Does Phrase Work in China? PIPL Cross-Border Data Transfer & Content Residency

For a localization team serving mainland China, the question about Phrase was never whether the platform loads or whether translators can reach it — they can. Phrase is the former Memsource (now Phrase TMS) joined with the former PhraseApp (now Phrase Strings) as one Phrase Localization Platform: a translation-management system you connect to your repositories, CMS and content stores, so your source strings, documents and copy are uploaded to Phrase’s servers to be translated. Those servers sit in Phrase’s EU or US data centers — there is no mainland-China region. And the content does not pass through and vanish; as a TMS it accumulates as a permanent offshore corpus — translation memory, glossaries and term bases, projects, context screenshots and translator accounts — with another cross-border transfer on every sync. Whatever personal, sensitive or confidential information lives in the text goes with it: a transfer of personal information under PIPL (Articles 38–40, 数据出境), Article 28 for sensitive text, and an in-country-storage question (Cybersecurity Law Article 39, formerly Article 37) for a CIIO or high-volume handler.

Phrase in China at a glance

What you actually send — and where it goes

The thing to hold onto is that a translation service is a transfer of the exact content you send it. With Phrase you do not send a request that bounces off an edge and returns; you upload the source — the strings, the documents, the copy — so it can be translated and so the results can be reused later. And the content a business most needs translated is, almost by definition, the content most likely to contain personal information: support tickets full of customer names and emails, HR and employee documents, contracts, product and legal copy, knowledge-base articles, user-generated text. Confidential, unreleased and regulated material rides along in the same files.

Where does it go? Phrase names only two homes. Its Data Centers documentation says Phrase “currently uses servers based in two different locations” — a EU data center on AWS in Ireland (eu-west-1) and a US data center on AWS in the United States (us-east-1) — with the newer Phrase Studio running on Google Cloud in Warsaw, the Netherlands and Iowa, each “a separate cloud infrastructure.” None of them is in mainland China; an account picks EU or US at sign-up, and East-Asian teams are simply pointed at the US region. Because Phrase is a translation-management system rather than a one-shot API, the exposure is not a single call: the source and its translations persist offshore as translation memory, glossaries and projects, alongside the accounts of the translators who work on them, and every repository or CMS sync ships more across the border. On top of that, Phrase Language AI can route the same text to third-party machine-translation engines — its sub-processor list (“all sub-processors for all Phrase Solutions”) names providers in Redmond, Tokyo and Dublin among others — a further hop to additional offshore processors, some of which, Phrase warns, “may use their own data centers based in different locations.”

It’s a cross-border data transfer — under PIPL

Uploading China-origin source text to a server in Ireland or Virginia is, in plain terms, a cross-border transfer of personal information (数据出境). PIPL Articles 38–40 set the conditions: you must give notice of the overseas recipient, obtain a separate consent for the export specifically, and put a transfer mechanism in place — a CAC security assessment, the China Standard Contract, or certification. Sending a document abroad to be translated transfers everything inside it, so the lawful basis has to cover the whole payload, not a tidy summary of it.

Two things raise the bar. First, sensitivity: much of what gets translated is Article 28 sensitive personal information — medical, financial, legal, biometric or ID-bearing — and you cannot strip it out of a document you need rendered in full, so it needs the specific purpose, strict necessity, separate consent and prior impact assessment that category demands. Second, residency and volume: for a critical information infrastructure operator or a high-volume handler, personal information and important data collected in the mainland must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). An offshore translation-memory corpus that only grows is, by construction, in the wrong jurisdiction for that duty — and crossing a volume or sensitivity threshold can trigger a CAC-led data-export security assessment before any of it lawfully leaves.

Reaching the platform isn’t the question — keeping the content in-country is

The honest summary is narrow: nothing about Phrase is “blocked” in China, and the exposure is not the software. The exposure is that your China-origin source content — and the personal, sensitive and confidential information inside it — is exported to an offshore region and, in a TMS, kept there. Phrase’s own documentation underlines the point: it offers only EU and US regions and explicitly “does not provide a commitment to keep a customer’s data within a particular jurisdiction at all times.”

So the lever is not to make the offshore endpoint reachable — it is to stop the export of China content and keep its translation on an in-country path. In practice that means routing China-origin content through a licensed in-country machine-translation or localization alternative with the data kept in China; minimizing and pseudonymizing the personal information in strings before any offshore call is ever made; and disabling model-training retention, restricting any machine-translation step to engines that carry a data-region policy rather than the open set. Where Phrase itself must stay in the picture, you keep only the minimized, lawfully transferable subset crossing the border, backed by notice, a separate consent and a transfer mechanism. What this is not is a hidden path that ships the content offshore anyway and calls it local — that solves nothing and keeps the exposure. This is a risk map, not a verdict: whether you owe in-country storage, a transfer mechanism, a separate consent, a data-export security assessment, an ICP filing, or some combination turns on your entity, your data volumes, how much of your content is personal or sensitive, and whose data it is — settle the specifics with counsel before you decide where a single string or document is translated.

The lawful path — map, localize, deliver

You do not have to drop Phrase to run localization lawfully for mainland China. 21YunBox is a compliant overlay, not a migration — and, for a platform you already run, a partner alongside your stack rather than a competitor to it. There are three moves, and they fit together.

Map. Our China compliance team inventories what content actually flows into Phrase, what personal, sensitive or confidential information it carries, which region it lands in, whether any machine-translation step retains or reuses it, and where you lack a lawful basis for the cross-border leg — so the exposure is written down before anything moves.

Localize. Because the risk is China content leaving and persisting offshore, we keep that content’s translation in-country — on a licensed domestic machine-translation or localization path, with personal information minimized and pseudonymized in strings before any offshore call and model-training retention switched off. Localize means a lawful in-country translation path, never a tunnel back to an offshore endpoint; only the minimized, lawfully transferable subset ever crosses.

Deliver. For the China-facing site or app that consumes the translations — a public internet service with an ICP filing duty — the 21YunBox Optimizer provides ICP-filed, in-country delivery, in front of the stack you already run. No rebuild, no second codebase. 21YunBox never uses or suggests circumvention of any kind; the entire point is a lawful, filed, in-country path.

The goal is plain: your Phrase setup runs legally and compliantly for your users in China.

Get a compliance assessment →

Related reading:

• Cross-border data transfers under PIPL
• China’s Cybersecurity Law and data localization (Article 39)
• China’s data-export security assessment measures
• How to get an ICP filing for China

RELATED TECHNOLOGIES

Amazon Translate

Amazon Translate

Crowdin

Crowdin

DeepL

DeepL

Google Cloud Translation

Google Cloud Translation

Lokalise

Lokalise

Microsoft Translator

Microsoft Translator

Smartling

Smartling