Does Sitecore Search Work in China? Data Residency, PIPL & an Offshore Search API
Sitecore Search is a cloud-based, Sitecore-hosted site-search service with no mainland-China region, so your search index and the queries, interactions and events it logs from visitors sit offshore — a PIPL cross-border transfer, and every search is answered across the border. A compliance-first look at where your search data lives.
Does Sitecore Search work in China?
Whether you can use Sitecore Search in mainland China is first a data-residency and cross-border-data question, not a speed one. Sitecore Search is hosted search and discovery: it crawls and indexes your content, then records what your visitors search and do to rank and tune results — and where that index and those logs are kept is what China's law responds to.
Sitecore describes Sitecore Search in its own documentation as "a cloud-based solution," whose dashboards "Track your domains, locales, search keyphrases, content, widgets, and visitor interactions" and whose APIs "log visitor-driven events" — and it names no region inside mainland China. So your index, the searches your China visitors type, and the behavioral events tied to them are processed and stored offshore: a cross-border transfer of personal information that PIPL governs, needing notice, separate consent, a transfer mechanism, and for a CIIO or large-volume handler, in-country storage. And because every query is answered by that offshore API, on-site search leans on a path that crosses the border each time. The table below is Sitecore's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on what your index holds, how much personal data your queries carry, and who your users are. Our China team can map your Sitecore Search exposure with you →
Compliance snapshot
- ! Reachable, but on-site search is answered by an offshore cloud API — every query your China visitors type is resolved across the border
- ✕ Sitecore documents no mainland-China region for Sitecore Search: the index and the event logs it builds sit offshore by design
- ! It records visitors' search keyphrases, interactions and events — personal, behavioral data held offshore, a PIPL cross-border transfer
- ! On-site search answers between keystrokes, so a degraded or interrupted cross-border path degrades or breaks it
- ✓ A compliant, ICP-filed in-country delivery path exists — no rebuild, no migration off Sitecore Search
What Sitecore Search's own documentation says about China
| Fact | Primary source |
|---|---|
| In Sitecore's own words: Sitecore Search is "a cloud-based solution" for AI-powered search — a hosted service you configure and call over APIs. Its documentation names no region inside mainland China, so for a China-facing site the index your results are drawn from is hosted offshore. | Sitecore — Sitecore Search Documentation (doc.sitecore.com/search), retrieved 2026-10-08 |
| Sitecore Search records your visitors, not just your catalog. Its own documentation says the service lets you "Track your domains, locales, search keyphrases, content, widgets, and visitor interactions," and that its "Query APIs" both return results and "log visitor-driven events." The search keyphrases visitors type and the events they generate routinely carry personal data — IP addresses, identifiers, session context — and all of it is kept in the offshore service. | Sitecore — Sitecore Search Documentation (doc.sitecore.com/search), retrieved 2026-10-08 |
| Search keyphrases, visitor interactions and event logs captured from users in China and held in an offshore Sitecore Search tenant leave the country. PIPL governs that cross-border transfer: the personal-information handler — you, Sitecore's customer, not Sitecore — must give notice, obtain separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 |
| For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored inside mainland China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Because Sitecore documents no mainland-China region for Sitecore Search, keeping your China visitors' search and behavioral data on Chinese soil means running that collection and storage on infrastructure inside the mainland — which is where a lawful China presence and its ICP filing enter the picture. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37); Sitecore — Sitecore Search Documentation (no mainland region), retrieved 2026-10-08 |
| Every search is answered by Sitecore Search's cloud "Query APIs," and with no mainland-China region each query from China is resolved across the border. On-site search returns results between keystrokes, so it is unusually sensitive to that round trip: when the cross-border path degrades or is interrupted, on-site search degrades or stops with it. That is a delivery exposure, separate from — and on top of — the data-residency one. | Sitecore — Sitecore Search Documentation (doc.sitecore.com/search), retrieved 2026-10-08 |
Sources verified by the 21YunBox compliance team on 2026-10-08.
For a mainland-China audience, the deciding question about Sitecore Search is not how quickly a results list paints — it is where your search index is allowed to sit, where the queries and behavior it records from your visitors end up, and whether the cloud API your on-site search calls stays reachable from inside the mainland. Sitecore Search is hosted search and discovery: it crawls and indexes your content, then logs what your visitors type and do to tune relevance. Sitecore describes it in its own documentation as a cloud-based service, and names no region inside mainland China. A China-facing site can still reach it, but the index and the query logs are served and stored offshore, and every search is answered across the border — which turns on-site search into a cross-border transfer of personal information China’s law governs. The reachability is a delivery matter; the residency and the transfer are the exposure.
Sitecore Search in China at a glance
| What decides it | In Sitecore's own terms |
|---|---|
| Where it runs | A cloud-based search service Sitecore hosts and you call over APIs. Its documentation names no region inside mainland China, so the index your results come from is served from offshore. |
| What it stores | Your searchable index, plus what it records to tune relevance — Sitecore Search lets you “Track your domains, locales, search keyphrases, content, widgets, and visitor interactions,” and its APIs “log visitor-driven events.” All of it sits in the offshore tenant. |
| Your China visitors' data | Search keyphrases, interactions and event logs carry personal data — IP addresses, identifiers, session context. Collected in China and held offshore, that is a cross-border transfer PIPL governs, with an in-country storage duty for CIIOs and large-volume handlers that an offshore tenant cannot meet. |
| Serving each search | Each query is answered by the cloud Query API in an offshore region. With none in mainland China, every search your China visitors run is resolved across the border. |
| Is it reachable? | Yes — Sitecore Search is not blocked. But on-site search answers between keystrokes, so a degraded cross-border path is felt sharply, and a disruption to that path takes the search box down with it. |
A cloud-hosted search service with no mainland region
Sitecore Search is not software you run — it is a service Sitecore hosts and you reach over APIs. In its own documentation Sitecore calls it “a cloud-based solution” for AI-powered search, and that documentation names no region inside mainland China. For a China-facing audience that settles the starting point before performance ever enters it: the index your results are drawn from lives offshore, and the site that queries it reaches across the border for every search.
What it records is your visitors’ searches, not only your catalog
What Sitecore Search keeps is more than a copy of your content. To rank and personalize results it records what your audience does: in Sitecore’s own words the service lets you “Track your domains, locales, search keyphrases, content, widgets, and visitor interactions,” and its “Query APIs” both return results and “log visitor-driven events.” Those search keyphrases and events routinely carry personal information — IP addresses, user and session identifiers, the terms a person typed. Gathered from visitors in China and written to an offshore tenant, that information leaves the country.
Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, Sitecore’s customer, not Sitecore — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore-only search tenant cannot satisfy. Standing up that in-country collection and storage legally is where an ICP filing enters the picture.
Reachable, but every search leans on an offshore API
Sitecore Search is not blocked in China. But it is a hosted API, not a page you can simply cache: each query your China visitors run is answered by the cloud Query API in an offshore region, and with none in mainland China that request and its response cross the border every time. On-site search is also unusually unforgiving of distance — a visitor types and expects matches to appear between keystrokes — so a poor or interrupted cross-border path does not just slow the site, it can degrade or break the search box itself. That delivery problem is worth solving, but it is a separate matter from the compliance one: tuning the network does not move your index onshore, and it does not clear the PIPL transfer that offshore storage creates.
This is a risk map, not a verdict: whether you need a transfer mechanism, in-country storage, in-country delivery, or all three depends on what your index holds, how much personal data your queries carry, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building on Sitecore Search. We add the piece a hosted search service with no mainland region leaves to you: compliant, ICP-filed delivery from inside the mainland, set in front of the site that queries your Sitecore Search endpoints — no rebuild, no second search platform, and no move off Sitecore. Our China team maps your PIPL cross-border and data-residency obligations against your entity and the personal data your queries carry, then stands up the in-country delivery and, where the law requires your China visitors’ search data to stay on the mainland, the in-country storage a lawful China presence needs — while your index and relevance models stay exactly where they already run.
Related reading:
Frequently Asked Questions
Does Sitecore Search store Chinese visitors' search data in China?
No. Sitecore's own documentation describes Sitecore Search as a cloud-based service and names no region inside mainland China. The index it builds from your content, the search keyphrases your visitors type, and the visitor-driven events it logs are held in that offshore service, not on Chinese soil.
Is it against the law to use Sitecore Search in China?
Not inherently. The issue is the cross-border transfer of the personal data inside those search queries, interactions and event logs, which PIPL permits if you give notice, obtain separate consent and meet one of its transfer mechanisms. Whether you also face an in-country storage duty depends on your role (for example, whether you are a critical information infrastructure operator) and the volume of personal information you handle — and under the CAC's March 2024 cross-border rules, a non-CIIO moving fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the assessment, standard contract and certification. Treat it as a risk to confirm with counsel, not a blanket prohibition.
Can 21YunBox help make our Sitecore Search setup compliant in China?
Yes. Our China team can help you assess the cross-border and data-residency exposure for your data volumes and role, and stand up compliant, ICP-filed in-country delivery — and, where the law requires your China visitors' search data to stay on the mainland, in-country storage — without moving you off Sitecore Search. Get in touch to work through your specific case.
