23:59 PST, new customers will no longer be able to purchase new Data Center subscriptions,” and that “End of life for impacted Data Center products … will take place on March 28, 2029,” after which they become read-only — with Jira Service Management Data Center named among the impacted products.

So the right thing to build around is the pattern, not the product: consented, in-country storage for the China-collected personal information and the CMDB and ticket data that must stay, with only what may lawfully leave reaching your global service desk. That pattern outlives any one vendor’s product lifecycle, and it is what 21YunBox stands up and integrates — with the legal conclusions settled alongside your counsel.

The lawful path — map, localize, deliver

There is a compliant way to run IT service management for a China-facing team, and it has a clear shape — three moves, in order.

Map. Our China compliance team inventories what your Jira Service Management instance holds — the China IT staff directory and requester identities, the CMDB and asset data, the content of incident and change tickets, and any China-facing self-service portal — establishes where it is hosted today, the ICP status of any public surface, and the consent and residency basis each flow relies on. We build the technical picture; the legal conclusions are settled with your counsel.

Localize. Keep the China-collected personal information and the CMDB and ticket data that must stay on a consented, China-resident store, protect that security-sensitive estate record, obtain the Article 13/23 notice-and-consent and an Article 24 opt-out for automated handling, and let only what may lawfully leave reach the service desk your team already uses — so your queues, workflows and automations keep working, without the ITSM becoming the thing that carries your estate’s data out of China unlawfully. Localize means keeping the data on an in-country path — never a route that ships it offshore anyway.

Deliver. Any China-facing self-service or ticket portal served to users in the mainland is a public service there, so it carries an ICP filing duty and needs compliant, in-country delivery. 21YunBox delivers it in-country — the 21YunBox Optimizer — set in front of what you already run, with no rebuild and no re-platform. The result is an IT service desk, and a China-facing portal, that run legally and compliantly for your users in China. What we do not do, and what no one lawfully can, is give you a way around China’s network controls: we keep in-country what must stay and deliver the rest compliantly from inside the mainland. 21YunBox is a compliance overlay and partner to the ITSM you already run, not a competitor to it.

Get a compliance assessment →

Tell us how your China team uses Jira Service Management and what your tickets and CMDB hold — we’ll map what may lawfully leave, localize what must stay in-country, and deliver your China-facing portal compliantly. Reach out and we’ll scope it with you and get you a quote.

Related reading:

• Cross-border data transfers under PIPL
• China’s Cybersecurity Law (data localization, Article 39)
• China’s Personal Information Protection Law (PIPL)
• How to get an ICP filing for China

RELATED TECHNOLOGIES

BMC Helix

BMC Helix

Freshservice

Freshservice

Ivanti Neurons for ITSM

Ivanti Neurons for ITSM

ManageEngine ServiceDesk Plus

ManageEngine ServiceDesk Plus