Does KnowBe4 Work in China? Data Residency, ICP & Cross-Border Rules
KnowBe4 is a cloud-only security-awareness and phishing-simulation platform holding your workforce's roster PII and who-clicked results. Its instances sit in the US, EU, UK, Canada and Germany — none in mainland China — so China employee data rests offshore under PIPL cross-border rules.
Does KnowBe4 work in China?
Whether KnowBe4 works in China is first a data-residency and cross-border question, not a reachability one. A security-awareness and simulated-phishing platform holds your workforce's personal information — the employee roster and the record of who clicked, reported or failed each test — and China's law follows that data wherever it is kept.
KnowBe4 is cloud-only SaaS: its own documentation lists instances only in the US, EU, UK, Canada and Germany, with none in mainland China and no self-hosted edition, and says personal data "will always be processed in the United States." So the behavioral profile of your China employees — a ranked map of who is most likely to be phished — comes to rest offshore, a cross-border transfer PIPL governs, and for a CIIO or high-volume handler an in-country storage duty an offshore cloud cannot meet.
This is a risk map, not a verdict — your duties turn on your entity, data volumes and who your users are. Our China compliance team can map your KnowBe4 exposure with you →
What KnowBe4's own documentation says about China
| Fact | Primary source |
|---|---|
| In KnowBe4's own Data Protection Impact Assessment: "KnowBe4 operates instances located within the US, EU, UK, Canada, and Germany instances" — with no mainland-China instance on the list — and its platform (security-awareness training, KCM GRC, PhishER and SecurityCoach) is "built in the cloud leveraging Amazon AWS." KnowBe4 is cloud-only SaaS with no self-hosted edition, so a China workforce's data has nowhere in-country to rest. | KnowBe4 — KSAT, KCM GRC, PhishER & SecurityCoach DPIA (server locations; cloud architecture), retrieved 2026-10-14 |
| Picking a region does not keep the data there. The same DPIA notes "Customers may choose where data is stored during the course of the services," but adds that "generally personal data will always be processed in the United States" because KnowBe4 relies on US-based subprocessors. The workforce data a security-awareness platform collects — the roster plus who clicked, reported or failed each campaign — therefore rests and is processed offshore. | KnowBe4 — KSAT, KCM GRC, PhishER & SecurityCoach DPIA (storage choice; US processing), retrieved 2026-10-14 |
| Employee personal information collected in China and sent to a US or EU KnowBe4 instance is a cross-border transfer. Under PIPL the handler — you, the employer, not KnowBe4 — must give notice, obtain separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–40). | Personal Information Protection Law, Articles 38–40 |
| A critical information infrastructure operator or high-volume handler must store personal information collected in the mainland inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). An offshore-only security-awareness cloud with no mainland instance structurally cannot meet that in-country storage duty. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-14.
For a team rolling out security-awareness training to staff in mainland China, the question about KnowBe4 was never whether employees can reach the platform or load a training module — you point a browser at it and the phishing tests and courseware run. The real question is a residency one: where is the workforce data KnowBe4 holds allowed to come to rest? A security-awareness and simulated-phishing platform concentrates something unusually sensitive — not email bodies or source code, but a behavioral record of your people. It keeps the employee roster — names, work emails, department, manager — and, for every campaign, who opened the lure, who clicked, who reported it and who failed the follow-up training: a ranked, per-person map of which of your staff are most likely to be phished. KnowBe4 is cloud-only software-as-a-service — there is no self-hosted edition to stand up in-country, and its instances sit offshore. So the tool you bought to reduce human risk is itself an offshore cross-border path for your workforce’s behavioral data.
KnowBe4 in China at a glance
| What decides it | In KnowBe4's own terms — and China's law |
|---|---|
| Where the workforce data physically rests | KnowBe4 is cloud-only SaaS; your account is pinned to one instance. Its own Data Protection Impact Assessment says it "operates instances located within the US, EU, UK, Canada, and Germany instances" and that the platform is "built in the cloud leveraging Amazon AWS" — none in mainland China, and no self-hosted edition to run in-country. It adds that "personal data will always be processed in the United States." |
| What it ingests, and why residency bites | A security-awareness platform sees your people: the employee roster (names, work emails, department, manager) and, per campaign, who opened, clicked, reported or failed — a behavioral profile of your workforce, often with a per-person risk score. That is personal information under PIPL directly, not by reference, and the profile itself is what crosses the border. |
| Your mainland employees' data | Roster and campaign results collected from staff in China and held on a US or EU instance are a cross-border transfer PIPL governs: notice, a separate consent, and one transfer mechanism (PIPL Articles 38–40). The handler on the hook is you, the employer — not KnowBe4. |
| In-country storage duty | A critical information infrastructure operator or high-volume handler owes an in-country storage duty an offshore cloud cannot meet — mainland personal information and important data must stay in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged. |
| Is it reachable? | Treat reachability as the delivery half, not the question — browsers and training modules reach the cloud fine. Because KnowBe4 is cloud-only with no self-hosted edition, the lawful lever is to run the workforce-data layer in-country on a licensed in-country or sovereign equivalent, and any China-facing surface in front of it — the admin console, the reporting portal, the training page your staff hit — needs an ICP filing tied to a mainland hosting resource (State Council Order No. 292; MIIT Order No. 33). |
Where the workforce data actually rests
KnowBe4 does not give you a mainland region to toggle. Its own Data Protection Impact Assessment — covering the security-awareness training, KCM GRC, PhishER and SecurityCoach products — states that it “operates instances located within the US, EU, UK, Canada, and Germany instances.” A customer may choose among those at setup, but the list stops there: there is no mainland-China instance to select, and KnowBe4 is “built in the cloud leveraging Amazon AWS,” with no self-hosted edition you could install on in-country infrastructure. Point your organization at KnowBe4 and your workforce data lands on one of those offshore instances.
Choosing a region does not keep the data in that region, either. The same assessment notes that “generally personal data will always be processed in the United States” because KnowBe4 relies on US-based subprocessors. So even an EU instance routes processing back through the United States — and for a China workforce, the roster and every campaign result have, by that point, left the mainland. Under the Personal Information Protection Law, moving the China personal information those records contain out of the country is a cross-border transfer, and the handler responsible is you, the employer.
What it holds is personal information — and the irony is exact
KnowBe4 earns this scrutiny because of what a security-awareness platform concentrates. Most tools touch one slice of your data; this one holds a behavioral record of your people. The roster alone — names, work emails, department, reporting line — is personal information. Add the campaign history, and you hold something sharper: a per-person, timestamped account of who opened each simulated lure, who clicked, who handed over credentials to a fake page, who reported it, and who failed the remedial training — frequently distilled into a risk score for each named employee. That is a profile of your staff, and for a China workforce it is the personal information of people in the mainland.
The irony is the whole point for a security buyer: the platform you deployed to reduce human risk holds the most revealing map of that risk — which of your China employees are most likely to be fooled — and keeps it offshore. That is not merely a best-practice concern. For a critical information infrastructure operator, and for a handler whose volumes cross the regulators’ thresholds, personal information collected in the mainland must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). An offshore security-awareness cloud with no mainland instance structurally cannot satisfy that duty — the workforce data is, by definition, in the wrong country. And where an export is permitted at all, crossing a volume threshold can trigger a CAC-led data-export security assessment before any of it lawfully leaves.
Running it on a no-China-region cloud doesn’t meet the residency duty — and what does
The honest summary is narrow and important: nothing about KnowBe4 is “blocked,” and the exposure is not the software — it is a managed service that parks a behavioral profile of your mainland workforce outside the mainland. There is a wrinkle specific to this vendor, though: KnowBe4 is cloud-only. There is no self-hosted KnowBe4 edition you can stand up on mainland-China infrastructure, so the in-country lever here is not “run the vendor’s binary locally.” It is to run the workforce-data layer in-country another way — a lawful in-country or licensed sovereign-cloud equivalent that keeps the roster and campaign results on mainland soil — while only a minimized, consented, lawfully transferable subset ever crosses the border. Pointing a mainland connector back at KnowBe4’s offshore instances is not localization and does not meet the storage duty; standing up a lawful in-country equivalent is. Any China-facing surface in front of the platform — the admin console, the reporting portal, the training page your mainland staff reach — earns its own ICP filing tied to a mainland host.
This is a risk map, not a verdict. Whether you owe in-country storage, a transfer mechanism, a separate consent, an ICP filing, or some combination turns on your entity, your data volumes, how many of the people in your campaigns are in the mainland, and how the results are used — and it is worth settling with counsel before you decide where a single employee’s record comes to rest.
The lawful path — map, localize, deliver
You do not have to drop KnowBe4 to run security-awareness training lawfully for mainland China. 21YunBox is a compliant overlay, not a migration — and, for a platform you already run, a partner that sits alongside your stack, not a competitor to it. There are three moves, and they fit together.
Map. Our China compliance team reads your PIPL cross-border, data-residency and data-localization (CII) obligations against your actual entity, your campaign volumes, and whose personal information your roster and results carry — so the exposure is written down before anything is moved.
Localize. Because the risk is where the workforce data rests, we run the workforce-data layer in-country — on a licensed in-country or sovereign-cloud equivalent — so the roster and campaign results China requires to stay on mainland soil do. Localize means a lawful in-country deployment of that data layer, never a route back to an offshore endpoint; only the minimized, lawfully transferable subset ever crosses.
Deliver. For any China-facing surface in front of the platform — the admin console, the reporting portal, the training or self-service page your mainland staff hit — the 21YunBox Optimizer provides ICP-filed, in-country delivery, in front of the stack you already run. No rebuild, no second codebase. 21YunBox never uses or suggests circumvention of any kind; the entire point is a lawful, filed, in-country path.
The goal is plain: your security-awareness program runs legally and compliantly for your people in China.
Related reading:
- How to get an ICP filing for China
- Cross-border data transfers under PIPL
- China’s Cybersecurity Law and data localization
- China’s Personal Information Protection Law
