Does Statamic Work in China? ICP Filing, Data Residency & Visitor-Data Rules
Statamic is a self-hosted Laravel/PHP CMS you install and run on your own server, so whether it 'works' in mainland China turns on where you host it and where the visitor data lives — not load speed. Because you host it yourself, an in-country, ICP-filed deployment is achievable; left offshore, the site can't be ICP-filed and the visitor data it collects crosses the border under PIPL. A compliance-first look at the ICP, hosting-residency and visitor-data path.
Does Statamic work in China?
Because Statamic is a self-hosted Laravel/PHP CMS you run on your own server, it CAN run in China lawfully — but a China-facing site needs an ICP filing bound to mainland hosting, and the visitor data it collects must stay in-country, which is a PIPL cross-border matter if the CMS is hosted offshore.
Statamic holds your content and the personal information the site gathers from mainland visitors — contact-form submissions, registered-user accounts, comments, and the analytics and cookies behind the page. A public site served to mainland readers is an internet information service, so an ICP filing bound to a mainland hosting resource is the lead door, and you cannot file a site that lives offshore. Because you host Statamic yourself, deploying it on China-resident infrastructure is the residency lever — keeping the content and the visitor data in the mainland. Left on an offshore PaaS or VM, that visitor data becomes a cross-border transfer under PIPL, with notice and a separate consent, plus an in-country storage duty for a CIIO or high-volume handler. The lawful lever is to host the CMS in-country, ICP-file the site, and keep the visitor data home — not to make an offshore site reachable.
This is a risk map, not a verdict — your duties turn on your data volumes and your role, so settle the specifics with counsel. Our China team can map your exposure →
What Statamic's own documentation says about China
| Fact | Primary source |
|---|---|
| Statamic is a self-hosted platform. Its own installation docs state, "Because Statamic is a self-hosted platform, there are many different ways to get started" — you install the Laravel/PHP CMS with Composer and run it on infrastructure you choose, which is exactly what makes an in-country, ICP-filed China deployment achievable. | Statamic Docs — How to install Statamic (retrieved 2026-10-11) |
| You provide the server. Statamic's requirements page says, "To run Statamic you'll need a server meeting the following requirements" (PHP 8.3 or above) and that "Statamic runs on any host that meets the requirements above" — so the hosting location, including inside mainland China, is your decision. Statamic Core is free and Pro is a paid per-site license; the software is proprietary-licensed, not OSI open source. | Statamic Docs — Server requirements (retrieved 2026-10-11) |
| A public China-facing site needs an ICP filing bound to mainland hosting. A site served to the mainland public is an internet information service and carries an ICP filing (备案) duty tied to an in-country hosting resource — a site hosted offshore cannot be filed, which is why a self-hosted, China-resident deployment is the lever. | 21YunBox — How to get an ICP filing for China (retrieved 2026-10-11) |
| Offshore hosting makes the visitor data a cross-border transfer. Collecting mainland visitors' personal information on offshore hosting is a cross-border transfer under PIPL Articles 38–40 (with Articles 13/23 notice-and-consent); a CIIO or high-volume handler must store it in the mainland under Cybersecurity Law Article 39 (formerly Article 37). | 21YunBox — Cross-border data transfers & China's Cybersecurity Law (retrieved 2026-10-11) |
Sources verified by the 21YunBox compliance team on 2026-10-11.
For a site aimed at mainland China, the Statamic question looks at first like a speed question — will the pages load, will the control panel answer from Shanghai. That is not where it is settled. Statamic is a self-hosted CMS: a Laravel/PHP application you install with Composer and run on a server you provide, with its content in flat files or a database. Statamic Core is free and Pro is a paid per-site license; the software is proprietary-licensed, its source on GitHub rather than OSI open source — but the decisive fact for China is that you host it yourself, and there is no first-party managed cloud fixing your region for you. That is what lets the China question answer yes: because you choose where it runs, you can run it in-country, lawfully. What then decides the matter is the ICP filing a public mainland site owes, where the visitor data the site collects comes to rest, the cross-border exposure if that host sits offshore, any in-country storage duty for a CIIO or high-volume handler, and compliant in-country delivery — not latency. Statamic states the hosting model plainly in its own documentation.
Statamic in China at a glance
| What decides it | In Statamic's own terms — and China's law |
|---|---|
| What it holds | Your content (entries in flat files or a database, plus the control panel your editors sign in to) — and the personal information the site gathers from mainland visitors: contact-form submissions, registered-user accounts and profiles, comments, and the analytics and cookies behind the page. |
| Self-hosted — your choice of host (the lever) | Statamic is a self-hosted Laravel/PHP CMS: in its own words, “a self-hosted platform.” You pick the server, so a China-resident deployment is achievable — that openness is the whole lever, and it is what a managed SaaS with “no China region” cannot offer. |
| ICP filing (the lead door) | A public site served to mainland readers is an internet information service, so it needs an ICP filing (备案) bound to a mainland hosting resource. You cannot file a site that is hosted offshore — a self-hosted, in-country Statamic gives you a mainland resource to file against. |
| Visitor-data residency & cross-border | Host offshore and the visitor personal information the site collects rests abroad — a cross-border transfer under PIPL (Articles 38–40, with Articles 13/23 notice-and-consent and cookie consent). For a CIIO or high-volume handler, in-country storage applies (Cybersecurity Law Article 39, formerly Article 37). |
| Reachability isn't the axis | A Statamic site answers from wherever you deploy it, so “it loads from Shanghai” settles nothing. The decision is the ICP filing, the hosting location, and where the visitor data lives — with compliant in-country delivery (the 21YunBox Optimizer) in front of the CMS you already run. |
What it actually holds — your content and your visitors’ data
It is easy to file Statamic under “just the website” and stop there, but a live Statamic install holds two different things China’s law treats differently. The first is your content — entries kept as flat YAML/Markdown files or in a database, your templates and blueprints, and the control panel your editors authenticate against. The second, and the one that moves the China analysis, is the personal information the public site collects from the people who visit it: the submissions behind every contact or lead form, the accounts and profiles of registered users, the comments they leave, and the analytics, cookies and tracking that watch how they browse. Wherever your Statamic instance lives, all of that lives there too.
The structural fact that makes Statamic’s China story a hopeful one is that you decide where it lives. Statamic is self-hosted by design — you install it into your own Laravel application and run it on a server of your choosing, and there is no first-party managed cloud quietly fixing your region offshore. So the location of the content and the visitor data is a choice you control, not a constraint the vendor imposed. That single degree of freedom is what the rest of this page turns on.
The doors: ICP, self-hosting as the residency lever, and visitor data
The lead door is the ICP filing. A site actually served to mainland visitors from inside China is a public internet information service, and that service turns on an ICP filing (ICP 备案) attached to a hosting resource physically in the mainland. This is where self-hosting earns its keep first: an offshore host leaves nothing on Chinese soil to file against, while a Statamic you run on China-resident infrastructure gives you exactly the mainland resource the filing binds to. “We already run the site on Statamic” does not carry across the border on its own — reaching a page from Shanghai is not the same as being cleared to operate a mainland site.
The second door is the visitor data, and here self-hosting in-country is the residency lever. If the CMS sits offshore — on a US/EU PaaS or an offshore VM — the personal information it collects about people in mainland China rests abroad, and under China’s Personal Information Protection Law that is a cross-border transfer. The duty lands on you, the handler, not on Statamic: notice, a separate consent for the overseas transfer distinct from any general sign-up, cookie/tracking consent, and one cleared transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–40, with Articles 13/23). And for a critical information infrastructure operator or a large-volume handler, the Cybersecurity Law’s Article 39 (formerly Article 37 — the data-localization provision was renumbered by the 2025 amendment that took effect on January 1, 2026, with its substance unchanged), together with PIPL Article 40, requires personal information generated in China to be stored in the mainland. Because you host Statamic yourself, the clean answer to all of this is the same: deploy it in-country, and the content and the visitor data stay home by design rather than by exception.
Loading isn’t the question — a compliant, ICP-filed in-country site is
So the productive question is not whether a Statamic page paints quickly from the mainland. It is whether the CMS is hosted in-country, whether the public domain carries its ICP filing, and whether the visitor data the site collects stays on Chinese soil. Get those right and “does it load” takes care of itself; get them wrong and a fast page is still a non-compliant one. The lawful pattern is to host the self-hosted CMS in-country, file the ICP on the mainland hosting resource, and keep the visitor personal information in the mainland on an in-country path — never routed back out through a tunnel. None of this is a verdict that Statamic is “blocked” or “illegal”; it is self-hosted software, and much of the exposure dissolves the moment you choose a China-resident deployment. It is a risk map — whether you owe a separate consent, a transfer mechanism, in-country storage, a data-export assessment, an ICP filing, or some combination turns on your entity, your data volumes, your role as handler and who your visitors are, so settle the specifics with counsel before your China site depends on them.
The lawful path — map, localize, deliver
There is a compliant way to run Statamic for a China-facing audience, and because the CMS is self-hosted, its middle step is unusually clean.
First, map: our China team inventories what the site collects from mainland visitors — form submissions, user accounts, comments, analytics and cookies — and where the CMS is hosted today (often an offshore PaaS or VM), the ICP status of the China-facing domain, and the consent and residency basis you are relying on. The legal conclusions are settled with counsel; we build the technical picture that feeds them.
Then localize: this is where Statamic’s self-hosted design pays off directly. We stand up and integrate a China-resident Statamic so the content, the control panel and — crucially — the visitor personal information stay in the mainland by design, with the Article 13/23 notice-and-consent and cookie consent in place and any CIIO or high-volume storage duty handled. Localize means keeping the data and the site on an in-country path — never a route back out.
Then deliver: the public China-facing site is a mainland internet information service, so it carries an ICP filing duty bound to a mainland hosting resource, plus compliant, in-country delivery. 21YunBox delivers it in-country — the 21YunBox Optimizer — set in front of the Statamic you already run, with no rebuild and no re-platform. The result is a Statamic-backed site that runs legally and compliantly for your users in China. What we never do — and what no one lawfully can — is hand you a route around China’s data-export rules or around any network restriction: 21YunBox never uses or suggests circumvention of any kind.
Related reading:
- How to get an ICP filing for China
- Cross-border data transfers under PIPL
- China’s Personal Information Protection Law (PIPL)
- China’s Cybersecurity Law (data localization, Article 39)
