Does Metabase Work in China? Data Residency, ICP & Cross-Border Rules
Metabase is an open-source BI tool that queries your data and caches the results — so the China question isn't dashboard speed, it's where that cached data rests. Metabase Cloud saves cached results to US servers (a PIPL cross-border transfer); self-hosted Metabase runs in-country. A compliance-first look at Metabase's data residency, PIPL cross-border rules and Cybersecurity Law localization.
Does Metabase work in China?
Whether you can use Metabase in China is a data-residency question, not a speed one. Metabase is generally reachable from the mainland — the exposure is legal, in where the data it concentrates is allowed to rest.
Metabase is a BI tool: it queries your source systems and caches the results, holding saved questions, dashboards and user accounts. By Metabase's own documentation, a self-hosted instance keeps cached query results "saved to your application database," while on Metabase Cloud they are "saved to Metabase's servers in the United States." So a Cloud deployment puts your China users' analytical data — personal information under PIPL — offshore: a cross-border transfer PIPL governs, and for a CIIO or high-volume handler a data-localization problem a no-China-region cloud cannot solve. The lever is Metabase's other shape — it is open-source and self-hostable, so you can run it in-country.
This is a risk picture, not a verdict — your duties turn on your role and data volumes. Our China team can map your Metabase data exposure with you →
What Metabase's own documentation says about China
| Fact | Primary source |
|---|---|
| In Metabase's own words: Metabase "is built and packaged as a Java JAR file and can be run anywhere that Java is available" — it is open-source software you install yourself, via Docker, the JAR, Podman and more. Because you choose the infrastructure, a self-hosted instance can run on servers inside mainland China, keeping the data it holds in-country. | Metabase Docs — Installing Metabase, retrieved 2026-10-14 |
| Metabase caches the results of your queries. By its own caching documentation, if you self-host, "cached question results will be saved to your application database"; but "if you're using Metabase Cloud, cached question results will be saved to Metabase's servers in the United States." Metabase Cloud offers no mainland-China region, so a Cloud deployment holds your China analytical data offshore. | Metabase Docs — Caching, retrieved 2026-10-14 |
| Metabase concentrates personal information — the customer, user and employee records it queries and caches. When the people behind those records are in China and the instance (or Metabase Cloud) sits offshore, holding that data abroad is a cross-border transfer under PIPL (Articles 38–40): the handler owes notice, separate consent, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. | PIPL Articles 38–40 (cross-border transfer of personal information) |
| A critical-information-infrastructure operator or high-volume handler must store China personal information on the mainland — PIPL Article 40 and Cybersecurity Law Article 39 (formerly Article 37) (renumbered by the 2025 amendment, in force January 1, 2026, substance unchanged). Because BI concentrates data, a single Metabase deployment can tip a handler over the volume threshold; an offshore cloud cannot meet an in-country storage duty. | Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40 |
Sources verified by the 21YunBox compliance team on 2026-10-14.
For a team serving mainland China, the deciding question about Metabase is not whether a dashboard renders quickly or whether the app reaches your database — both are routine. It is where the data Metabase works with is allowed to come to rest. Metabase is a business-intelligence tool: it queries your source systems and builds the saved questions, dashboards, collections and cached result sets your teams read from — and that content is, overwhelmingly, your customers’, users’ and employees’ personal information. Metabase ships in two shapes that sit on opposite sides of the residency line. Metabase Cloud is the vendor-hosted, managed service. Self-hosted Metabase is open-source software you install and run on infrastructure you control — which can be inside mainland China. So “does Metabase work in China?” is really two questions with two answers, and both turn on data residency rather than milliseconds.
Metabase in China at a glance
| What decides it | In Metabase's own terms — and China's law |
|---|---|
| What it is | Two shapes under one name. Metabase Cloud is the vendor-hosted, managed SaaS. Self-hosted Metabase is open-source software you install and run yourself — it "is built and packaged as a Java JAR file and can be run anywhere that Java is available," on infrastructure you choose, which can be inside mainland China. |
| What it holds, and why it is personal information | Metabase queries data pulled from across your business — customer records, user accounts, transactions, employee data — and caches the results. Those cached result sets, saved questions, dashboards and user accounts are personal information under PIPL, some of it sensitive. Where they rest is a legal question, not a performance one. |
| Where cached results actually rest | Metabase's own caching documentation is explicit: self-host and "cached question results will be saved to your application database"; on Metabase Cloud they "will be saved to Metabase's servers in the United States." Metabase Cloud offers no mainland-China region, so a Cloud deployment holds the data offshore. |
| Loading China data into offshore Metabase | Holding the personal information of people in China in an offshore Metabase Cloud tenant is a cross-border transfer under PIPL (Articles 38–40): notice, a separate consent, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. |
| The in-country storage duty (CIIO / high-volume handler) | A critical-information-infrastructure operator or high-volume handler must keep China personal information on the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Because BI concentrates data, a single Metabase deployment can itself push a handler over the large-volume threshold; an offshore cloud cannot meet the duty. |
| The data-resident path | Run self-hosted, open-source Metabase on infrastructure inside China (or a licensed in-country option), keep the cached results and application database resident, and deliver the China-facing dashboards in-country on ICP-filed infrastructure. Reachability was never the test; residency is. |
Where the data actually rests
Metabase’s residency is set by which shape you run, not by a load-time test from Shanghai. Metabase Cloud is the fully managed service — Metabase runs the instance, and its caching documentation states plainly that on Cloud, “cached question results will be saved to Metabase’s servers in the United States.” There is no mainland-China region to select, so a Cloud deployment, by construction, sits offshore. Self-hosted Metabase is the other shape: the product “is built and packaged as a Java JAR file and can be run anywhere that Java is available,” installed via Docker, the JAR, Podman and other methods on infrastructure you control — and there the same documentation says “cached question results will be saved to your application database,” the database you host.
That distinction is the whole game for a China-facing deployment. Metabase is known for querying your source databases in place rather than copying them wholesale, and that genuinely limits how much raw data lands in the platform. But it does not move the residency question off the table. Metabase still caches the results of queries, and it holds your saved questions, dashboards, collections and user accounts in its application database. Those cached result sets and saved artifacts are themselves personal information — and they come to rest somewhere: on Metabase’s US servers in the Cloud case, or in your own application database when you self-host.
What it holds is personal information
A BI platform is a concentrator. It pulls from every source system — your warehouse, your transactional databases, your event streams — into one querying and reporting layer, then builds caches, saved questions and dashboards on top. That makes a Metabase deployment one of the largest single concentrations of personal information a company holds: customer records, user accounts, transactions, support history, employee data. Most of it is personal information under PIPL, and some — contact, financial and identity data — is sensitive personal information that draws heightened duties.
That is why residency, not reachability, is the test. When the personal information of people in China rests in an offshore Metabase Cloud tenant, you are making a cross-border transfer, and PIPL Articles 38–40 govern it: notice, separate consent, and one lawful transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. The security-assessment measures set when that assessment is mandatory rather than optional, and the duty scales with your role and your volumes, not with the act of switching Metabase on.
On top of the transfer rules sits a harder duty. A critical-information-infrastructure operator or a high-volume handler must store China personal information inside the mainland — PIPL Article 40 and the data-localization rule in Cybersecurity Law Article 39 (formerly Article 37) (renumbered by the 2025 Cybersecurity Law amendment, in force January 1, 2026, substance unchanged). Because BI concentrates data, a single Metabase deployment can itself tip a handler over the large-volume threshold that triggers that duty. An offshore Cloud tenant cannot satisfy it, because the data is, by definition, not in the country.
Why a reachability check misses this
Point a probe at Metabase from Shanghai and it will tell you the service loads — and that is exactly why the familiar “does it open from China?” question answers the wrong thing. Reachability is a delivery matter; it says nothing about where your cached results and saved dashboards are allowed to live. Two Metabase deployments can look identical from a browser in China and sit on opposite sides of the law: one on Metabase Cloud, with its cached results on US servers, and one self-hosted on mainland infrastructure, with the data resident. A speed test cannot see that difference. The residency of the data — not the latency of the dashboard — is what decides whether you can lawfully run Metabase for a China-facing audience, which is why this page publishes no first-party China latency figure for Metabase: a number without the data-residency context would answer the wrong question.
The lawful path — map, localize, deliver
21YunBox is a compliant overlay, not a migration — and a partner to your analytics team, not a competitor to it.
- Map. We read the PIPL cross-border, data-residency, data-localization (CII) and ICP obligations against your entity, your data volumes and whose personal information actually flows into Metabase — so you know which duties bite before you move anything.
- Localize. We run the analytics layer in-country so the personal information stays on mainland soil — typically a self-hosted, open-source Metabase instance on infrastructure inside the mainland, with its application database and cached results resident and the data store it reads from in-country too, or a licensed in-country equivalent. Localize means an in-country deployment, not reaching back to an offshore endpoint.
- Deliver. Any China-facing surface in front of the analytics layer — the dashboards, the embedded reporting, the reporting portals your mainland users open — runs over ICP-filed, in-country delivery (the 21YunBox Optimizer), in front of the stack you already run. No rebuild, no second codebase.
None of this is a legal ruling. Whether your operation is a critical-information-infrastructure operator, whether what you hold counts as important data, and which transfer mechanism (if any) your flows require are determinations to settle with qualified China counsel against what you actually load into Metabase — this page maps the exposure, it does not resolve it.
The result is an analytics layer that runs legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind.
Related reading
- Cross-border data transfers under PIPL
- China’s data-export security assessment measures
- China’s Cybersecurity Law — data localization at Article 39 (formerly Article 37)
- How to get an ICP license for a website in China
