Does Pimcore Work in China? ICP, Data Residency & Where You Host It
Pimcore is open-source DXP/PIM/MDM/CMS software — self-hosted on infrastructure you choose, or run on Pimcore's fully managed PaaS. Whether it works in mainland China is decided one layer down: where you host it sets your ICP filing and data residency, and Pimcore's managed PaaS is no mainland-China presence. A compliance-first look at the layers.
Does Pimcore work in China?
Whether you can use Pimcore in mainland China is decided one layer below Pimcore itself — by where you host it — and it is first an ICP and data-residency question, not a speed one. Pimcore is open-source DXP/PIM/MDM/CMS software, not a hosting service: in almost every edition you deploy it on infrastructure you choose, and a separate managed PaaS has Pimcore run that hosting for you.
Pimcore's own editions page says you “Deploy where it works best for you—on-premise or in your private or public cloud—with Pimcore Enterprise Edition,” and offers a “fully managed PaaS” as the alternative — but neither is a mainland-China presence out of the box. Host it offshore and a public site reaches China with no footing for an ICP filing, while the content, product, asset and customer data Pimcore holds about people in China sits outside the mainland — a cross-border transfer PIPL governs. Deploy it instead on a mainland host held by a mainland entity and an ICP path opens — but that footing comes from your hosting, not from Pimcore. The table below pairs Pimcore's own wording with the rule each line triggers.
This is a risk picture, not a verdict — what applies turns on where you deploy, what data Pimcore holds, how much of it is personal, and who your users are. Our China team can map your Pimcore exposure with you →
Compliance snapshot
- ! Pimcore is software you deploy where you choose — on-premise, private or public cloud, or its managed PaaS — so it ships no mainland-China home of its own
- ✕ Hosted offshore (self-managed or on Pimcore's PaaS), a China-facing site has no footing for an ICP filing and your data sits outside the mainland
- ✓ Self-host Pimcore on a mainland resource under a mainland entity and an ICP-filing path opens — but that footing comes from your host, not from Pimcore
- ! Pimcore holds content, product, asset and customer data (PIM/MDM/DAM/CDP); any personal data on it about China users, kept offshore, is a PIPL cross-border transfer
- ✓ A compliant, ICP-filed in-country delivery path exists — no rebuild, no migration off Pimcore
What Pimcore's own documentation says about China
| Fact | Primary source |
|---|---|
| Pimcore is software you deploy on infrastructure you choose — it ships no mainland-China home of its own. Pimcore's editions overview describes the Enterprise Edition as one you “Deploy where it works best for you—on-premise or in your private or public cloud,” and the Professional Edition as “Deploy on-premise or in private/public clouds, without managed operations.” Where Pimcore runs — and with it the ICP and data-residency posture — is set by your hosting decision, not by Pimcore. | Pimcore — Editions Overview (pimcore.com), retrieved 2026-10-08 |
| Its managed option is operated by Pimcore, not on Chinese soil. Pimcore also offers a “fully managed PaaS” that takes hosting off your hands, which its editions page frames as “worry-free operations.” That managed platform is run as Pimcore's own infrastructure and is not published with a mainland-China region, so a PaaS-hosted, China-facing site still reaches the mainland from offshore and still needs its own in-country footing. | Pimcore — Editions Overview (pimcore.com), retrieved 2026-10-08 |
| Serving a public site to mainland visitors from inside China turns on an ICP filing tied to a mainland host. An ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33 must attach to a hosting resource physically inside the mainland, held by a mainland entity. Pimcore the software cannot hold that filing; the infrastructure you deploy it on must. Hosted offshore it has no such footing — so the filing is yours to arrange, on a mainland host, for the site you build on Pimcore. | State Council Order No. 292 (PRC Telecommunications Regulations); MIIT Order No. 33 |
| Pimcore holds content, product, asset and customer data — and any of it that is personal data about China users, kept offshore, is a cross-border transfer. As a unified DXP it stores content, product information (PIM/MDM), digital assets (DAM) and, through its customer data platform, customer profiles and personalization data. Gathered from people in China and kept on an offshore deployment, that personal data is a cross-border transfer under PIPL: the handler — you, not Pimcore — must give notice, obtain separate consent, and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). | PIPL Chapter III, Articles 38–43 |
| Keeping China users' data on Chinese soil means deploying Pimcore on a mainland host — not flipping a setting. For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Because Pimcore is deploy-anywhere software, that duty is met by running your instance — with its database and asset storage — on infrastructure inside the mainland, a hosting arrangement you stand up rather than a Pimcore feature. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-08.
For a mainland-China audience, the first thing to settle about Pimcore is what Pimcore is. It is open-source software — a digital experience platform that unifies content management, product information and master data management, digital asset management and a customer data platform — and in almost every edition you deploy it on infrastructure you choose. Pimcore’s own editions overview says so plainly for its Enterprise Edition: you deploy it on-premise or in your private or public cloud, while a separate, fully managed PaaS edition has Pimcore operate the hosting for you. Neither comes with a mainland-China home of its own. So “does Pimcore work in China” is not really a question about Pimcore — it is a question about where you run it, because that is what decides your ICP filing and where your users’ and product data live. The software is the easy part; the licensing and the data residency are the exposure.
Pimcore in China at a glance
| What decides it | What it means for a China-facing deployment |
|---|---|
| What it is | Open-source DXP/PIM/MDM/DAM/CMS software, not a hosting service. You run it; where it runs is a separate decision — “Deploy … on-premise or in your private or public cloud.” |
| Self-hosted editions | Community, Professional and Enterprise editions run on infrastructure you choose. Host it offshore and there is no mainland footing for an ICP filing; host it on a mainland resource under a mainland entity and an ICP path opens — but that footing comes from your host, not from Pimcore. |
| Managed PaaS | Pimcore's “fully managed PaaS” operates the hosting for you, but not on a mainland-China presence — so a PaaS-hosted site reaches China from offshore and the ICP question is unchanged. |
| Serving the public | A site served to mainland visitors from inside China needs an ICP filing tied to a mainland host held by a mainland entity. Pimcore the software cannot hold it; the infrastructure must. |
| Your China users' & product data | Pimcore stores content, product (PIM/MDM), assets (DAM) and customer-profile data (CDP). Any of it that is personal data about people in China and kept offshore is a cross-border transfer under PIPL, with an in-country storage duty for CIIOs and large-volume handlers. |
Pimcore is software you deploy — so the China question sits one layer down
Pimcore is the platform layer. The infrastructure you run it on is where China’s licensing rules land. In its own editions overview you “Deploy where it works best for you—on-premise or in your private or public cloud—with Pimcore Enterprise Edition,” and the Professional Edition is one you “Deploy on-premise or in private/public clouds, without managed operations.” A website shown to mainland visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically inside the mainland, held by a mainland entity. Pimcore supplies neither the host nor the entity — so if you deploy it offshore, there is simply nothing for the filing to sit on.
That is where “we built it in Pimcore” runs out. Being reachable in China and being licensed to operate there are two different things, and the choice of platform settles neither — no more than the choice of application framework would. Switching Pimcore editions or tuning the build does not create the mainland hosting footing a filing needs; that footing is created at the host.
Self-hosted or managed PaaS — neither is a mainland-China presence by default
Pimcore’s deploy-anywhere nature cuts both ways, and the honest answer depends on which path you take. Because the self-hosted editions run wherever you install them, you can put Pimcore on a mainland-China host — a Chinese cloud region, under a mainland entity — and at that point an ICP-filing path opens and your data can stay on Chinese soil. That is a real route, but it is a hosting arrangement you stand up, not something Pimcore hands you; the software behaves the same wherever it sits.
The managed PaaS goes the other way. Pimcore describes it as a “fully managed PaaS” for “worry-free operations” — it takes the hosting off your hands, but it runs as Pimcore’s own platform, not a mainland-China region. So a PaaS-hosted, China-facing site reaches the mainland from offshore, and the ICP filing still lands on the public site you serve, with no in-country footing underneath it. Whichever path you are on, the mainland presence a lawful public site needs is not in the box — it is yours to arrange, or ours to provide.
What Pimcore holds — product, asset and customer data — and where PIPL lands
A unified DXP stores far more than marketing copy. Pimcore holds your content, your product information and master data (PIM/MDM), your digital assets (DAM), and through its customer data platform it can hold customer profiles and personalization data. Where all of that physically lives is the residency question. Personal data gathered from people in China and kept on an offshore deployment — self-managed or on the PaaS — is a cross-border transfer under China’s Personal Information Protection Law: the handler, meaning you rather than Pimcore, has to give notice, obtain separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification.
For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Because Pimcore is deploy-anywhere software, the way you meet that duty is to run the instance — and its database and asset storage — on infrastructure inside the mainland. That is a hosting decision, not a Pimcore setting, which is exactly why the China answer lives one layer below the platform.
This is a risk map, not a verdict: whether you need an ICP filing, in-country delivery, in-country storage, or some combination depends on where you deploy, what data your Pimcore instance holds, how much of it is personal, and who your users are — all worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Pimcore, in whichever edition you already chose, wherever it already sits. We add the one piece a deploy-anywhere platform leaves to you: compliant, ICP-filed delivery from inside the mainland, set in front of the public site you already serve — no rebuild, no second codebase, and no move off Pimcore. Our China team maps your ICP and PIPL data-residency obligations against your entity and the content, product and customer data your instance holds, then stands up the in-country delivery — and, where the law requires it, the in-country storage — a lawful China presence needs, while your Pimcore platform stays exactly where it runs.
Related reading:
Frequently Asked Questions
Can I self-host Pimcore in China?
Yes — Pimcore is open-source, deploy-anywhere software, so you can run it on a mainland-China host (for example a Chinese cloud region) under a mainland entity. Doing so is what opens an ICP-filing path and lets you keep your China users' data in-country. But that footing comes from the host and entity you choose, not from Pimcore itself — the software runs the same way wherever you put it. Whether your setup triggers the ICP filing and in-country storage is a risk to confirm with counsel.
Do I need an ICP filing to use Pimcore in China?
The ICP filing does not attach to Pimcore — it is software, not a host. It attaches to the public mainland website or app you build on it and the in-country hosting resource that serves it. If you serve that site to mainland visitors from inside China, it needs an ICP filing tied to a mainland host held by a mainland entity — which an offshore self-hosted deployment or Pimcore's managed PaaS does not provide. Whether your particular setup triggers the filing is a risk to confirm with counsel, not a given.
Can 21YunBox help make our Pimcore setup compliant in China?
Yes. Our China team can assess your ICP and PIPL data-residency exposure for the content, product, asset and customer data your Pimcore platform holds, and stand up compliant, ICP-filed in-country delivery — and, where the law requires your China users' data to stay on the mainland, in-country storage — in front of the site you already run, so you keep building on Pimcore. Get in touch to work through your specific case.
