Does Platform.sh Work in China? ICP, Data Residency & an Offshore PaaS
Platform.sh — now running under the Upsun brand — operates no region inside mainland China; its projects deploy to Australia, Europe, Canada and the US — so a China-facing app is served offshore with no ICP-filing path, and the personal data it stores lands outside the mainland under PIPL. A compliance-first look at the two doors.
Does Platform.sh work in China?
Whether Platform.sh works for a mainland-China audience is a licensing and data-residency question first, and a speed question only after that. Platform.sh is a platform-as-a-service — now running under the Upsun brand — that deploys your whole application and its managed data into one region you choose, and China's law turns on where that region is.
By its own regions page, headed "Deploy globally, comply locally," Platform.sh runs data-center regions in Australia, four European countries, Canada and the United States — and not one is inside mainland China, the nearest being Sydney. So a public site you run on Platform.sh reaches mainland users from offshore, with no ICP-filing path on Platform.sh itself, and any personal data your app or its managed services keep there is a cross-border transfer PIPL governs. The snapshot below maps Platform.sh's own footprint to the China rules it triggers — and the compliant, ICP-filed in-country path that closes them.
This is a risk map, not a legal verdict — what you owe turns on what you serve and the personal data you hold. Our China team can map the ICP and cross-border path with you →
Compliance snapshot
- ✕ Platform.sh runs no mainland-China region (it now operates under the Upsun brand), so a public site on it has no ICP-filing path
- ! Your app and its managed data deploy to one offshore region — Australia, Europe, Canada or the US
- ! Chinese users' personal data in a Platform.sh app or managed service is a cross-border transfer under PIPL
- ! A Platform.sh app can be reached from China, but reaching it is delivery — it creates no ICP filing or residency
- ✓ A compliant path exists: ICP-filed in-country delivery in front of your Platform.sh origin
What Platform.sh's own documentation says about China
| Fact | Primary source |
|---|---|
| By Platform.sh's own regions page — headed "Deploy globally, comply locally" and now published under the Upsun brand the platform.sh domain redirects to — its projects deploy to data-center regions in Sydney (Australia); Dublin, Frankfurt, Gravelines, London, Paris, Stockholm and Zurich in Europe; Montreal in Canada; and Charleston, Moses Lake and Washington in the United States. None is inside mainland China; the nearest, Sydney, is still offshore. | Platform.sh (Upsun) — Cloud Regions, retrieved 2026-10-07 |
| Serving a public website or application to mainland-China visitors from inside the mainland requires an ICP filing (ICP 备案) under the State Council's Order No. 292 and MIIT's Order No. 33, and that filing must attach to a hosting resource physically inside the mainland. Because Platform.sh operates no mainland-China region, a Platform.sh-hosted site has nothing on Platform.sh to file against — it reaches China from offshore. | PRC Regulations on Telecommunications (State Council Order No. 292); Administrative Measures for the Filing of Non-operational Internet Information Services (MIIT Order No. 33) |
| Keep Chinese users' personal data in a Platform.sh app or one of its managed services (database, search or cache) and it lives in whichever offshore region you deployed, so PIPL treats it as a cross-border transfer: the handler — you, Platform.sh's customer, not Platform.sh — must give notice, obtain separate consent, and clear one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). | Personal Information Protection Law, Chapter III, Articles 38–43 |
| For a critical information infrastructure operator or large-volume handler, personal information collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Platform.sh publishes no mainland-China region, so none of its locations can meet that residency duty — holding the data on Chinese soil means running the storage on infrastructure inside the mainland, which is where an ICP filing re-enters. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| How heavy the duty is scales with volume and role, not with the bare fact of using an offshore platform: under the CAC's March 2024 cross-border rules, a non-CIIO exporting the non-sensitive personal information of fewer than 100,000 people in a calendar year is exempt from the security assessment, standard contract and certification — a line worth pinning down before you assume you are in the clear. | CAC — Provisions on Promoting and Regulating Cross-border Data Flows, March 2024 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the question that decides Platform.sh is not how quickly it paints — it is which country your application is permitted to run in, and which country the data it holds is permitted to sit in. Platform.sh is a platform-as-a-service — now operating under the Upsun brand, with the platform.sh domain redirecting to upsun.com — and its own regions page answers both: not one of its data-center regions is inside mainland China. That leaves a China-facing Platform.sh app reachable yet entirely offshore, with no footing for the ICP filing a public mainland site requires, and with any personal data your app or its managed services keep for Chinese users turning into a cross-border transfer China’s law governs. Reaching China is the delivery detail; the licensing and the data residency are where the exposure lives.
Platform.sh in China at a glance
| What decides it | In Platform.sh's own terms |
|---|---|
| Where it runs | Data-center regions in Sydney (Australia); Dublin, Frankfurt, Gravelines, London, Paris, Stockholm and Zurich (Europe); Montreal (Canada); and Charleston, Moses Lake and Washington (United States) — on AWS, Azure, Google Cloud and OVHcloud. None sits inside mainland China; the nearest, Sydney, is still offshore. |
| What runs there | Platform.sh deploys your whole project — application containers plus its managed services (databases, search, cache) — into the single region you pick. Whatever your app stores lives wherever that region is. |
| Serving the public | A site served to mainland visitors from inside China needs an ICP filing tied to a mainland hosting resource. With no mainland region, Platform.sh offers no ICP-filing path of its own. |
| Your data on Platform.sh | Personal data of Chinese users held in a Platform.sh app or managed service sits offshore — a cross-border transfer PIPL governs, plus a data-localization duty for CIIOs and large-volume handlers that offshore regions cannot meet. |
| Is it reachable? | Reachability is a delivery question, not a compliance one. Even when a Platform.sh app loads for mainland users, it is served from offshore and creates neither an ICP filing nor in-country data residency. |
No mainland region, so no footing for an ICP filing
Platform.sh deploys each project to a single region, and its published regions sit in Australia, four European countries, Canada and the United States — running on AWS, Azure, Google Cloud and OVHcloud. Upsun, the brand Platform.sh now runs under, heads its regions page “Deploy globally, comply locally,” yet not one of those regions is inside mainland China, and the closest of them, Sydney, is on the far side of the South China Sea.
That geography settles the licensing question before performance is ever in frame. A public-facing website or application delivered to mainland visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and the filing has to attach to a hosting resource that physically sits in the mainland. Platform.sh has no such resource, so there is nothing on Platform.sh to file against. This is where “we already deploy on Platform.sh” stops being enough: reaching China is not the same as being cleared to operate there, and neither a git-push deploy nor the region selector conjures the mainland footing a filing needs.
Your China users’ data stays offshore
Platform.sh runs your application containers and its managed services — the databases, search and cache your app depends on — inside the one region you choose. So the personal data your app collects from Chinese users comes to rest wherever that region is: Australia, Europe, Canada or the United States, never the mainland. Under China’s Personal Information Protection Law that movement is a cross-border transfer, and the duty falls on the handler — you, Platform.sh’s customer, not Platform.sh — to give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty none of Platform.sh’s offshore regions can satisfy. The catch is in the vendor’s own tagline: “comply locally” assumes a local region exists, and for mainland China there is none.
Reachable is not the same as cleared
China does not categorically block a Platform.sh app, but reachability is the delivery half of the question, and it is the half that misleads. However briskly the app answers a mainland visitor, it answers from offshore — and answering from there yields neither an ICP filing nor in-country data residency. Those two gaps are compliance facts about where the hosting sits and where the data lands, not latency a faster paint can erase. A quicker offshore response is still an offshore response.
This is a risk map, not a verdict: whether you need an ICP filing, in-country storage, or both depends on what you serve, how much personal data you hold, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep deploying on Platform.sh. We add the single piece a platform with no mainland presence cannot: compliant, ICP-filed delivery from inside the mainland, placed in front of your existing Platform.sh origin — no rebuild, no second codebase, and no move off Platform.sh. Our China team maps your ICP and data-residency obligations against your entity and data volumes, then stands up the in-country delivery and storage a lawful China presence needs, while your application keeps running exactly where it already does.
Related reading:
Frequently Asked Questions
Does Platform.sh have a data center in mainland China?
No. By Platform.sh's own region list — now published under the Upsun brand — projects deploy to Sydney (Australia); Dublin, Frankfurt, Gravelines, London, Paris, Stockholm and Zurich (Europe); Montreal (Canada); and Charleston, Moses Lake and Washington (United States). None is inside mainland China, and the nearest, Sydney, is still offshore — so a site served to mainland visitors from Platform.sh is delivered from outside the country and has no ICP-filing path on Platform.sh itself.
Is it against the law to run a China-facing site on Platform.sh?
Not inherently. Two separate duties create the exposure: serving a public site to mainland visitors from inside China needs an ICP filing, which attaches to mainland hosting Platform.sh does not offer; and holding Chinese users' personal data in an offshore Platform.sh app or managed service is a cross-border transfer PIPL governs, with an in-country storage duty for CIIOs and large-volume handlers. Treat it as a risk to size with counsel for your data and role, not a blanket ban.
Can 21YunBox help run a Platform.sh app in China?
Yes. Our China team can assess your ICP and data-residency exposure and provide the compliant, ICP-filed in-country delivery and storage an offshore PaaS cannot — placed in front of the Platform.sh origin you already run, with no rebuild. Get in touch to work through your specific setup.
