Does Streamlit Community Cloud Work in China? ICP, Data Residency & an Offshore Host
Streamlit Community Cloud runs no region inside mainland China — it serves your app from an offshore *.streamlit.app address on third-party cloud infrastructure — so a China-facing app is reached from offshore with no ICP-filing path, and the personal data it collects lands outside the mainland under PIPL. A compliance-first look at the two doors.
Does Streamlit Community Cloud work in China?
Whether Streamlit Community Cloud works for a mainland-China audience is a licensing and data-residency question first, and a speed question only after that. Community Cloud is Snowflake's free tier for deploying and sharing Streamlit apps — and China's law turns on where it runs them and the domain it serves them from.
By Streamlit's own Trust and security page the service runs your app offshore, in "secure data centers maintained by infrastructure-as-a-service cloud providers," with no mainland-China region named, and its documentation reaches each live app at a your-custom-subdomain.streamlit.app address. So a public app you share with mainland users is served from offshore, with no ICP-filing path on Streamlit itself, and any personal data it collects is a cross-border transfer PIPL governs. The snapshot below maps Streamlit's own footprint to the China rules it triggers, and the compliant, ICP-filed in-country path that closes them.
This is a risk map, not a legal verdict — what you owe turns on what your app serves and the personal data it handles. Our China team can map the ICP and cross-border path with you →
Compliance snapshot
- ✕ Streamlit Community Cloud runs no mainland-China region, so a public app on it has no ICP-filing path
- ! Your app is served offshore from a your-custom-subdomain.streamlit.app address — reached across the border, not hosted in-country
- ! Personal data your Streamlit app collects from Chinese users is processed offshore — a cross-border transfer under PIPL
- ! An app may load for mainland users, but reaching it is delivery — it creates no ICP filing or in-country residency
- ✓ A compliant path exists: ICP-filed in-country delivery in front of your Streamlit app
What Streamlit Community Cloud's own documentation says about China
| Fact | Primary source |
|---|---|
| On Streamlit's own Trust and security page, Streamlit Community Cloud's "physical infrastructure is hosted and managed within secure data centers maintained by infrastructure-as-a-service cloud providers" — and the page names no mainland-China region and publishes no data-residency location. The service runs your app offshore. | Streamlit Docs — Trust and security, retrieved 2026-10-07 |
Every deployed app is served from an offshore Streamlit domain. Streamlit's app-settings documentation points you to your live app "at <your-custom-subdomain>.streamlit.app" — a streamlit.app address Streamlit owns and operates outside the mainland, not a hosting resource you can place inside China. | Streamlit Docs — App settings, retrieved 2026-10-07 |
| Serving a public website to mainland-China visitors from inside the mainland requires an ICP filing (ICP 备案) under the State Council's Order No. 292 and MIIT's Order No. 33, and that filing must attach to a hosting resource physically inside the mainland. Because Streamlit Community Cloud runs no mainland region, a Streamlit-hosted app has nothing on Streamlit to file against. | PRC Regulations on Telecommunications (State Council Order No. 292); Administrative Measures for the Filing of Non-operational Internet Information Services (MIIT Order No. 33) |
| Any personal data your Streamlit app collects from Chinese users — form inputs, uploads, account identifiers — is processed on that offshore infrastructure, so PIPL treats it as a cross-border transfer: the handler — you, the developer, not Streamlit — must give notice, obtain separate consent, and clear one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). | Personal Information Protection Law, Chapter III, Articles 38–43 |
| For a critical information infrastructure operator or large-volume handler, personal information collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). With no mainland-China region, an offshore hosting tier cannot meet that residency duty — holding the data on Chinese soil means running it on infrastructure inside the mainland, where an ICP filing re-enters. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Streamlit Community Cloud is not how fast the app paints — it is where the app is allowed to run and where the data it collects is allowed to live. Community Cloud is Snowflake’s free tier for deploying and sharing Streamlit apps, and it answers both questions by where it hosts them: on offshore cloud infrastructure, with no region inside mainland China, each app reached at a your-custom-subdomain.streamlit.app address. A China-facing Streamlit app is therefore reachable but entirely offshore, which leaves it with no footing for the ICP filing a public mainland site requires, and turns any personal data it collects from Chinese users into a cross-border transfer China’s law governs. The reachability is a delivery detail; the licensing and the data residency are the exposure.
Streamlit Community Cloud in China at a glance
| What decides it | In Streamlit's own terms |
|---|---|
| Where it runs | On offshore third-party cloud infrastructure. Streamlit's Trust and security page places its "physical infrastructure ... within secure data centers maintained by infrastructure-as-a-service cloud providers," and names no mainland-China region. |
| What it serves from | Each deployed app is reached at an offshore your-custom-subdomain.streamlit.app address — a domain Streamlit owns and operates outside the mainland, not a host you can place inside China. |
| Serving the public | A site served to mainland visitors from inside China needs an ICP filing tied to a mainland hosting resource. With no mainland region and only a streamlit.app address, Streamlit offers no ICP-filing path of its own. |
| Your data on Streamlit | Personal data your app collects from Chinese users is processed on that offshore infrastructure — a cross-border transfer PIPL governs, plus a data-localization duty for CIIOs and large-volume handlers that offshore hosting cannot meet. |
| Is it reachable? | Reachability is a delivery question, not a compliance one. Even when a Streamlit app loads for mainland users, it is served from offshore and creates neither an ICP filing nor in-country data residency. |
No mainland region, so no footing for an ICP filing
Streamlit Community Cloud runs your app for you — you connect a repository, Streamlit builds it, and it serves the result. Where it serves from is the whole question for China. On its own Trust and security page Streamlit says its “physical infrastructure is hosted and managed within secure data centers maintained by infrastructure-as-a-service cloud providers,” it publishes no mainland-China region and no data-residency location, and every deployed app is reached at an offshore your-custom-subdomain.streamlit.app address.
That geography settles the licensing question before performance ever enters it. A public-facing website delivered to mainland visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically located in the mainland. A Community Cloud app has none — it lives on offshore infrastructure under a streamlit.app domain — so there is simply nothing on Streamlit to file against. That is where “we already deployed it on Streamlit” runs out: reaching the country is not the same as being cleared to operate there, and nothing in the deploy step creates the mainland footing a filing needs.
Your China users’ data stays offshore
Because Streamlit runs the app on offshore infrastructure, whatever personal data it collects from Chinese users — form inputs, file uploads, login identifiers, anything your Python code stores — is processed outside the mainland. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, the developer, not Streamlit — has to give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore hosting tier cannot satisfy.
Reachable is not the same as compliant
A Streamlit app is not a service China categorically blocks, but reachability is the delivery half of the question, and it is the half that misleads. An app on a streamlit.app subdomain is reached across the border from offshore; whether it paints quickly or stalls on the third-party assets a data app tends to pull in, serving it there gives you neither an ICP filing nor in-country data residency. Those two gaps are compliance facts about where the app is hosted and where its data lands — not latency you can tune away. A faster offshore paint is still an offshore paint.
This is a risk map, not a verdict: whether you need an ICP filing, in-country storage, or both depends on what your app serves, how much personal data it handles, and who its users are — worth settling with counsel before you ship.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building and deploying on Streamlit. We add the one piece a free, offshore hosting tier cannot: compliant, ICP-filed delivery from inside the mainland, set in front of your existing Streamlit app — no rebuild, no second codebase, and no move off Streamlit. Our China team maps your ICP and data-residency obligations against your entity and data volumes, then stands up the in-country delivery and storage a lawful China presence needs, while your app keeps running on Streamlit.
Related reading:
Frequently Asked Questions
Does Streamlit Community Cloud have a data center in mainland China?
No. Streamlit's own Trust and security page describes infrastructure in third-party cloud data centers and names no mainland-China region, and its app-settings docs serve each app from an offshore your-custom-subdomain.streamlit.app address. So a Community Cloud app reaches mainland visitors from outside the country and has no ICP-filing path on Streamlit itself.
Is it against the law to share a China-facing Streamlit app on Community Cloud?
Not inherently. Two separate duties create the exposure: serving a public app to mainland visitors from inside China needs an ICP filing, which attaches to mainland hosting Streamlit does not offer; and processing Chinese users' personal data in an offshore app is a cross-border transfer PIPL governs, with an in-country storage duty for CIIOs and large-volume handlers. Treat it as a risk to size with counsel for your data and role, not a blanket ban.
Can 21YunBox help run a Streamlit app in China?
Yes. Our China team can assess your ICP and data-residency exposure and provide the compliant, ICP-filed in-country delivery an offshore hosting tier cannot — placed in front of the Streamlit app you already run, with no rebuild. Get in touch to work through your specific setup.
