Does PocketBase Work in China? Data Residency, ICP & Cross-Border Rules
PocketBase is an open-source backend you run yourself — a single executable, no managed cloud — so for mainland China the deciding question is where you deploy it, not speed. Host it offshore and your China users' SQLite database, auth records and uploaded files sit abroad under PIPL; deploy it in-country and the data stays on Chinese soil.
Does PocketBase work in China?
Whether you can use PocketBase in China is a data-residency question, not a speed one. PocketBase is an open-source backend you run yourself — a single executable with no managed cloud — so whether it is compliant turns on where you deploy it, not on how fast it loads.
By the project's own documentation PocketBase is "self-hosted only" and "could be deployed by just uploading the executable on your server"; everything it holds — an embedded SQLite database, your users' auth records, uploaded files, and the stored S3/SMTP credentials — lives in a pb_data directory on the host you pick. Run that host offshore and the personal information of your China users sits abroad: a cross-border transfer PIPL governs (notice, separate consent, a transfer mechanism), and for a CIIO or large-volume handler China-collected data must stay in the mainland (CSL Article 39 (formerly Article 37)). Deploy the binary in-country and that data — and those secrets — stay on Chinese soil.
This is a risk picture, not a verdict — your obligations turn on your data volumes and your role. Our China team can map your PocketBase deployment with you →
What PocketBase's own documentation says about China
| Fact | Primary source |
|---|---|
| In PocketBase's own words: it is "completely portable" and "doesn't require any external dependency and could be deployed by just uploading the executable on your server." There is no PocketBase-managed cloud — its FAQ states "PocketBase is self-hosted only" — so there is no vendor region to pick, and where the data lives is entirely the operator's choice: the host you deploy the single executable to. | PocketBase Docs — Going to production, and FAQ, retrieved 2026-10-13 |
PocketBase stores your application's data in an embedded SQLite database, together with your users' auth/account records and the files they upload, all inside a pb_data directory on the server you run the binary on; by the production guide its stored settings even include the "SMTP password and S3 storage credentials." Deploy that binary on offshore hosting and your China users' personal information — and those secrets — rest abroad; deploy it in-country and they rest in China. | PocketBase Docs — Going to production (Backup and Restore; Enable settings encryption), retrieved 2026-10-13 |
| Because your PocketBase instance holds the accounts, records and files you collect from users in China — personal information — hosting it offshore transfers that data abroad. PIPL governs that cross-border transfer (Articles 38–40): the personal-information handler — you, the operator, not PocketBase — must give notice, obtain separate consent, and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). | PIPL — cross-border transfer of personal information (Articles 38–40) |
| For a critical information infrastructure operator or large-volume handler, personal information collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) — the 2025 amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged). An offshore PocketBase deployment cannot meet that duty; running the binary on in-country infrastructure can, and standing a public mainland surface up lawfully brings an ICP filing into the picture. | Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40 |
Sources verified by the 21YunBox compliance team on 2026-10-13.
For a mainland-China audience, the real question about PocketBase is not whether it loads or how fast it answers — PocketBase is a backend you run yourself, so that is entirely in your hands — but where the data it holds is allowed to come to rest. PocketBase is an open-source backend shipped as a single executable: it keeps your application’s database, the accounts and auth records your users create, and the files they upload. There is no PocketBase-managed cloud; by the project’s own FAQ it is “self-hosted only.” That is the compliance lever and the compliance risk in one — because you choose the server, you can keep your Chinese users’ data on Chinese soil, or, if you deploy on offshore hosting, you leave it abroad. The endpoint answering is the easy half; where the data is stored is the half the law turns on.
PocketBase in China at a glance
| What decides it | In PocketBase's own terms — and China's law |
|---|---|
| Where the data physically rests | PocketBase keeps everything in a pb_data directory on the server you deploy the single executable to — not on a vendor region menu. Run the binary offshore and the data rests abroad; run it on in-country infrastructure and it rests in China. With PocketBase, that is your decision to make. |
| What it holds, and why it's personal information | An embedded SQLite database, your users' auth and account records, and the files they upload — so the personal information of people in China physically comes to rest inside your PocketBase instance. |
| Is there a managed cloud? | No. By PocketBase's own FAQ, asked “Do you offer hosting?”, the answer is “No. PocketBase is self-hosted only.” There is no first-party SaaS and no region to pick — which is exactly why residency is entirely in the operator's hands. |
| Your China users' records, kept offshore | Deployed on offshore hosting, your Chinese users' personal information is a cross-border transfer PIPL governs (Articles 38–40) — notice, separate consent, and one transfer mechanism. |
| The in-country storage duty | A critical information infrastructure operator or large-volume handler must store China-collected personal information in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). An offshore deployment cannot meet it; an in-country one can. |
You choose where PocketBase runs — so you can keep the data in China
The feature that makes PocketBase different from a managed backend is also what makes it compliant-ready: you install and run it yourself. By its own production guide, “one of the best PocketBase features is that it’s completely portable” — it “doesn’t require any external dependency and could be deployed by just uploading the executable on your server.” Its FAQ describes the same thing from the other side: PocketBase was built “to assist building self-contained applications that can run on a single server,” and, asked whether it offers hosting, answers plainly that “PocketBase is self-hosted only.” In other words, your backend comes to rest on the one machine you put the binary on. Point that machine at in-country infrastructure and your database — and the personal information inside it — stays on Chinese soil by construction. The residency question for PocketBase is therefore not “is there a China region?” but “did we deploy it in China?”
What PocketBase holds is personal information
PocketBase is not a cache or an edge in front of your data — it is your data. It stores your application’s records in an embedded SQLite database, together with the auth and account records your users create and the files they upload, all inside a single pb_data directory on the server it runs on. For a China-facing product that means the personal information of people in the mainland physically lives there. Keep that instance on offshore hosting and, under China’s Personal Information Protection Law, you are making a cross-border transfer: the handler — you, the operator, not PocketBase — must give notice, obtain separate consent, and clear one transfer mechanism, whether a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–40). “It’s just a backend we host” settles none of that; reaching the instance and being cleared to store Chinese users’ data in it are different questions.
The secrets live on the same host, too
There is a second exposure a reachability check never sees. By PocketBase’s production guidance, its stored application settings include “the SMTP password and S3 storage credentials” — which is why it offers an optional encryption key for them — and it can broker sign-in through the OAuth2 providers you enable, whose client secrets it holds as well. So the host you pick carries not only your users’ records but the credentials PocketBase uses to reach your mail and object-storage providers. This is precisely where a self-hosted engine is the lever rather than the liability: unlike an offshore platform whose normal operation would pull your China data across the border and concentrate your secrets abroad, PocketBase keeps the regulated data and those secrets together in one place you control. Deploy the binary offshore and both sit abroad; deploy it in-country and both stay on Chinese soil.
How much is at stake depends on your volume and your role
The weight of these duties is not uniform. Under the CAC’s March 2024 Regulations on Promoting and Regulating Cross-border Data Flows, a handler that is not a critical information infrastructure operator and moves fewer than 100,000 individuals’ non-sensitive personal information in a calendar year is exempt from the security assessment, the standard contract and certification — a genuinely lighter path for a small app. At the other end, a CIIO or a large-volume handler carries a data-residency duty: personal information collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) — the 2025 amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged). No offshore host can satisfy that — and because PocketBase is self-hosted, the way out is built in: run the binary on infrastructure inside the mainland, and standing that deployment up lawfully behind a public surface is what brings an ICP filing into the picture.
Why a reachability check misses the real question
A mainland user can open and use a PocketBase instance hosted offshore, so a reachability or latency test will report “works.” But reachability is the delivery half, not the legal half. The violation a connection test can never see is that the regulated data is stored offshore: the SQLite database, auth records, uploaded files and the stored S3/SMTP credentials all rest abroad, and an offshore instance can hold neither an in-country copy of the data a localization duty demands nor the ICP-filed footing a public mainland surface needs (State Council Order No. 292; MIIT Order No. 33). Making the instance merely reachable does not answer the question; storing the data and secrets in-country does.
This is a risk map, not a verdict: whether you owe a transfer mechanism, in-country storage, or both depends on the data you hold, your volumes, and whose it is — worth settling with counsel before you build.
The lawful path — map, localize, deliver
You keep PocketBase as your backend. What 21YunBox adds is the compliance layer it was never meant to provide on its own, arranged around the stack you already run — no rebuild, no second codebase, no migration off PocketBase.
- Map. Our China team inventories what your PocketBase instance holds (the SQLite database, auth and account records, uploaded files, and the stored S3/SMTP/OAuth secrets) and where the binary runs, then reads it against your PIPL cross-border, data-residency and data-localization (CII) obligations and any ICP duty.
- Localize. Where the law requires your China users’ data to stay on the mainland, we help you run the PocketBase binary on in-country infrastructure so the
pb_datadirectory — and the secrets with it — sit in China; with Art 13/23 notice and separate consent, and the border crossed by as little as possible. Localize means an in-country deployment, not a route back to an offshore endpoint. - Deliver. Any China-facing surface in front of your backend — the app, the API edge, the admin dashboard your mainland users reach — runs over ICP-filed, in-country delivery (the 21YunBox Optimizer), in front of the in-country PocketBase.
The result runs legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind. We are a compliant overlay and a partner to the way you already build, not a competitor and not a migration.
Related reading:
- China’s Personal Information Protection Law (PIPL)
- Cross-border data transfers under PIPL
- China’s Cybersecurity Law and data localization
- How to get an ICP filing for China
