Does Prometheus Work in China? Data Residency, ICP & Cross-Border Rules
Prometheus is open-source monitoring you run yourself, so residency, not reachability, is the question. Its labelled time series carry user and tenant IDs; sent from China to an offshore backend, that is a PIPL cross-border transfer. Scrubbing cannot close it; self-managing in-country is the lever.
Does Prometheus work in China?
For a team serving mainland China, the question about Prometheus is not whether it runs in Shanghai — it is open-source software you run yourself, so it runs wherever you put it. The question is where the metrics it collects come to rest, and whether that data may lawfully leave China. Prometheus stores its metrics as time series, and the labels on those series routinely carry user, tenant and instance identifiers — and, through exporters, request-level detail. A labelled series tied to identifiable people is personal information, not anonymous machine data.
Collect it inside the mainland and ship it to a Prometheus server or long-term backend hosted offshore and you have a cross-border transfer under the Personal Information Protection Law: notice, a separate consent for the export, and one transfer mechanism (PIPL Articles 38–40). A CIIO or large-volume handler also owes in-country storage under the Cybersecurity Law (Article 39 (formerly Article 37)), and a China-facing dashboard needs an ICP filing. Dropping high-cardinality or PII labels narrows what crosses — it does not change whether it crosses, and it does nothing for residency.
Because Prometheus is yours to run, the lever is simple: self-manage it in-country so the metrics stay in China. In-country infrastructure is not automatic compliance, though — the PIPL and ICP duties then fall to you. Our China team can map your exposure with you →
What Prometheus's own documentation says about China
| Fact | Primary source |
|---|---|
| Prometheus is software you run yourself. Its own documentation opens: "Prometheus is an open-source systems monitoring and alerting toolkit." It adds that "Each Prometheus server is standalone, not depending on network storage or other remote services," and that "It stores all scraped samples locally" — so the server, and the data it holds, live wherever you deploy them, not in a vendor's fixed region. | Prometheus — Overview, prometheus.io documentation, retrieved 2026-10-13 |
| Metrics are stored as labelled time series. Prometheus's documentation states it "collects and stores its metrics as time series data," where "metrics information is stored with the timestamp at which it was recorded, alongside optional key-value pairs called labels." Those labels routinely carry user, tenant and instance identifiers, and exporters can surface request-level detail — which makes the stored series personal information, not anonymous machine data. | Prometheus — Overview, prometheus.io documentation, retrieved 2026-10-13 |
| Shipping China-collected metrics offshore is a cross-border transfer. Under the Personal Information Protection Law, exporting personal information collected in the mainland requires notice, a separate consent for the export, and one statutory transfer mechanism — a CAC security assessment, the standard contract, or certification (PIPL Articles 38–40). Redacting labels narrows the payload but does not remove the transfer. | Personal Information Protection Law of the PRC, Articles 38–40 — retrieved 2026-10-13 |
| A CIIO or large-volume handler owes in-country storage. Personal information and important data collected in China by a critical information infrastructure operator must be stored in the mainland (Cybersecurity Law Article 39 (formerly Article 37), renumbered by the 2025 amendment effective January 1, 2026; PIPL Article 40). Self-hosting Prometheus offshore cannot meet that duty; self-hosting it in-country can. | Cybersecurity Law of the PRC, Article 39 (formerly Article 37); PIPL Article 40 — retrieved 2026-10-13 |
Sources verified by the 21YunBox compliance team on 2026-10-13.
For a team serving mainland China, the useful question about Prometheus is almost never whether it runs — it is open-source software you deploy and operate yourself, so it runs wherever you put it, the mainland included. The question is where the metrics it collects come to rest, and whether that data may lawfully leave China. Prometheus stores what it gathers as time series, and the labels on those series routinely carry user, tenant and instance identifiers; through exporters and recording rules they can surface request-level detail as well. Metrics feel like anonymous machine data, but a labelled series tied to identifiable people is personal information. Reaching a Prometheus server, or a dashboard in front of it, is the delivery half; where the series are stored is the exposure.
Prometheus in China at a glance
| What decides it | In Prometheus's own terms — and China's law |
|---|---|
| Where Prometheus runs | Open-source software you deploy and run yourself. Each server is standalone and stores its samples locally, so the metrics live wherever you host them — there is no vendor-fixed region, and no mainland location by default unless you choose to self-host in-country. |
| What the metrics contain | Metrics are labelled time series; labels routinely carry user, tenant and instance identifiers, and exporters can surface request-level detail. A series tied to identifiable people is personal information, not anonymous machine data. |
| Does scrubbing fix it? | Dropping high-cardinality or PII labels narrows what crosses the border — but it changes what crosses, not whether, and does nothing for residency (whether the series stays in-country). |
| Your China metrics on an offshore backend | Collected in the mainland and shipped to an offshore Prometheus server or long-term store, it is a cross-border transfer PIPL governs; a CIIO or large-volume handler also owes an in-country storage duty. |
| The residency lever | Because you operate Prometheus, self-managing it on mainland infrastructure keeps the metrics in-country — though the PIPL consent, transfer and ICP duties then fall to you. |
| Is it reachable? | Treat reachability as the delivery half, not the question. The exposure is where the metrics are stored, not whether the dashboard loads. |
Prometheus is yours to run — and so is the choice of where its metrics live
Because Prometheus is open-source software you operate, there is no vendor region to accept or regret — the deployment location is entirely yours. Its documentation is explicit that “Each Prometheus server is standalone, not depending on network storage or other remote services,” and that “It stores all scraped samples locally.” So the server, and the time series it holds, come to rest exactly where you deploy them. Run Prometheus on infrastructure physically in the mainland and the metrics can stay in-country; run it — or a long-term, remote-write backend behind it — offshore, and every series you collect in China is leaving the country. Unlike a pure SaaS tool with a fixed menu of foreign regions, Prometheus hands you the residency decision outright. (Managed, hosted “Prometheus-compatible” services are a separate, offshore matter; this page is about the open-source server you run.)
The metrics Prometheus stores are personal information — and scrubbing does not close the door
Observability data is not anonymous by nature. Prometheus “collects and stores its metrics as time series data,” where each sample is “stored with the timestamp at which it was recorded, alongside optional key-value pairs called labels.” Those labels are where identity creeps in: a user or account ID, a tenant, an instance, a customer-facing endpoint — and exporters or recording rules can pull request-level detail into the series too. A mainland visitor’s identifier sitting in a label is already personal information under China’s Personal Information Protection Law. Teams reach for scrubbing — dropping high-cardinality labels, masking IDs, relabelling away PII — and it is worth doing. But it answers the wrong half: dropping a label changes what crosses the border, not whether it crosses, and it does nothing for residency — whether the series stays in China at all. A redacted-but-still-identifiable series shipped to an offshore backend is still a cross-border transfer; redaction lowers exposure, it does not make an offshore destination lawful.
Cross-border transfer, in-country storage, and the China-facing dashboard
Collect metrics inside the mainland and send them to a Prometheus server or long-term store hosted abroad and you have a cross-border transfer the law governs. Under the Personal Information Protection Law the handler — you, not the Prometheus project — must give notice, obtain a separate consent for the export, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–40). If you are a critical information infrastructure operator or a large-volume handler, personal information and important data gathered in China must also be stored in the mainland (Cybersecurity Law Article 39 (formerly Article 37), renumbered by the 2025 amendment that took effect on January 1, 2026; PIPL Article 40). And a dashboard served publicly to users inside China needs an ICP filing tied to a mainland hosting resource. Self-hosting answers the residency question; it does not, on its own, answer consent, transfer or filing.
This is a risk map, not a verdict. Whether you owe a transfer mechanism, a separate consent, in-country storage, an ICP filing, or some combination turns on what your metrics actually contain, how much of it is personal, your role as handler, and who your users are — worth settling with counsel before you point a remote-write at any backend.
Why a reachability check misses this
A speed-or-reachability test asks whether a Prometheus server answers from Shanghai and whether a dashboard renders. Both usually pass — the agent scrapes, the server responds, the panels draw. What that test never sees is where the labelled series come to rest and whether that resting place is lawful. The exposure is not latency; it is a personal-information stream collected in China and stored offshore, plus a residency duty that no amount of scrubbing can satisfy. That is the half a reachability probe structurally cannot measure — and the half that decides whether your monitoring is compliant.
The lawful path — map, localize, deliver
You do not have to give up Prometheus to run it compliantly for mainland China. There are three moves, and they fit together.
Map. Our China compliance team inventories your telemetry’s duties — which metrics carry personal information, whether your data volumes or your role as handler trigger an in-country storage duty, which PIPL transfer mechanism (if any) your exports need, and where an ICP filing attaches. You get the exposure written down before anything is rewired.
Localize. Where metrics must stay, we put them on an in-country, consented processing and storage footing — a self-managed Prometheus and the backend behind it on mainland infrastructure — and let only the lawfully exportable telemetry reach the global tools your team already uses.
Deliver. In front of whatever you run, the 21YunBox Optimizer provides ICP-filed, in-country delivery for the China-facing dashboard and origin — no rebuild, no second codebase, no move off Prometheus. 21YunBox never uses or suggests circumvention of any kind; the entire point is a lawful, filed, in-country path.
The goal is plain: your monitoring runs legally and compliantly for your users in China.
Related reading:
- How to get an ICP filing for China
- Cross-border data transfers under PIPL
- China’s Personal Information Protection Law
- China’s Cybersecurity Law and data localization
