Does Northpass Work in China? ICP, PIPL & Where Your Learner Data Lives
Northpass — now Gainsight's Customer Education platform — stores your learners' data in US data centers with no mainland-China region, so a China-facing academy is served offshore: learner personal data becomes a cross-border transfer under PIPL and the public academy has no ICP-filing path. A compliance-first look at the two doors.
Does Northpass work in China?
It loads — but that is the smaller question. Northpass, now Gainsight's Customer Education platform, keeps your learners' names, emails and course records in US data centers with no mainland-China region, so serving Chinese learners is a compliance exposure before it is a speed one.
In its own privacy notice Gainsight states “We maintain primary data centers in the USA,” and its sub-processor list runs the Customer Education (CE) service — the Northpass platform — on “Amazon Web Services, Inc.” in the “United States,” with no location inside mainland China. Collect personal data from mainland learners into that academy and it leaves the country: a cross-border transfer of personal information PIPL governs (notice, separate consent and a transfer mechanism; Articles 38–43), on infrastructure that cannot be ICP-filed. Gainsight adds that it handles this data “in our role as a service provider” and that your business “is the controller” — so under PIPL the duty is yours, not the vendor's. The table below is Gainsight's own wording and the rule each line triggers.
This is a risk map, not a verdict — which obligations bite depends on your entity, your data volumes and who your learners are. Our China team can map your exposure with you →
What Northpass's own documentation says about China
| Fact | Primary source |
|---|---|
| Northpass is now Gainsight's customer-education platform — a cloud LMS that holds your learners' records. Gainsight announced on July 11, 2023 that “it has signed a definitive agreement to acquire Northpass,” calling it a “market-leading digital customer education platform” that customers choose to “power their digital customer academies.” Those academies host your course content and the personal data behind it — learner names, emails, progress and “course completion rates,” in Gainsight's words — which is exactly what turns this into a data-residency question in China. | Gainsight — “Gainsight Acquires Leading Customer Education Platform Northpass” press release, retrieved 2026-10-07 |
| Your learners' personal data sits in the United States, not the mainland. Gainsight's privacy notice — which it says covers “www.northpass.com” — states “We maintain primary data centers in the USA” and that data may be processed in “countries other than the country in which you are located, including the USA.” Its sub-processor list runs the Customer Education (CE) service on “Amazon Web Services, Inc.” in the “United States,” with Datadog and Snowflake also US-based. No location on either page is inside mainland China. | Gainsight Privacy Policy (April 2026) & List of Gainsight Sub-Processors (September 2026), retrieved 2026-10-07 |
| That makes mainland learner data a cross-border transfer — and the duty is yours, not Gainsight's. Personal information collected from mainland learners and stored offshore is a cross-border transfer under PIPL: the handler must give notice, obtain separate consent and clear one transfer mechanism (Articles 38–43), and a CIIO or large-volume handler must keep it inside China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Gainsight's notice says it processes this data “in our role as a service provider” and that your business “is the controller,” so under PIPL you — not the platform — are the personal-information handler carrying those obligations. | Gainsight Privacy Policy (April 2026), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
| Gainsight's cross-border safeguards are built for Europe, not China. The privacy notice protects transfers with “the European Commission's Standard Contractual Clauses as issued on 4 June 2021,” the “UK Addendum,” and the “EU-U.S. Data Privacy Framework.” Those are GDPR and UK-GDPR instruments — none is a recognized PIPL transfer mechanism, and none meets China's data-localization rules. Being squared away for the EU and UK does not clear a mainland academy. | Gainsight Privacy Policy (April 2026), retrieved 2026-10-07; PIPL Articles 38–43 |
| The public academy that serves your courses to mainland learners needs an ICP filing — and an offshore site can't hold one. A customer academy shown to mainland visitors is a public-facing website, and a public site served into mainland China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, which must attach to a hosting resource physically inside the mainland. Northpass runs no mainland region — Gainsight's sub-processor list shows no mainland-China location — so there is nothing on it to file against. | State Council Order No. 292; MIIT Order No. 33; List of Gainsight Sub-Processors (September 2026, no mainland-China location), retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Northpass — the customer-education platform Gainsight acquired in 2023 and now runs as its Customer Education (CE) line — is not how quickly a course page paints. It is where your learners’ personal data is allowed to live, and whether the academy that serves them is cleared to operate in China at all. Gainsight answers the first in its own documentation: Northpass stores data in US data centers, with no region inside mainland China. A China-facing academy on Northpass is therefore reachable but served entirely from offshore, which turns every mainland learner’s name, email and completion record into a cross-border transfer China’s law governs, and leaves the public academy with no footing for an ICP filing. The content loads; the licensing and the data residency are the exposure.
Northpass in China at a glance
| What decides it | In Gainsight's own terms |
|---|---|
| Where it runs | Gainsight's privacy notice states “We maintain primary data centers in the USA,” and its sub-processor list runs the Customer Education (CE) service — Northpass — on “Amazon Web Services, Inc.” in the “United States.” No region is inside mainland China. |
| Who holds the learner data | A cloud LMS: Northpass hosts your “digital customer academies” and the learner records behind them — names, emails, progress and “course completion rates.” That personal data lands in the US data centers above. |
| Who carries the duty | Gainsight processes this data “in our role as a service provider” and names your business as “the controller.” Under PIPL that makes you — not Gainsight — the personal-information handler. |
| Serving the public | A customer academy shown to mainland visitors is a public-facing website, and a public site needs an ICP filing tied to a mainland host. With no mainland region, Northpass offers no ICP-filing path of its own. |
| Transfer safeguards | Gainsight's cross-border safeguards are the EU “Standard Contractual Clauses,” the “UK Addendum” and the “EU-U.S. Data Privacy Framework” — GDPR instruments, none of which is a PIPL transfer mechanism. |
Where your learners’ data actually lives
Gainsight is explicit about geography. Its privacy notice — which it says applies to “www.northpass.com” — states plainly, “We maintain primary data centers in the USA,” and warns that personal data may be processed in “countries other than the country in which you are located, including the USA.” Its sub-processor list carries the same story down to the vendor: the Customer Education (CE) service runs on “Amazon Web Services, Inc.” in the “United States,” with Datadog, Snowflake and the rest also US-based. Not one entry sits inside mainland China. For a platform whose whole job is to hold learner identities and training records, that single fact — where the data rests — is what starts the China analysis, long before anyone measures a load time.
Your mainland learners’ data crosses the border — and the duty is yours
Collect personal data from learners in the mainland into a US-hosted academy and it leaves the country. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler must give notice, obtain separate consent, and satisfy one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). A critical information infrastructure operator or a large-volume handler must keep personal information collected in China inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty a US data center cannot meet. And the obligation is not Gainsight’s to carry: its notice says it handles this data “in our role as a service provider” and that your business “is the controller,” which under PIPL makes you the personal-information handler. “We run our training on Northpass” does not move that duty onto the vendor.
Safeguards for Europe are not safeguards for China
Gainsight does address cross-border transfer — but for a different border. Its privacy notice leans on “the European Commission’s Standard Contractual Clauses as issued on 4 June 2021,” the “UK Addendum,” and the “EU-U.S. Data Privacy Framework.” Those are GDPR and UK-GDPR instruments; none of them is a recognized PIPL transfer mechanism, and none satisfies China’s localization rules. A vendor that is fully squared away for Frankfurt and London can still leave a mainland academy exposed, because the legal regime that governs your Chinese learners’ data is one its paperwork never names.
The public academy still needs an ICP filing
Separate from the data question, the academy itself is a public-facing website served to mainland visitors, and that turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33. An ICP filing must attach to a hosting resource physically inside the mainland. Northpass runs no mainland region, so there is nothing on it to file against — the same gap that keeps the data offshore keeps the academy unfilable. Reachability is a separate, lesser matter: whether the pages paint quickly is the delivery half of the question, not the legal half that decides whether you may operate the academy in China at all.
None of this is a verdict — it is a map of where the risk sits. Whether an ICP filing, in-country storage, or both apply to your academy depends on what you teach, how much learner data you hold, and where your learners are — the kind of call worth settling with counsel before you open enrollment in the mainland.
Where 21YunBox fits — a compliant overlay, not a migration
Nothing here asks you to leave Gainsight. Northpass stays your LMS, your courses and learner records stay in it, and your team keeps working the way it does today. What we add is the layer a US-hosted academy structurally cannot supply on its own: ICP-filed delivery operated from inside the mainland, placed in front of your existing Northpass academy so mainland learners reach it through a compliant in-country path — no rebuild, no second codebase, no fork of your content. First our China team maps the obligations that actually apply to you — your PIPL cross-border position, any data-residency duty, and the ICP filing the public academy needs — against your entity and your learner volumes. Then we stand up the in-country delivery and storage a lawful mainland presence requires, while the platform you already trust keeps doing its job.
Related reading:
