Does Sitecore XM Cloud Work in China? ICP, Data Residency & an Offshore SaaS
Sitecore XM Cloud is a Sitecore-hosted SaaS delivered from a global CDN with no region inside mainland China — so a China-facing site has no ICP-filing host, and the visitor data its personalization collects sits offshore under PIPL. A compliance-first look at the two doors.
Does Sitecore XM Cloud work in China?
Yes, Sitecore XM Cloud is reachable in mainland China — but as a Sitecore-hosted, offshore SaaS it leaves you with no in-country host to ICP-file, and the visitor data its personalization collects sits outside the mainland. "We run on XM Cloud" does not make a China-facing site compliant.
XM Cloud delivers content through Sitecore Experience Edge — in Sitecore's words a GraphQL endpoint "distributed through a CDN, and hosted by Sitecore," built to "globally replicate and scale your Sitecore content delivery." None of that path sits inside the mainland: Sitecore's published hosting regions include none in mainland China, so a public site served this way has no in-country resource to attach an ICP filing to. Meanwhile XM Cloud "uses cookies to identify site visitors" to personalize, so your China users' personal information is collected and held offshore — a cross-border transfer PIPL governs. The table below is Sitecore's own wording and the rule each line triggers.
This is a risk map, not a verdict — which obligations bite depends on your entity, your data and who your users are. Our China team can map your exposure with you →
What Sitecore XM Cloud's own documentation says about China
| Fact | Primary source |
|---|---|
| XM Cloud is Sitecore-hosted SaaS, delivered from a global CDN — none of it inside mainland China. Content reaches the browser through Sitecore Experience Edge, which Sitecore describes as a GraphQL "service endpoint that allows you to retrieve layout and content," "distributed through a CDN, and hosted by Sitecore," built to "globally replicate and scale your Sitecore content delivery." It is reachable, but served entirely from offshore infrastructure Sitecore runs — not from a host you could place in the mainland. | Sitecore documentation — Experience Edge for XM (doc.sitecore.com/xmc), retrieved 2026-10-07 |
| A site served from XM Cloud has no mainland host to ICP-file. A public-facing website shown to mainland visitors needs an ICP filing (ICP 备案) tied to a hosting resource physically inside China, under State Council Order No. 292 and MIIT Order No. 33. Because XM Cloud is hosted by Sitecore on offshore regions — its published locations include none in mainland China — there is nothing on the XM Cloud side to file against, however fast it loads. | Sitecore documentation — Experience Edge for XM (doc.sitecore.com/xmc), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
| XM Cloud is built around visitor data, which widens your cross-border exposure. Its personalization "uses cookies to identify site visitors" and serves variations "based on their behavior, such as the pages they viewed," with real-time site and page analytics on top. That is personal information — collected from your China users and processed on offshore infrastructure, which PIPL treats as a cross-border transfer (notice, separate consent and a transfer mechanism, Articles 38–43). A static CMS exports less; a personalization engine exports more. | Sitecore documentation — Personalize in XM Cloud (doc.sitecore.com/xmc), retrieved 2026-10-07; PIPL Articles 38–43 |
| Where your XM Cloud data lives is a region you pick at setup — and none is in mainland China. An XM Cloud project is created in a Sitecore region you select, and Sitecore's published hosting locations run to the Americas, Europe and Asia-Pacific, among others; none of those regions is in mainland China, so the nearest sits offshore. For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty no offshore region can meet. | Sitecore documentation — managing an XM Cloud environment (doc.sitecore.com/xmc) & Sitecore published hosting regions, retrieved 2026-10-07; PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the first question about Sitecore XM Cloud is not how quickly it renders — it is whether a site built on it can be operated legally there, and where the data it gathers on your visitors is allowed to live. XM Cloud answers both in Sitecore’s own documentation: it is a Sitecore-hosted SaaS whose content is delivered from a global CDN, with no region inside mainland China. A China-facing XM Cloud site is therefore reachable but entirely offshore — which leaves it with no footing for the ICP filing a public mainland site requires, and turns the visitor data its personalization collects into a cross-border transfer China’s law governs. The reachability is real; the licensing and the data residency are the exposure.
Sitecore XM Cloud in China at a glance
| What decides it | In Sitecore's own terms |
|---|---|
| Where it runs | A Sitecore-hosted SaaS. Content is delivered through Sitecore Experience Edge — a GraphQL endpoint “distributed through a CDN, and hosted by Sitecore.” The delivery is global, but none of it is inside mainland China. |
| Serving the public | A public mainland site needs an ICP filing bound to a host physically in China. XM Cloud provides no mainland host, so there is no footing on the XM Cloud side for a filing. |
| Your visitors' data | Personalization “uses cookies to identify site visitors” and acts on their behavior, with real-time analytics — personal information collected from China users and held offshore. |
| Where your data sits | A region you choose at project setup, from Sitecore's global hosting footprint across the Americas, Europe and Asia-Pacific — none inside mainland China, so the nearest sits offshore. |
| Is it reachable? | Yes — Experience Edge is a global CDN, so the site generally loads rather than being blocked. Reachability is the delivery half of the question, not the legal half. |
No mainland host, so no footing for an ICP filing
Sitecore hosts XM Cloud and ships its content from Sitecore Experience Edge — in Sitecore’s own words a GraphQL “service endpoint that allows you to retrieve layout and content,” one “distributed through a CDN, and hosted by Sitecore” and built to “globally replicate and scale your Sitecore content delivery.” That delivery is global, but it is not Chinese: none of the regions Sitecore offers for XM Cloud sits inside the mainland.
That settles the licensing question before performance is even on the table. A public-facing site shown to mainland visitors turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing has to attach to a hosting resource physically located in China. XM Cloud gives you none, so there is nothing on the XM Cloud side to file against. This is where “we’re already on XM Cloud” stops carrying: being reachable from China is not the same as being licensed to run a public site there, and no amount of tuning conjures the in-country host a filing needs.
Your China visitors’ data — and XM Cloud is built to collect it
XM Cloud is not a static publisher. Its personalization “uses cookies to identify site visitors” and serves them variations “based on their behavior, such as the pages they viewed,” with real-time site and page analytics layered on top — and it can draw on data its connected Sitecore CDP and Personalize hold about those same visitors. All of that is personal information, and on XM Cloud it is collected from your users in China and processed on offshore infrastructure.
Under China’s Personal Information Protection Law that is a cross-border transfer: you — the handler, not Sitecore — must give notice, obtain separate consent, and clear one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification) under Articles 38–43. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — which an offshore XM Cloud region cannot do. A plain CMS exports a little data; a personalization engine exports a lot, so the data-residency door is wider here, not narrower.
Reachable from a global CDN — which is not the same as compliant
Experience Edge is a global CDN, so an XM Cloud site generally loads for mainland visitors rather than being blocked outright. But reachability is the delivery half of the question, not the legal half. Being able to see the page does not give the site an ICP filing, and it does not bring your visitors’ personal data back inside the border. Those two gaps are compliance facts, and network distance has nothing to do with closing them.
This is a risk map, not a verdict: whether an ICP filing, in-country storage, or both apply to you depends on what you publish, how much personal data you hold, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
Your team keeps authoring, personalizing and publishing in XM Cloud exactly as today. What we add is the single piece a Sitecore-hosted SaaS cannot put inside the mainland: lawful, ICP-filed delivery from within mainland China, set in front of your existing XM Cloud origin — no rebuild, no parallel codebase, and no moving off Sitecore. Our China team weighs your ICP obligation and your PIPL cross-border and data-residency exposure against your entity, your data volumes and who your users are, then stands up the in-country delivery and storage a lawful China presence calls for, while Experience Edge and your front end stay right where they already run.
Related reading:
