Does Splunk Work in China? Logs, PIPL Cross-Border Transfer & Data Residency
Splunk Cloud runs no region inside mainland China — its AWS, Google Cloud and Azure regions sit in the US, Europe, Asia Pacific and beyond — so the logs, events and traces you collect from Chinese users are indexed offshore, and the personal data inside them crosses the border under PIPL. A compliance-first look at the two doors.
Does Splunk work in China?
Yes — Splunk Cloud ingests and indexes machine data from mainland China, but that reachability is the easy half. Splunk Cloud runs no region inside the mainland, so every log, event and trace you collect in China is shipped to and indexed in a Splunk Cloud region offshore — and the personal data inside those logs crossing the border is a PIPL question, not a speed one.
By Splunk's own Service Details, "Splunk Cloud Platform is available in the following global regions for new stacks" — on AWS, Google Cloud and Microsoft Azure across the US, the UK, Europe, Asia Pacific (Tokyo, Seoul, Singapore, Sydney, Mumbai, Indonesia), Canada, South America and the Middle East. None is in mainland China. Splunk "provides software and APIs that enable you to ingest data from your applications, cloud services, servers, network devices, and sensors into the service," and that machine data routinely carries client IPs, user IDs and request contents. Collected from mainland users and indexed offshore, that personal information is a cross-border transfer PIPL governs (notice, separate consent and a transfer mechanism, Articles 38–43), and for a CIIO or large-volume handler it must be stored in China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). The table below is Splunk's own wording and the rule each line triggers.
This is a risk map, not a verdict — what applies turns on the data your logs carry, how much of it is personal, and who your users are. Our China team can map your exposure with you →
Compliance snapshot
- ! No mainland-China region on AWS, GCP or Azure — your China logs index offshore
- ! Logs, events and traces carry client IPs, user IDs and request data — personal information
- ! Shipping that machine data to a Splunk Cloud region is a cross-border transfer under PIPL
- ✕ No in-country storage option, so data-residency duties can't be met on Splunk Cloud
- ✓ Reachability isn't the question — where the ingested data lands is
What Splunk's own documentation says about China
| Fact | Primary source |
|---|---|
| Splunk Cloud runs no region inside mainland China. Splunk's own Service Details states that "Splunk Cloud Platform is available in the following global regions for new stacks," then lists them across three cloud providers — on AWS: US (Oregon, Virginia), UK (London), Europe (Dublin, Frankfurt, Milan, Paris), Asia Pacific (Indonesia, Mumbai, Seoul, Singapore, Sydney, Tokyo), Canada (Central) and South America (Brazil); on Google Cloud: US (Iowa), Europe (Frankfurt) and Middle East (Dammam); on Microsoft Azure: US (Phoenix, Virginia), UK (London) and Asia Pacific (Tokyo). Not one is in mainland China — the nearest, Tokyo, Seoul and Singapore, are still offshore — so the logs, events and traces you collect in China are indexed on a Splunk Cloud region outside the mainland. | Splunk — Splunk Cloud Platform Service Details (docs.splunk.com), retrieved 2026-10-07 |
| The machine data Splunk ingests is personal information. By Splunk's own Service Details, Splunk Cloud "provides software and APIs that enable you to ingest data from your applications, cloud services, servers, network devices, and sensors into the service" — your forwarders and HTTP Event Collector post that data outbound to a Splunk Cloud region. Logs, events and traces routinely carry client IP addresses, user IDs and the contents of requests. Gathered from mainland users and shipped to an offshore region, that is a cross-border transfer of personal information under PIPL — notice, separate consent and a transfer mechanism (Articles 38–43). | Splunk — Splunk Cloud Platform Service Details (docs.splunk.com), retrieved 2026-10-07; PIPL Articles 38–43 |
| Splunk Cloud offers no way to keep the data in the mainland. You choose from Splunk's published regions, but every one of them — in the US, UK, Europe, Asia Pacific, Canada, South America and the Middle East — is outside mainland China. For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a data-residency duty Splunk Cloud's offshore-only regions cannot satisfy. | Splunk — Splunk Cloud Platform Service Details (docs.splunk.com), retrieved 2026-10-07; PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| Reachability is the easy half — Splunk Cloud is a backend, not a hosted site. Splunk's Service Details notes that "Splunk Cloud Platform does not allow direct access to infrastructure by customers" and that "data in transit is TLS 1.2+ encrypted": it is a destination you send machine data to, not a public website it serves for you. So the ICP filing question (State Council Order No. 292; MIIT Order No. 33) attaches to the public mainland website or app you operate, not to Splunk — while the PIPL cross-border and data-residency duties attach to the telemetry Splunk carries offshore. | Splunk — Splunk Cloud Platform Service Details (docs.splunk.com), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the question about Splunk is not how quickly a dashboard paints — it is where the machine data you pour into it is allowed to live. Splunk Cloud Platform is an ingest-and-index service: your forwarders and HTTP Event Collector ship logs, events and traces out to a Splunk Cloud region, and that data routinely carries personal information — client IP addresses, user IDs, the contents of requests. Splunk runs those regions on AWS, Google Cloud and Microsoft Azure, and not one of them sits inside mainland China. So a China-facing Splunk pipeline is reachable, but the personal data inside your logs leaves the country the moment it is ingested — a cross-border transfer China’s law governs, with no in-country region to fall back on. Reachability is the easy half; residency and the cross-border transfer are the exposure.
Splunk in China at a glance
| What decides it | In Splunk's own terms |
|---|---|
| Where it runs | Splunk Cloud Platform regions run on AWS, Google Cloud and Microsoft Azure — the US, UK, Europe (Dublin, Frankfurt, Milan, Paris), Asia Pacific (Tokyo, Seoul, Singapore, Sydney, Mumbai, Indonesia), Canada, South America and the Middle East (Dammam). No region is inside mainland China; the nearest — Tokyo, Seoul, Singapore — are still offshore. |
| What you send it | Splunk Cloud “provides software and APIs that enable you to ingest data from your applications, cloud services, servers, network devices, and sensors into the service.” Your forwarders and HTTP Event Collector post logs, events and traces outbound to a Splunk Cloud region. |
| What the data contains | Machine data is rarely anonymous: logs, events and traces routinely carry client IP addresses, user IDs, session identifiers and request contents — personal information under Chinese law. |
| A backend, not a hosted site | “Splunk Cloud Platform does not allow direct access to infrastructure by customers,” and “data in transit is TLS 1.2+ encrypted.” It is a destination you send data to, not a public website it serves for you. |
| Your data on Splunk Cloud | Telemetry collected from mainland users and indexed offshore is a cross-border transfer of personal information PIPL governs, plus a data-localization duty for CIIOs and large-volume handlers that an offshore-only region cannot meet. |
No mainland region — your logs are indexed offshore
Splunk Cloud Platform runs on AWS, Google Cloud and Microsoft Azure, and in Splunk’s own Service Details it is “available in the following global regions for new stacks” — the US, the UK, Europe (Dublin, Frankfurt, Milan, Paris), Asia Pacific (Tokyo, Seoul, Singapore, Sydney, Mumbai, Indonesia), Canada, South America and the Middle East (Dammam). Not one of those regions is in mainland China, and the closest — Tokyo, Seoul, Singapore — are still outside it.
That geography settles the residency question before performance ever enters it. For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland under China’s Personal Information Protection Law (Article 40) and the Cybersecurity Law (Article 39, formerly Article 37). Splunk publishes no mainland region, so there is nowhere on Splunk Cloud to keep that data on Chinese soil. Tuning the ingest pipeline does not change where the index physically sits.
The personal data lives inside the logs
Splunk is not serving web pages to your visitors — it is collecting your machine data. But machine data is rarely anonymous. Splunk Cloud “provides software and APIs that enable you to ingest data from your applications, cloud services, servers, network devices, and sensors into the service,” and the logs, events and traces that flow in routinely carry client IP addresses, user IDs, session identifiers and the contents of requests. Those are personal information under Chinese law.
Ship that data from a mainland forwarder or HTTP Event Collector to an offshore Splunk Cloud region and you have made a cross-border transfer of personal information. PIPL puts the duty on the handler — you, Splunk’s customer, not Splunk — to give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). The transfer happens the moment the data is ingested; it is a property of where the pipeline terminates, not of how fast it runs.
Where the ICP line actually falls
It is worth being precise about which rule bites where. An ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33 attaches to the public-facing website or app you operate for mainland visitors — not to a backend like Splunk, which “does not allow direct access to infrastructure by customers” and serves nothing to your users on your behalf. So “we already run Splunk” neither creates nor discharges an ICP obligation. What Splunk does put on your plate is the other door: the personal data inside your telemetry leaving the country, and the residency duty an offshore-only region cannot meet.
This is a risk map, not a verdict: whether you face a transfer mechanism, in-country storage, or both turns on what your logs carry, how much personal data you hold, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building on Splunk. We add the piece a logging backend with no mainland presence cannot: compliant, ICP-filed delivery and storage from inside the mainland, placed in front of the stack you already run — no rebuild, no second pipeline, and no move off Splunk. Our China team maps your PIPL cross-border and data-residency obligations against your entity and your data volumes, then stands up the in-country delivery and storage a lawful China presence needs, so the telemetry that can lawfully leave the mainland still flows to Splunk exactly as it does today.
Related reading:
Frequently Asked Questions
Does Splunk Cloud have a data center or region in mainland China?
No. Splunk's own Service Details lists the regions Splunk Cloud Platform runs in — on AWS, Google Cloud and Microsoft Azure across the US, the UK, Europe, Asia Pacific (Tokyo, Seoul, Singapore, Sydney, Mumbai, Indonesia), Canada, South America and the Middle East — and none sits in mainland China, the nearest being Tokyo, Seoul and Singapore. So the logs, events and traces you collect from Chinese users and servers are indexed on a Splunk Cloud region offshore.
Is it a problem that our Splunk telemetry leaves China?
Treat it as a risk to assess with counsel, not a flat yes or no. Splunk's forwarders and HTTP Event Collector collect machine data in China — client IP addresses, user IDs, and personal data that lands in event fields, URLs and request bodies — and send it to an offshore Splunk Cloud region. Under PIPL that is a cross-border transfer requiring notice, separate consent and a transfer mechanism, and for a CIIO or large-volume handler the data must be stored in the mainland. Splunk's Ingest actions can filter and mask some fields on the way in, but masking narrows the exposure rather than removing the border crossing.
Can 21YunBox help make our Splunk setup compliant in China?
Yes. Our China team can map your PIPL cross-border and data-residency exposure for your entity, your data volumes and your users, and stand up the ICP-filed, in-country delivery and storage a compliant China presence needs — in front of the stack you already run, so you keep Splunk for the telemetry that can lawfully leave the mainland. Get in touch to work through your specific case.
