Does Saviynt Work in China? Data Residency, ICP & Cross-Border Rules
Saviynt Enterprise Identity Cloud is a vendor-hosted IGA SaaS on AWS and Azure with no mainland-China region. The workforce identities, entitlements and access-certification records it holds for your China operation — the blueprint of who-can-access-what — rest offshore under PIPL. A compliance-first look at the residency, important-data and ICP doors.
Does Saviynt work in China?
Whether Saviynt works in China is a data-residency question, not a speed one. Saviynt's Enterprise Identity Cloud is reachable from the mainland — but as a vendor-hosted IGA SaaS on AWS and Azure, with no mainland-China region, it keeps the workforce identities, entitlements and access-certification records of your China operation in an offshore site.
The distinctive exposure a reachability check never sees is what that record is: the identity graph and entitlement map are a concentrated, security-sensitive blueprint of who-can-access-what across your China estate. Holding it abroad is a cross-border transfer of personal information under PIPL (Articles 38–40), with notice-and-consent duties, an important-data dimension for the governance plane, and Article 24 questions wherever access certification is automated.
This is a risk picture, not a verdict — your duties turn on your data volumes and your role. Our China team can map your Saviynt exposure with you →
What Saviynt's own documentation says about China
| Fact | Primary source |
|---|---|
| Saviynt's own Enterprise Identity Cloud architecture page describes a vendor-hosted global cloud: under its Sovereignty tenet it states, “With 25+ sites around the globe, Saviynt EIC ensures data and backups meet corporate, local, and regional requirements.” None of those sites is named as a mainland-China region or an in-country China residency option. | Saviynt — Enterprise Identity Cloud architecture solution guide (Sovereignty tenet), retrieved 2026-10-12 |
| Saviynt delivers residency through isolated cloud tenants it hosts: its January 2025 announcement says “Isolated environments on AWS and Azure ensure data residency and compliance with local and global regulations” — launched for India. The residency markets Saviynt names publicly (the US, the EU/Frankfurt and India) include no mainland-China region, and it handles tenant placement per customer. | Saviynt press release — dedicated AWS/Azure tenants for India, retrieved 2026-10-12 |
| The workforce identities, entitlements and access-certification records Saviynt holds for people in China are personal information. Holding them in an offshore tenant is a cross-border transfer under PIPL — Articles 38–40 require a transfer mechanism, Articles 13 and 23 require notice and a basis, and automated access certification engages PIPL Article 24 on automated decision-making. | Personal Information Protection Law of the PRC (PIPL), Articles 13, 23, 24, 38–40 |
| For a critical information infrastructure operator or a high-volume handler, the Cybersecurity Law's Article 39 (formerly Article 37) requires personal information generated in China to be stored in the mainland — an in-country storage duty an offshore Saviynt site cannot meet. | Cybersecurity Law of the PRC, Article 39 (formerly Article 37); 2025 amendment in force 2026-01-01 |
Sources verified by the 21YunBox compliance team on 2026-10-12.
For a company that runs Saviynt to govern who inside the organization may reach which systems, the mainland-China question is rarely decided by how quickly the access-request portal paints from Shanghai. Saviynt’s Enterprise Identity Cloud — its identity governance and administration (IGA) platform — is a vendor-hosted SaaS, and it is reachable from inside China, so reachability is not where the decision is made. What settles it is residency and cross-border transfer. An IGA platform exists to hold a precise, continuous record of your workforce and its access: the directory of every identity you govern, the entitlements and roles behind each account, and the access-review and certification history that proves who approved that access and when it was last checked. For your China-based employees, that whole record is personal information — and because Saviynt hosts the Enterprise Identity Cloud on AWS and Azure sites worldwide, with none inside mainland China, that record is held and processed abroad by default. That makes this a compliance-risk question first, not a performance one.
Saviynt in China at a glance
| What decides it | In Saviynt's own terms — and China's law |
|---|---|
| What it is | Saviynt is an identity governance and administration (IGA) platform. Its Enterprise Identity Cloud (EIC) holds the directory of workforce identities you govern, the entitlements and roles behind every account, and the access-review and certification records that document who may reach which systems — a continuous, identifiable record of your employees and their access. |
| Is it reachable from the mainland? | Yes. The Enterprise Identity Cloud is callable from inside China and is not a service blocked at the border, so reachability is not the China question. (Cross-border traffic to an offshore tenant can be inconsistent — an operational matter, not the decision, and never a reason for a network workaround.) |
| Where the identity-governance data sits | Offshore. EIC is a Saviynt-hosted SaaS on AWS and Azure; Saviynt's own architecture page describes “25+ sites around the globe,” and it delivers residency through isolated per-market tenants (it announced dedicated AWS/Azure tenants for India in January 2025). The residency markets it names publicly — the US, the EU/Frankfurt, India — include no mainland-China region, and placement is handled per customer. Confirm your own tenant's region with Saviynt. |
| Workforce identities & entitlements | The identities, entitlement inventories and certification records are personal information. Holding them in an offshore tenant is a cross-border transfer (数据出境) under PIPL Articles 38–40, layered on the Article 13/23 notice-and-consent. For a critical information infrastructure operator or a high-volume handler, Cybersecurity Law Article 39 (formerly Article 37) requires China-collected personal information to be stored in the mainland. |
| The identity graph — a security exposure | This is the half a reachability check never sees. Offshore, the identity graph and the entitlement/role map are a concentrated, security-sensitive blueprint of who-can-access-what across your China operation. That is both a cross-border data issue and, for sensitive operations, may implicate “important data” (重要数据) handling and Multi-Level Protection Scheme (等级保护, MLPS) duties on the governance plane that guards your estate. Frame it as a risk to confirm with counsel, not a settled classification. |
| Automated access certification | Risk-based access requests, auto-provisioning and automated certification campaigns that approve, deny or recommend access about individual employees are automated decision-making under PIPL Article 24 — which requires transparency and an opt-out from decisions made solely by automated means. Where a profile carries sensitive personal information (ID numbers, for example), PIPL Articles 28–29 raise the bar further. |
| A China-facing access portal | A self-service or access-request portal served to employees inside the mainland is reached as an internet service, so it carries an ICP filing (备案) consideration bound to a mainland hosting resource. A Saviynt-hosted portal runs on offshore infrastructure, so it offers no ICP-filing path of its own. |
| The data-resident path | Keep China-resident identity-governance data in-country on a data-resident footing, with the Article 13/23 notice-and-consent, the Article 24 opt-out for automated certification, and the governance plane protected rather than left abroad. 21YunBox maps, localizes and delivers — the 21YunBox Optimizer — in front of what you already run; it never uses or suggests circumvention of any kind. |
What Saviynt actually holds — the blueprint of who-can-access-what
Saviynt is not a static asset like a font or a script; it is the control record for access across your China operation, and it concentrates exactly the data China’s law cares about. Its whole job is to hold a precise, continuous picture of your workforce and its access: every identity you govern, the accounts and entitlements each person holds, the roles that bundle them, and the periodic access reviews and certifications that prove the access was examined and re-approved. For your employees in mainland China, every field of that record is personal information. And the half a reachability check never sees is what that record is when you step back: an access-review or entitlement export is, in effect, a map of who inside your organization can reach which systems — the identity graph and entitlement map read together as a single, security-sensitive blueprint of how your China estate is locked and who holds the keys. Because the Enterprise Identity Cloud is a Saviynt-hosted SaaS running on offshore sites, that blueprint — and your China employees’ personal information — is held and processed abroad by default.
The doors: residency, the identity graph as a security exposure, automated certification, and ICP
The first door is personal-information residency. The identities, entitlement inventories and certification records your Saviynt tenant collects from people in China are personal information under China’s Personal Information Protection Law, and holding them in an offshore site is a cross-border transfer (数据出境). The duty lands on you, the handler, not on Saviynt the processor: Articles 13 and 23 require notice and a basis to collect the data, and Articles 38–40 require a transfer mechanism to send it abroad — a CAC security assessment, the CAC standard contract, or certification. And for a critical information infrastructure operator or a high-volume handler, the Cybersecurity Law’s Article 39 (formerly Article 37 — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, with its substance unchanged) requires personal information generated in China to be stored in the mainland, which an offshore Saviynt site cannot satisfy.
The second door is the one that makes an IGA platform different from an ordinary SaaS. Your identity graph and entitlement map are not just more personal data — offshore, they are a concentrated, security-sensitive record of who can reach what across your China estate: the governance plane that sits in front of everything else. That exposure is both a cross-border data issue and, for sensitive operations, may implicate “important data” (重要数据) handling and the Multi-Level Protection Scheme (等级保护, MLPS) obligations that attach to the authentication and governance control plane. Treat the classification as a risk to confirm with counsel rather than a label to claim — the point is that a blueprint of who holds the keys to your operation, sitting abroad, is a governance question a speed test will never surface.
The third door is automated handling. Saviynt’s risk-based access requests, auto-provisioning, and automated certification campaigns that approve, deny, or recommend access about individual employees are automated decision-making under PIPL Article 24, which gives individuals transparency and an opt-out from decisions made solely by automated means. Where a profile or certification record carries sensitive personal information — ID-document numbers, for instance — Articles 28–29 add a specific-purpose, necessity and separate-consent test on top.
The fourth door is the ICP filing. If you publish a China-facing self-service or access-request portal to employees inside the mainland, that surface is reached as a public internet service, which turns on an ICP filing (ICP 备案) consideration bound to a hosting resource physically inside the mainland. A Saviynt-hosted portal runs offshore, so there is nothing on it to file against — tuning the stack does not create the mainland footing a filing needs.
A reachability check never sees this
Saviynt is not the kind of service that simply refuses to load in China — the exposure is quieter and more durable than a slow paint. Even if the access-request portal and the certification console opened instantly, using them would still place your China employees’ personal information and the concentrated blueprint of your access estate outside the country. A reachability test answers “did the page come back?”; it is blind to where the identity directory, the entitlement map and the certification records come to rest, and to who is lawfully allowed to hold them. For that reason this page publishes no first-party China latency figure for Saviynt — speed is not the axis for a decision that turns on residency and consent. Where the data lives, not how fast it arrives, is what China’s law responds to.
This is a risk map, not a verdict that Saviynt is “blocked” or “illegal” in China. Which duties bite your case turns on your entity, what your directory and certifications actually hold, your role under Chinese law, and whose identities you govern — worth settling the specifics with counsel before your China operation depends on it.
The lawful path — map, localize, deliver
There is a compliant way to run identity governance for a China operation, and it sits in front of the Saviynt your team already uses — no rebuild, no second tool, no migration off the platform.
First, map: our China team inventories what your Saviynt tenant governs — the identity directory, the entitlement and role map, the access-review and certification records, and any China-facing access portal — establishes where it is hosted (an offshore Saviynt site), the ICP status of any public surface, and the consent and residency basis each flow relies on. We build the technical picture; the legal conclusions are settled with counsel.
Then localize/govern: we help you keep the regulated data — the China-resident workforce identities, entitlements and certification records — on a lawful in-country footing, obtain the Article 13/23 notice-and-consent, provide the Article 24 opt-out for automated certification, treat any biometric or ID-document factor as sensitive personal information, and protect the governance plane rather than leaving it to rest abroad. Localize means keeping the identity data on an in-country path — never a route that ships it offshore anyway.
Then deliver: any public China-facing access surface is reached as an internet service, so it carries an ICP filing consideration bound to mainland hosting and needs compliant, in-country delivery. 21YunBox stands that up — the 21YunBox Optimizer — in front of what you already run, so it serves your users in China legally and compliantly. 21YunBox never uses or suggests circumvention of any kind — we keep in-country what the law says must stay, deliver the rest compliantly from inside the mainland, and never move personal information across the border by stealth. Making an offshore tenant merely reachable is not the answer; keeping the regulated identity data in-country, filing the portal and delivering it compliantly is. 21YunBox is a compliance overlay and partner to the identity platform you already run, not a competitor to it.
Related reading:
- China’s Personal Information Protection Law (PIPL)
- Cross-border data transfers under PIPL
- China’s Cybersecurity Law (data localization, Article 39)
- How to get an ICP filing for China
