Does Kong Gateway Work in China? Self-Hosted vs Konnect, ICP & PIPL
Kong Gateway is software you deploy, so compliance turns on where you run it: self-host the data plane on licensed, in-country infrastructure and it can be lawful inside the mainland — but Kong Konnect's control plane is hosted offshore with no mainland-China geo, and routing mainland users' API traffic across the border raises PIPL. A compliance-first look at both models.
Does Kong Gateway work in China?
It depends where you run it. Kong Gateway is software you deploy, not a hosted service — self-host the data plane on licensed, in-country infrastructure and it can sit lawfully inside the mainland, but lean on Kong Konnect's cloud control plane, or run the gateway offshore, and you inherit a PIPL cross-border and data-residency question.
Kong describes Konnect as combining "a control plane, managed by Kong and hosted in the cloud, with the versatility of managing the data plane on your terms," and its control-plane geos are Australia, Europe, the Middle East, the United States, India and Singapore — none inside mainland China. The gateway's data plane is the node that sits in your users' request path; place it offshore, or route mainland traffic across the border to reach it, and that is a cross-border transfer of personal information PIPL governs (Articles 38–43; localization under Article 40 and Cybersecurity Law Article 39 (formerly Article 37)). Kong itself carries no ICP — that falls on the public API it fronts, which needs a filing on an in-country host. The table below is Kong's own wording and the rule each choice triggers.
This is a risk map, not a verdict — which setup is lawful turns on which Kong model you run, where your data plane sits, and who your users are. Our China team can map your exposure with you →
What Kong Gateway's own documentation says about China
| Fact | Primary source |
|---|---|
| Kong Gateway is software you deploy; Kong Konnect is a control plane Kong runs for you. Kong describes Konnect as combining "a control plane, managed by Kong and hosted in the cloud, with the versatility of managing the data plane on your terms," offered as a serverless gateway, Dedicated Cloud Gateways "fully managed by Kong," or self-hosted data plane nodes you run yourself. Self-host the gateway on in-country, ICP-filed infrastructure and it can sit inside the mainland; lean on the managed control plane and part of your stack is offshore by design. | Kong — Konnect overview (developer.konghq.com/konnect), retrieved 2026-10-07 |
| Konnect's control plane runs only in the geos Kong offers — none inside mainland China. Kong: "Konnect allows you to host and operate your cloud instance in a geographic region that you specify," and the supported control-plane geos are Australia, Europe, the Middle East, the United States, India and Singapore. There is no mainland-China region, so a Konnect-managed control plane — and the configuration and analytics it holds — resides outside the mainland; the nearest, Singapore, is still offshore for cross-border transfer purposes under PIPL. | Kong — Geographic Regions (developer.konghq.com/konnect-platform/geos), retrieved 2026-10-07; PIPL Articles 38–43 |
| The data plane sits in your users' request path; the control plane ingests only traffic metadata. In Kong's words, "Data plane nodes send usage information to the Control Plane for Analytics and for account billing," and "Analytics tracks aggregate traffic by Gateway Service, Route, and the consuming application" — Kong adds that "Telemetry data does not include any customer information or any data processed by the Data Plane." The personal data itself flows through the data plane node you place, so where that node runs — in-country or offshore — is what decides the cross-border question (PIPL Articles 38–43 and 40; Cybersecurity Law Article 39 (formerly Article 37)). | Kong — Control Plane and Data Plane communication (developer.konghq.com/gateway/cp-dp-communication), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
| Konnect isolates your consumer and service objects to the geo you choose — and none of them is in the mainland. Kong notes that objects "like Consumers and Gateway Services" inside a Konnect instance are "geo-specific," and that "only authentication, billing, and usage is shared between Konnect geos." Since every available geo is offshore, that data stays outside mainland China by design. Kong itself carries no ICP — the public API it fronts needs an ICP filing tied to an in-country host (State Council Order No. 292; MIIT Order No. 33), and an API served from offshore has nothing in the mainland to file against. | Kong — Geographic Regions (developer.konghq.com/konnect-platform/geos), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
Whether Kong Gateway “works” in mainland China is a question about where you run it, not how fast it loads. Kong Gateway is software you deploy, so the honest answer is not a flat yes or no: self-host the gateway on licensed, in-country infrastructure and it can sit lawfully inside the mainland; reach for Kong Konnect’s cloud control plane, or run the gateway offshore and route mainland traffic across the border to it, and you take on a cross-border personal-data question China’s law governs. The gateway sits in your users’ request path — so where it sits is the compliance decision, and Kong documents the pieces in its own words.
Kong Gateway in China at a glance
| What decides it | In Kong's own terms |
|---|---|
| Which model you run | Kong Gateway is software you deploy; Kong Konnect adds “a control plane, managed by Kong and hosted in the cloud,” while you manage “the data plane on your terms” — self-hosted, serverless, or Kong's Dedicated Cloud Gateways. |
| Konnect's regions | Konnect control-plane geos are Australia, Europe, the Middle East, the United States, India and Singapore. None is inside mainland China; the nearest, Singapore, is still offshore. |
| What sits in the request path | The data plane node serves your users' API traffic. Where you place it — in-country or offshore — decides whether mainland users' personal data crosses the border. |
| What the control plane holds | “Data plane nodes send usage information to the Control Plane for Analytics and for account billing,” tracking traffic “by Gateway Service, Route, and the consuming application.” Kong states telemetry “does not include any customer information or any data processed by the Data Plane.” |
| ICP & residency | Kong holds no ICP of its own; the public API it fronts needs one, on an in-country host. Personal data of mainland users processed offshore is a cross-border transfer PIPL governs. |
Two deployment models, two very different answers
Kong Gateway and Kong Konnect are not the same decision. Kong Gateway is open, self-managed software: you run the data plane wherever you choose — including on licensed, in-country infrastructure inside the mainland. Kong Konnect is Kong’s SaaS: in Kong’s words it combines “a control plane, managed by Kong and hosted in the cloud, with the versatility of managing the data plane on your terms,” offered as a serverless gateway, Dedicated Cloud Gateways “fully managed by Kong,” or self-hosted data plane nodes you run yourself. So the first thing that decides whether Kong “works” in China is which of these you are actually running — and the answer is genuinely different for each.
The control plane is hosted by Kong — and never in the mainland
Choose Konnect and the control plane lives in a Kong-operated geo. Kong: “Konnect allows you to host and operate your cloud instance in a geographic region that you specify” — and the geos on offer are Australia, Europe, the Middle East, the United States, India and Singapore. There is no mainland-China region, so the control plane that holds your configuration, your consumer and service objects, and your analytics sits outside the mainland by design. Kong even notes that objects “like Consumers and Gateway Services” are “geo-specific,” isolated to the geo you pick — which, for a China audience, is exactly the point: that geo is always offshore, and the closest one, Singapore, is still across the border.
Where the personal data actually flows
The piece that carries your users’ personal data is the data plane — the Kong node that serves traffic in the request path. Kong is careful about what leaves it: “Data plane nodes send usage information to the Control Plane for Analytics and for account billing,” and Analytics “tracks aggregate traffic by Gateway Service, Route, and the consuming application,” while “Telemetry data does not include any customer information or any data processed by the Data Plane.” So the control plane’s offshore residency is about configuration and traffic metadata, not raw user records. The cross-border question lands squarely on the data plane: if it runs offshore, or if mainland users’ requests travel across the border to reach it, their personal information makes a cross-border transfer under China’s Personal Information Protection Law — notice, separate consent and one transfer mechanism (Articles 38–43) — and for a critical information infrastructure operator or large-volume handler, that data must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)).
Kong carries no ICP — the API it fronts does
An API gateway is infrastructure, not a public website, so there is no “Kong ICP.” But the public-facing API or app that Kong serves to mainland visitors does need an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically in the mainland. Run the gateway and its origin offshore and there is nothing in-country to file against; place them inside the mainland and the filing has a home. This is the half that “we already run Kong” doesn’t settle: reachable software is not the same as a licensed, filed presence.
This is a risk map, not a verdict: whether you need in-country placement, an ICP filing, a cross-border mechanism, or all three depends on which Kong model you run, how much personal data you hold, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Kong exactly as you do. We add the piece neither the open-source gateway nor Konnect’s offshore control plane gives you: compliant, ICP-filed delivery from inside the mainland, set in front of your existing Kong origin — no rebuild, no second codebase, and no move off Kong or Konnect. Our China team maps which model you run and where your data plane sits, assesses your PIPL cross-border and data-residency obligations for your entity and data volumes, and stands up the in-country, filed delivery a lawful China presence needs — while your gateway configuration stays exactly where it already lives.
Related reading:
