Does Khoros Work in China? Data Residency, ICP & Cross-Border Rules
Khoros hosts branded communities and social/digital-care engagement on AWS in the US, Ireland and Australia — no mainland-China region — so your China community's posts, profiles and care histories rest offshore as a PIPL cross-border transfer, and a public China-facing community also carries an ICP filing and content-moderation duties. A compliance-first look.
Does Khoros work in China?
What decides Khoros in mainland China isn't whether the community loads — it's that a public, China-facing branded community is itself an internet information service, so it carries an ICP filing (备案) and content-moderation duties, while the posts, profiles and care histories it holds for your China members rest offshore.
Khoros's own trust documentation places the platform on Amazon Web Services datacenters in the US, Ireland and Australia, with no mainland-China region — so the community posts, member profiles, direct messages and care-case histories it collects from people in China are stored offshore: a cross-border transfer of personal information PIPL governs (Articles 38–40, 数据出境), on notice, a separate consent (Articles 13 and 23), and one transfer mechanism; for a CIIO or large-volume handler, an in-country storage duty too (Article 40; Cybersecurity Law Article 39 (formerly Article 37)). The distinctive half a speed test never sees: because your community publishes Chinese users' user-generated content to the public, it needs an ICP filing bound to mainland hosting, plus the real-name and content-review obligations China places on anyone hosting that speech.
This is a risk map, not a verdict — whether you owe a transfer mechanism, in-country storage, an ICP filing, content moderation, or some combination turns on your entity, your data volumes and who your members are. Our China team can map your exposure with you →
What Khoros's own documentation says about China
| Fact | Primary source |
|---|---|
| Khoros hosts on AWS in the US, Ireland and Australia — never mainland China. Its Trust Center states that Khoros “primarily hosts its products in Amazon Web Services (AWS) datacenters located in the US, Ireland, and Australia.” No region sits inside mainland China, so the community posts, member profiles, messages and care histories it collects from your China users are stored offshore. | Khoros — Trust Center, Physical Security (khoros.ai/legal), retrieved 2026-10-12 |
| Khoros's security overview names the same three offshore regions and no other. It states that “Khoros products are hosted on Amazon Web Services (AWS) in The United States, Ireland and Australia,” and that Khoros “utilizes AWS as its hosting platform.” There is no mainland-China deployment and no customer-run, in-country self-host to anchor an on-shore install to. | Khoros — Security Overview (assets.khoros.com), retrieved 2026-10-12 |
| China-origin community and care data sent offshore is a cross-border transfer PIPL governs. Because the posts, profiles, DMs and case histories are collected from people in the mainland and stored in the US, Ireland or Australia, you — the handler, with Khoros the processor — owe notice, a separate consent and one transfer mechanism under PIPL Articles 38–40 (数据出境), on the consent conditions in Articles 13 and 23. A CIIO or large-volume handler must keep China-collected personal information in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)), which an offshore-only platform cannot do. | PIPL Articles 13, 23, 38–40; Cybersecurity Law Article 39 (formerly Article 37) |
| A public, China-facing branded community is an internet information service — so it carries an ICP filing and content-moderation duties. A community that publishes Chinese users' user-generated content to the public must be served from an ICP-filed (备案) mainland hosting resource (State Council Order No. 292; MIIT Order No. 33), and operators hosting that speech owe real-name registration and active content review under China's cybersecurity and online-content rules — duties a hosted offshore platform does not discharge for you. | State Council Order No. 292; MIIT Order No. 33; PRC Cybersecurity Law (real-name and content administration), retrieved 2026-10-12 |
Sources verified by the 21YunBox compliance team on 2026-10-12.
For a brand that wants a presence in mainland China, the question about Khoros was never whether the community loads or the care console opens — it usually does. The question is where the records behind it are allowed to come to rest, and what a public, China-facing community obliges you to do before you may run one at all. Khoros runs branded online communities, social-media management, and digital-care engagement: it holds the posts, replies and threads your members write, their profiles and sign-in identities, the direct messages and social conversations your team handles, and the case histories of the people you serve. Much of that is personal information the moment it identifies someone — and a community is user-generated content by design. By Khoros’s own trust documentation, the platform is hosted on Amazon Web Services in the United States, Ireland and Australia, with no mainland-China region. So a China rollout meets three doors at once, and not one of them turns on latency: a cross-border transfer of the community and care data it stores, an ICP filing for the public community surface, and the content-moderation duties that attach to anyone hosting Chinese users’ speech.
Khoros in China at a glance
| What decides it | In Khoros's own terms — and China's law |
|---|---|
| What it holds, and why it's personal information | A branded community and a social/care operation are built from people: the posts, replies and threads your members publish; their display names, avatars, bios, sign-in identities and member profiles; the direct messages and social conversations your team handles; and the case histories of the customers you serve. Each is personal information the moment it identifies someone, and a care thread can surface Article 28 sensitive personal information — a health, payment-account or ID detail — which carries a higher bar of specific purpose, strict necessity and separate consent. |
| Where the records live | Khoros's Trust Center states it "primarily hosts its products in Amazon Web Services (AWS) datacenters located in the US, Ireland, and Australia." Its published hosting regions — the United States, Ireland and Australia — include none in mainland China, and there is no customer-run, in-country self-host to anchor an on-shore install to. |
| Your mainland data on the platform | Posts, profiles, direct messages and care histories collected from people in China and written to an offshore region is a cross-border transfer PIPL governs — notice, a separate consent, and one transfer mechanism (PIPL Articles 38–40, 数据出境; consent under Articles 13 and 23). A CIIO or large-volume handler also owes an in-country storage duty the hosted platform cannot meet (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39 (substance unchanged). |
| A public community is an internet information service | This is the half a reachability check never sees. A branded community that publishes Chinese users' user-generated content to the public is itself a public internet information service — so the surface needs an ICP filing (备案) tied to a mainland hosting resource (State Council Order No. 292; MIIT Order No. 33), and operating it brings real-name registration and content-review obligations on the speech your members post. A hosted offshore platform discharges none of that for you. |
| Is it reachable? | Treat reachability as the delivery half, not the question. And to the extent you manage Chinese social presence through Khoros — WeChat, Weibo, Douyin, RED — those platforms are a walled, licensed, real-name, content-reviewed domain that a western social-management tool does not natively hold domestic API access to: a platform-access and content-compliance question a speed test never raises. |
No mainland region, so the community record leaves the country
Khoros is explicit, in its own trust documentation, about where it runs: it “primarily hosts its products in Amazon Web Services (AWS) datacenters located in the US, Ireland, and Australia,” and its security overview repeats that “Khoros products are hosted on Amazon Web Services (AWS) in The United States, Ireland and Australia.” None of those is in mainland China, and because the platform is a managed SaaS there is no customer-run deployment to point an in-country install at. So when a member in China writes a post, your agent answers a direct message, or your team resolves a care case for someone in the mainland, the resulting records are written to whichever offshore region your environment sits in. Under China’s Personal Information Protection Law, sending personal information collected in the mainland to one of those regions is a cross-border transfer — and the handler on the hook is you, the brand running the community, not only the vendor. That transfer owes notice, a separate consent, and one approved mechanism — a CAC security assessment, the CAC standard contract, or certification — under PIPL Articles 38–40, and for a critical-information-infrastructure operator or a large-volume handler it collides with an in-country storage duty an offshore-only platform cannot satisfy.
A branded community is a public internet information service — ICP and content governance follow
Here is the part that separates a community platform from an ordinary offshore SaaS, and it is the part a connectivity test is structurally blind to. A branded community is not a private back office: it is a public surface that publishes your members’ user-generated content to anyone who visits. Under China’s framework that makes the community itself an internet information service, and two distinct duties attach. First, the public surface must be served from an ICP-filed (备案) mainland hosting resource (State Council Order No. 292; MIIT Order No. 33) — a filing bound to in-country hosting, which an offshore AWS region cannot carry. Second, hosting other people’s speech brings content-governance obligations: real-name registration of the people who post, and an active content-review duty over what they publish, under China’s cybersecurity and online-content rules. A hosted, offshore community platform provides neither the filing nor the moderation posture for you; they are the operator’s to meet. And where you route Chinese social presence — WeChat, Weibo, Douyin, RED — through the same tool, you meet a third walled domain: those platforms require domestic, real-name, content-compliant API access that a western social-management suite does not natively hold. Whether you owe an ICP filing, which content-moderation controls apply, which transfer mechanism fits, and whether in-country storage under Cybersecurity Law Article 39 (formerly Article 37) binds you turns on your entity, your data volumes and who your members are — settle it with counsel before you point a single mainland member at the community.
Loading the community isn’t the question — a compliant in-country path is
It is tempting to treat a China rollout as a connectivity problem, but reachability was never the deciding variable here. Khoros can let you minimize fields, shorten retention, or pick a non-U.S. region on your order — each narrows what is kept or where it defaults to, and none changes the two facts that decide this: the region on offer is always offshore, so mainland personal information still crosses the border; and a public community that hosts Chinese users’ content still needs an ICP filing and content moderation that an offshore platform does not provide. The lawful shape is different in kind: keep the community posts, member profiles, messages and care histories that must stay on mainland soil in-country and minimize what is collected; obtain the Article 13/23 notice and the separate consent the transfer requires; file any China-facing community surface and stand up the real-name and content-review posture it owes; and treat Chinese social-platform access as the licensed, domestic domain it is. This is a risk map, not a verdict — whether a transfer mechanism, in-country storage, an ICP filing, content moderation, or some combination applies to you is a question for qualified counsel against what you actually run.
The lawful path — map, localize, deliver
You do not have to drop Khoros to run it lawfully for mainland China. 21YunBox is a compliant overlay, not a migration — and for an enterprise platform like this, a partner that sits alongside the community and care suite you already run, not a competitor to it. There are three moves, and they fit together.
Map. Our China compliance team reads your PIPL cross-border, data-residency, ICP and content-governance obligations against your actual entity, your data volumes, and who your mainland members and customers are — so the exposure in your community, social and care records is written down before anything is rewired.
Localize. Because the hosted platform has no mainland region, we stand up consented, in-country storage and processing for the records that must stay on mainland soil — so the community and care data China requires to remain in-country does, while only the minimized, lawfully transferable subset ever reaches an offshore tenant, and the real-name and content-review posture the community owes is met.
Deliver. For any China-facing community or care surface — the community site, a member sign-in, a self-service help center — the 21YunBox Optimizer provides ICP-filed, in-country delivery, in front of the stack you already run. No rebuild, no second codebase, no move off the platform. 21YunBox never uses or suggests circumvention of any kind; the entire point is a lawful, filed, in-country path.
The goal is plain: your community and engagement program runs legally and compliantly for your members in China.
Related reading:
- How to get an ICP filing for China
- Cross-border data transfers under PIPL
- China’s Cybersecurity Law — data localization (Article 39, formerly Article 37)
- China’s Personal Information Protection Law (PIPL)
