Does Middleware.io Work in China? PIPL, Data Residency & Your Telemetry
Middleware.io is an offshore observability cloud with no mainland-China region — the logs, traces, metrics and RUM sessions it ingests from your China users carry personal data, so streaming it to Middleware's US stack is a PIPL cross-border transfer. A compliance-first look at the real door.
Does Middleware.io work in China?
Middleware.io is reachable from China, but reachability is the wrong test. It is an offshore observability cloud with no mainland-China region, and the logs, traces, metrics and session recordings it ingests from your China users carry their personal data — so streaming that telemetry to Middleware is a PIPL cross-border transfer to clear with counsel, not a settings tweak.
Middleware's own privacy policy says it "may collect personal information submitted through platform features such as logs, traces, and metrics," including "your name, email address, IP address, online identifiers," and that this data "may be collected, stored, accessed, or processed in countries outside of your own, including the United States." Its browser RUM, left at the default, "records the entire user session." Middleware "default[s] host in AWS and in Azure" with no China region, so for data collected from users in China this is a cross-border transfer PIPL governs (Articles 38–43), plus a data-localization duty for a CIIO or large-volume handler that an offshore stack cannot meet. The ICP filing is not Middleware's to hold — it attaches to the public app you are monitoring. The table below is Middleware's own wording and the rule each line triggers.
This is a risk map, not a verdict — what applies turns on your entity, the personal data inside your telemetry, and who your users are. Our China team can map your exposure with you →
Compliance snapshot
- ! Your logs, traces, metrics and RUM carry users' personal data
- ! China users' telemetry crosses the border to the US — PIPL applies
- ✕ No mainland-China region: your data lands offshore on AWS/Azure
- ! Browser RUM loads from and streams to offshore middleware.io endpoints
- ✓ ICP isn't Middleware's to hold — it sits on the app you monitor
What Middleware.Io's own documentation says about China
| Fact | Primary source |
|---|---|
| Middleware says the telemetry you send it carries personal data. Its privacy policy states "we may collect personal information submitted through platform features such as logs, traces, and metrics," and that this "can include details like your name, email address, IP address, online identifiers, and mailing address, as applicable." So the logs, traces and metrics streamed from your China users are not anonymous machine data — they are personal information, and routing them offshore is a cross-border transfer under PIPL (Articles 38–43). | Middleware.io Privacy Policy (middleware.io/privacy-policy/), retrieved 2026-10-07; PIPL Articles 38–43 |
| Middleware stores and processes that data offshore — in its own words, in the United States. The privacy policy says your personal information "may be collected, stored, accessed, or processed in countries outside of your own," "including the United States," relying on "European Commission–approved Standard Contractual Clauses (SCCs)" and the "EU-U.S. Data Privacy Framework." Those are EU/US transfer tools — neither is a PIPL mechanism. For data collected in China, PIPL requires its own notice, separate consent and a transfer route, and for a CIIO or large-volume handler the data must stay in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). | Middleware.io Privacy Policy (middleware.io/privacy-policy/), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
| There is no mainland-China region to land your data in. Middleware's hosting FAQ states, "We default host in AWS and in Azure, and can spin up new regions or in other Clouds as needed" — naming no data center inside mainland China. The default destination for your observability data is therefore offshore, which is exactly what turns a China-sourced telemetry stream into a cross-border transfer rather than an in-country one. | Middleware.io Docs — Cloud Hosting FAQ (docs.middleware.io/admin/faq/cloud-hosting), retrieved 2026-10-07 |
The browser RUM script loads from, and streams to, offshore Middleware endpoints — and records whole sessions. Middleware's RUM setup loads its library from https://cdnjs.middleware.io/…/middleware-rum.min.js and initializes against a https://<UID>.middleware.io target, with the docs noting recording: "1" "is the default value and records the entire user session." Every monitored China visitor's session is captured and exported offshore. The ICP filing, by contrast, is not Middleware's to hold: as a backend service it carries no ICP of its own — that obligation sits on the public app you are monitoring (State Council Order No. 292; MIIT Order No. 33). | Middleware.io Docs — Browser RUM Getting Started (docs.middleware.io/rum/getting-started), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the question to ask about Middleware.io is not whether its dashboard loads — it is what you are shipping to it and where that data comes to rest. Middleware is a full-stack observability cloud: your applications stream their logs, metrics, traces and real-user-monitoring sessions into it. That telemetry routinely carries personal data — IP addresses, user and session identifiers, and whatever ends up in your logs — and Middleware runs no region inside mainland China, so data gathered from your Chinese users crosses the border to its offshore stack. The dashboard working is the easy half; the cross-border transfer, and the licensing that sits on the app you are monitoring, are the exposure.
Middleware.io in China at a glance
| What decides it | In Middleware's own terms |
|---|---|
| Where it runs | Middleware “default[s] host in AWS and in Azure, and can spin up new regions or in other Clouds as needed,” naming no region inside mainland China — so the default destination for your data is offshore. |
| What you send it | Logs, traces, metrics and browser RUM. Middleware “may collect personal information submitted through platform features such as logs, traces, and metrics,” including “your name, email address, IP address, online identifiers.” |
| Browser RUM | Its script loads from cdnjs.middleware.io and streams to a <UID>.middleware.io target; left at the default, recording “records the entire user session.” |
| Where your data lands | “may be collected, stored, accessed, or processed in countries outside of your own, including the United States,” under SCCs and the EU-U.S. Data Privacy Framework — transfer tools built for EU/US law, not PIPL. |
| ICP filing | Not Middleware's to hold. A backend service carries no ICP; the filing attaches to the public app you monitor, on its own mainland hosting. |
What you send Middleware is personal data — in its own words
Middleware is a full-stack observability platform: your applications stream their logs, metrics, traces and real-user-monitoring sessions into it. Middleware is candid about what that payload contains. Its privacy policy says it “may collect personal information submitted through platform features such as logs, traces, and metrics,” and that such information “can include details like your name, email address, IP address, online identifiers, and mailing address, as applicable.” Its browser RUM goes further: the default setting “records the entire user session,” and a session cookie “collects all the actions from a user’s visit across different pages.” Telemetry, in other words, is not anonymous machine exhaust — for your Chinese users it is their personal information, and that is what turns a monitoring pipeline into a data-protection question.
Where it lands: offshore, under mechanisms built for other laws
Middleware runs no region inside mainland China. Its hosting FAQ states plainly, “We default host in AWS and in Azure, and can spin up new regions or in other Clouds as needed,” and the privacy policy says your personal information “may be collected, stored, accessed, or processed in countries outside of your own,” “including the United States.” To legitimize that, Middleware leans on “European Commission–approved Standard Contractual Clauses (SCCs)” and the “EU-U.S. Data Privacy Framework” — instruments written for EU and US law. China’s Personal Information Protection Law is not covered by either. For personal data gathered from users in China, PIPL treats the export as a cross-border transfer with its own duties — notice, separate consent, and one approved mechanism (a CAC security assessment, the CAC standard contract, or certification), under Articles 38–43. And if you are a critical information infrastructure operator or a large-volume handler, that personal information must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore observability cloud cannot satisfy.
The browser RUM script is an offshore round-trip
There is a second, quieter edge to watch. Middleware’s real-user-monitoring installs as a browser script that loads its library from an https://cdnjs.middleware.io/…/middleware-rum.min.js URL and initializes against an https://<UID>.middleware.io target. Every page view by a visitor in China therefore fetches code from, and ships session data to, endpoints outside the mainland. That is both a reachability consideration — the script and agents depend on those offshore hosts resolving and responding from inside China — and a continuous data-export one, since the RUM stream (device, IP, approximate location, pages viewed, cursor activity) leaves the country the moment it is captured. Neither is a speed problem you tune away; both are facts about where the data flows.
ICP is your app’s door, not Middleware’s
One thing Middleware does not put on you is its own ICP filing. An ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33 attaches to a public-facing website or app served from inside the mainland — that is the application you are monitoring, on its own mainland hosting, not the backend observability service watching it. So “do we need an ICP for Middleware?” is the wrong frame: Middleware holds none and grants none, and the licensing duty rests with the property it instruments. What Middleware adds to your China picture is the data pathway above — the cross-border flow of personal information inside your telemetry — which is the half that actually decides whether using it is compliant.
This is a risk map, not a verdict: whether PIPL consent, a transfer mechanism, in-country storage, or all three apply to your telemetry turns on your entity, how much personal data your logs and RUM carry, and who your users are — worth settling with counsel before you wire it up.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Middleware exactly as you have it. We do not replace your observability stack or re-point your telemetry; we add the piece a backend monitoring cloud never could — compliant, ICP-filed delivery from inside the mainland, set in front of the existing origin of the app Middleware watches, with no rebuild and no second codebase. Our China team maps where the personal data in your logs, traces, metrics and RUM crosses the border, weighs your PIPL cross-border and data-residency exposure against your entity and data volumes, and stands up the in-country delivery and storage a lawful China presence requires — so the application stays where it already runs and the compliance gaps get closed around it.
Related reading:
Frequently Asked Questions
Does Middleware.io have a China region, or keep our data in the mainland?
No. Middleware's own hosting FAQ says it "default[s] host in AWS and in Azure," and names no mainland-China region. Your logs, traces, metrics and RUM sessions come to rest offshore — the privacy policy says they may be "stored, accessed, or processed" in "the United States." For personal data collected from users in China, sending it there is a cross-border transfer under PIPL, and for a CIIO or large-volume handler China-collected personal information must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)).
Do we need an ICP filing to use Middleware.io in China?
Not for Middleware itself. Middleware is a backend observability service, so it holds no ICP filing and does not give you one; the ICP obligation attaches to the public website or app you are monitoring, served from its own mainland hosting (State Council Order No. 292; MIIT Order No. 33). What Middleware adds is a data pathway: its browser RUM script and agents load from and stream to offshore middleware.io endpoints, so the live question is a cross-border data-export and reachability one, not an ICP one — worth settling with counsel.
Can 21YunBox help us run Middleware.io compliantly in China?
Yes. Our China team can map where the personal data inside your telemetry crosses the border — assessing your PIPL cross-border and data-residency exposure for your entity, data volumes and users — and stand up the ICP-filed, in-country delivery a compliant China presence needs in front of the app you are monitoring, with your Middleware stack left exactly as it is. Get in touch to work through your specific case.
