Does ServiceNow Work in China? Data Residency, PIPL & Its Offshore Data Centers
ServiceNow is reachable from mainland China, so the deciding question isn't speed — it's where your data lives. ServiceNow hosts each instance in its own data centers, arranged in pairs by region, and none is in mainland China. So the employee and enterprise personal data your instance holds is stored offshore: a cross-border transfer PIPL governs. A compliance-first look at the data-residency door.
Does ServiceNow work in China?
Whether you can run ServiceNow for mainland China is a data-residency question, not a speed one. ServiceNow is reachable from inside the mainland and loads at a workable speed — the exposure is legal, not performance.
By ServiceNow's own account, "ServiceNow's data centers are arranged in pairs, with all customer production data hosted in both data centers simultaneously and kept in sync using asynchronous database replication" — and the data-center pair that hosts your instance sits in one region, none of which is in mainland China. So the employee profiles, requester identities and case records your instance holds are kept offshore: a cross-border transfer of personal information PIPL governs — it needs notice, separate consent, a transfer mechanism, and for a CIIO or large-volume handler, in-country storage. The table below is ServiceNow's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on your data volumes and your role. Our China team can map your ServiceNow data exposure with you →
Compliance snapshot
- ✓ Reachable from inside China and loads at a workable speed — speed isn't the deciding issue
- ! Hosts your instance in ServiceNow's own offshore data-center pairs — no mainland-China region
- ! Employee and enterprise personal data sits offshore — a PIPL cross-border transfer
- ✕ No mainland-China data center or in-country data-residency option on the platform
- ✓ A compliant path exists: map the transfer, add ICP-filed in-country delivery where it's public-facing
What ServiceNow's documentation says, and what we measured from inside China
| Fact | Primary source |
|---|---|
| In ServiceNow's own words: "ServiceNow's data centers are arranged in pairs, with all customer production data hosted in both data centers simultaneously and kept in sync using asynchronous database replication." ServiceNow hosts your instance in its own global data centers, and the pair that holds it sits in a single geographic region — none in mainland China. | ServiceNow — Platform Privacy & Security Blog, "Data backup for my ServiceNow instances", retrieved 2026-10-07 |
| ServiceNow runs its own data centers across the Americas, Europe, the Middle East and Asia Pacific; it provides each instance's exact location to customers directly and publishes no data center in mainland China — the nearest to the mainland being Hong Kong, Japan, Singapore and Korea. There is no China-bound data-residency option on the platform. | ServiceNow — Advanced High Availability (AHA) Architecture white-paper |
| Because a ServiceNow instance holds personal information — employee records, requester identities, HR and IT case data, and any customer data your ServiceNow experiences collect — and stores it in that offshore pair, data gathered from people in China is transferred abroad. PIPL governs that cross-border transfer: the personal-information handler (you, the ServiceNow customer — not ServiceNow) must give notice, obtain separate consent, and satisfy one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 |
| Exposure scales with volume and role. Under the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification. But a CIIO or large-volume handler must store personal information collected in China inside the mainland (CSL Article 39 (formerly Article 37); PIPL Article 40) — a duty no ServiceNow region can meet, and because ServiceNow is a managed service you cannot self-host, meeting it means mapping and segregating which Chinese users' data has to stay onshore. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows (March 2024); CSL Article 39 (formerly Article 37); PIPL Article 40 |
| ServiceNow's site completed all 3 page loads requested from a probe inside mainland China (Alibaba Cloud cn-zhangjiakou) on 2026-08-28, with a median time to first byte of 1,766 ms and a largest-contentful-paint of 1,836 ms. It loads — which is exactly why the real question is legal, not performance. A customer instance is an offshore SaaS endpoint reached across the border; where its data sits is what China's law responds to. | 21YunBox — China delivery measurement, measured from inside mainland China |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a team rolling ServiceNow out to mainland China, the question that actually decides things is not how quickly the platform paints — it is where the records inside it are allowed to live. ServiceNow is a system of record for workflows: it holds employee profiles, requester identities, HR and IT case histories, and whatever data the customer- or citizen-facing experiences you build on it collect. By ServiceNow’s own account the platform runs in ServiceNow-operated data centers arranged in pairs, and the data-center pair that hosts your instance sits in one geographic region — none of which is in mainland China. So a China-facing ServiceNow instance is reachable, yet every record it keeps is stored offshore: a cross-border transfer of personal information China’s law governs, not a latency problem.
ServiceNow in China at a glance
| What decides it | In ServiceNow's own terms |
|---|---|
| Where your data lives | ServiceNow hosts your instance in its own data centers, “arranged in pairs, with all customer production data hosted in both data centers simultaneously.” The pair that holds your instance sits in one region — across the Americas, Europe, the Middle East or Asia Pacific — and none is in mainland China; the nearest are Hong Kong, Japan, Singapore and Korea. |
| The cross-border transfer | Employee, requester and case data your instance collects in China lands in that offshore pair. That is a cross-border transfer of personal information PIPL governs — and the handler is you, the ServiceNow customer, not ServiceNow. |
| When the rules bite harder | Exposure scales with volume and role. Under the CAC's March 2024 cross-border rules, a non-CIIO moving fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification. |
| Data residency | For a CIIO or large-volume handler, personal information collected in China must be stored inside the mainland (CSL Article 39 (formerly Article 37); PIPL Article 40) — a duty no ServiceNow region can meet, and one you cannot self-host your way out of on a managed platform. |
| Is it reachable? | Yes — ServiceNow's site completed all 3 page loads requested from an Alibaba Cloud probe in Zhangjiakou on 2026-08-28 (median TTFB 1,766 ms, LCP 1,836 ms). A customer instance is an offshore endpoint reached across the border; the exposure is where the data sits, not whether it loads. |
No mainland region, so your instance data stays offshore
ServiceNow runs its own global data centers rather than renting a public-cloud region per customer, and it keeps them in matched pairs for resilience. In its own Platform Privacy & Security material, “ServiceNow’s data centers are arranged in pairs, with all customer production data hosted in both data centers simultaneously and kept in sync using asynchronous database replication.” The pair assigned to your instance lives in a single geographic region — ServiceNow documents its footprint across the Americas, Europe, the Middle East and Asia Pacific, and offers region- and country-bound hosting where it operates data centers.
The catch for China is what that map does not include. ServiceNow publishes no data center in mainland China; it provides each instance’s exact location to customers directly, and the nearest sites to the mainland are in Hong Kong, Japan, Singapore and Korea — all offshore. So the moment your instance serves people in China, the employee profiles, requester identities and case records it writes are kept outside the mainland, and that geography — not latency — is what China’s data law responds to.
Serve China from ServiceNow and your users’ data crosses the border
Personal information your instance gathers from people in China — staff identities, contact details, ticket contents, anything that identifies them — is written to that offshore pair. Under China’s Personal Information Protection Law, keeping it outside the mainland is a cross-border transfer, and the duty lands on the personal-information handler, which is you as the ServiceNow customer and not ServiceNow as the platform. PIPL asks that handler to give affected people notice, obtain their separate consent for the transfer, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. “We already run ServiceNow” answers none of that; operating the platform and being cleared to move Chinese users’ data out of the country are different questions.
How much is at stake depends on your volume and your role
The weight of these duties is not uniform. Under the CAC’s March 2024 Regulations on Promoting and Regulating Cross-border Data Flows, a handler that is not a critical information infrastructure operator and moves fewer than 100,000 individuals’ non-sensitive personal information in a calendar year is exempt from the security assessment, the standard contract and certification — a lighter path for a smaller rollout.
At the other end, a CIIO or large-volume handler carries a data-residency duty: personal information collected in China must be stored inside the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40). No ServiceNow region can satisfy that, and because ServiceNow is a managed service you do not self-host, you cannot simply stand it up on a server in Shanghai. Meeting the duty instead means mapping which Chinese users’ personal data has to stay onshore and keeping that data in-country, separate from the offshore instance — and wherever a ServiceNow experience is public-facing to mainland users, standing it up lawfully also brings an ICP filing into view.
Reachable, not blocked — which is why this is a data question
ServiceNow is not walled off from China. In 21YunBox’s own measurement from inside the mainland — an Alibaba Cloud probe in Zhangjiakou on 2026-08-28 — ServiceNow’s site completed all 3 of the page loads requested, with a median time to first byte of 1,766 ms and a largest-contentful-paint of 1,836 ms. It loads, and it loads at a usable speed. That is precisely why the real exposure on a China-facing ServiceNow instance is not whether people can reach it, but that reaching it leaves your employees’ and users’ personal data offshore with no mainland data-residency option. Those are compliance facts, and no amount of network tuning changes where the data is stored.
This is a risk map, not a verdict: whether you owe notice and consent only, a full transfer mechanism, or in-country storage of the data itself turns on how much personal information you hold and whether your role pulls you into the CIIO or large-volume tier — a question to settle with counsel before you scale the rollout.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running ServiceNow; nothing moves off the platform. What we add is the layer a managed SaaS with no mainland region cannot give you on its own: compliant, ICP-filed delivery from inside the mainland, set in front of any public-facing ServiceNow experience — a customer or citizen portal, a knowledge base, a Customer Service Management site — with no rebuild and no second codebase. Our China team first maps your cross-border and data-residency obligations against your entity and your data volumes. Then, for the case the law treats most strictly — where Chinese users’ personal data has to remain on the mainland — we help you design where that data is kept and how it is segregated from the offshore instance, so the records that must stay on Chinese soil do, while the rest of ServiceNow stays exactly where it already runs.
Related reading:
Frequently Asked Questions
Does ServiceNow store Chinese users' data in China?
No. By ServiceNow's own account its data centers are arranged in pairs with all customer production data hosted in them, and the pair that holds your instance sits in one region — none in mainland China, the nearest being Hong Kong, Japan, Singapore or Korea. ServiceNow provides each instance's exact location to customers directly. So the employee and enterprise records your instance collects in China are stored offshore.
Is it against the law to use ServiceNow in China?
Not inherently. The issue is the cross-border transfer of personal information, which PIPL permits if you give notice, obtain separate consent and meet one of its transfer mechanisms. Whether you also face a data-localization duty depends on your role — for example, whether you are a critical information infrastructure operator — and the volume of personal information you handle. Treat this as a risk to assess with counsel, not a blanket prohibition.
Can 21YunBox help make our ServiceNow setup compliant in China?
Yes. Our China team can assess the cross-border and data-residency exposure for your data volumes and role, stand up compliant, ICP-filed in-country delivery in front of any public-facing ServiceNow experience, and help you design where Chinese users' personal data is kept where the law requires it onshore. Get in touch to work through your specific case.
