Does ThoughtSpot Work in China? Data Residency, ICP & Cross-Border Rules
ThoughtSpot is a search- and AI-driven analytics platform that indexes your data, concentrating China customer and user personal information. ThoughtSpot Cloud (managed SaaS) runs on AWS and Google Cloud with no mainland-China region — so an instance rests offshore, a PIPL cross-border and data-residency question.
Does ThoughtSpot work in China?
Whether you can use ThoughtSpot in China is a data-residency question, not a speed one. ThoughtSpot is a search- and AI-driven analytics platform: it indexes the data you point it at so people can ask questions in plain language — which makes a deployment one of the largest single concentrations of your China customer, user and employee personal information.
ThoughtSpot Cloud, the managed SaaS edition, runs on AWS and Google Cloud, and by ThoughtSpot's own documentation "ThoughtSpot Cloud on AWS is available in the following regions" — a list whose nearest Asia-Pacific entries are Singapore, Tokyo and Sydney, with no region inside mainland China. So a managed instance, and the search index, saved answers and scheduled extracts it builds, come to rest offshore: a cross-border transfer of personal information that PIPL governs, with an in-country storage duty for a CIIO or high-volume handler. The lever is that ThoughtSpot also ships a self-managed Software edition you can run on infrastructure inside China.
This is a risk picture, not a verdict — your duties turn on your data volumes and your role. Our China team can map your ThoughtSpot data exposure with you →
What ThoughtSpot's own documentation says about China
| Fact | Primary source |
|---|---|
| In ThoughtSpot's own words: "ThoughtSpot Cloud on AWS is available in the following regions" and "ThoughtSpot Cloud on GCP is available in the following regions" — the lists span the US, Canada, Ireland, Frankfurt, London, the United Arab Emirates, Singapore, Japan (Tokyo) and Sydney. None is in mainland China; the nearest are Singapore, Tokyo and Sydney. A managed instance, and the search index, saved answers and extracts it builds, therefore rest offshore. | ThoughtSpot Cloud documentation — ThoughtSpot Cloud requirements and support, retrieved 2026-10-14 |
| ThoughtSpot also ships a self-managed Software edition. Its own deployment guide states "You can install ThoughtSpot Software on a cloud provider or VMware", with documented environments including AWS EC2, Microsoft Azure, Google Cloud Platform, VMware and your own operating system. Because you control where those nodes run, the Software edition can be deployed on infrastructure inside mainland China, keeping the indexed personal information on Chinese soil. | ThoughtSpot Software documentation — Deployment, retrieved 2026-10-14 |
| Holding the personal information of people in China in an offshore ThoughtSpot Cloud instance is a cross-border transfer. PIPL Articles 38–40 require the handler (you, the customer — not ThoughtSpot) to give notice, obtain separate consent, and satisfy one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. | Personal Information Protection Law, Chapter III (Articles 38–40) |
| A critical-information-infrastructure operator or high-volume handler must keep China personal information on the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) — the 2025 amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged). Because search analytics concentrates data, one deployment can itself cross the large-volume threshold; an offshore managed instance cannot meet the duty. | Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40 |
Sources verified by the 21YunBox compliance team on 2026-10-14.
For a team serving mainland China, the deciding question about ThoughtSpot is not whether a search bar answers or whether it can reach your warehouse — both are routine. It is where the data ThoughtSpot works with is allowed to come to rest. ThoughtSpot is a search- and AI-driven analytics platform: you point it at your sources, it builds a searchable model so people can ask questions in plain language and read the answers back as saved answers, Liveboards and scheduled deliveries. To do that it concentrates data — customer records, user accounts, transactions, employee data — into one indexed, in-memory analytics layer, and that content is, overwhelmingly, personal information. The flagship, ThoughtSpot Cloud, is the managed SaaS edition that ThoughtSpot runs on AWS and Google Cloud, and neither provider’s region list for the service includes mainland China. So a managed instance, and the search index, caches and result sets it holds, come to rest offshore. The separate, self-managed ThoughtSpot Software edition does run on infrastructure you control — the in-country lever we return to below.
Here is the half a reachability check cannot see: a search-and-AI analytics platform is a concentrator. It does not merely display a report — it pulls from every source system into one modeling and indexing layer and keeps the extracts, in-memory models and saved outputs there. Where those copies physically live, and on what legal basis the personal information inside them left China, is the question a latency test never asks. That is the question this page answers.
ThoughtSpot in China at a glance
| What decides it | In ThoughtSpot's own terms — and China's law |
|---|---|
| Where the data physically rests (the region reality) | ThoughtSpot Cloud, the managed edition, runs on AWS and Google Cloud, and ThoughtSpot's own region list has no mainland-China region. The nearest Asia-Pacific entries are Singapore, Tokyo and Sydney, all outside the mainland — so a managed instance and its search index, caches and result sets rest offshore. |
| What ThoughtSpot holds, and why it is personal information | ThoughtSpot indexes data pulled from across your business — customer records, user accounts, transactions, employee data — into a searchable, in-memory model. The index, saved answers, Liveboards and scheduled-delivery extracts it builds are personal information under PIPL, some of it sensitive. Where they rest is a legal question, not a performance one. |
| Your China users' records when the instance is offshore | Hold the personal information of people in China in an offshore ThoughtSpot Cloud instance and you are making a cross-border transfer under PIPL (Articles 38–40): notice, separate consent, and one transfer mechanism — a CAC security assessment, the standard contract, or certification. |
| The in-country storage duty (CIIO / high-volume handler) | A critical-information-infrastructure operator or high-volume handler must keep China personal information on the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) — the 2025 amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged). Because search analytics concentrates data, one deployment can itself cross the large-volume threshold; an offshore managed instance structurally cannot meet the duty. |
| Reachability is not the axis (and the China-facing surface) | Whether a Liveboard loads from China is a delivery matter, not the legal test; data-at-rest residency is. The lawful levers are to run analytics in-country — a self-managed ThoughtSpot Software deployment on mainland infrastructure — and to put any China-facing reporting surface on ICP-filed delivery. |
Where the data actually rests
ThoughtSpot comes in two shapes, and they answer the residency question differently. The flagship, ThoughtSpot Cloud, is the fully managed service: ThoughtSpot runs it on AWS and Google Cloud, and you pick the region from ThoughtSpot’s list. That list has no mainland-China region. By ThoughtSpot’s own requirements documentation, “ThoughtSpot Cloud on AWS is available in the following regions” — the US, Canada, Ireland, Frankfurt, London, the United Arab Emirates, Singapore, Japan and Sydney — and the GCP list is similar; the nearest to the mainland are Singapore, Tokyo and Sydney, all outside it. There is no China-region option to select, so a managed instance, by construction, sits offshore.
ThoughtSpot can query a cloud warehouse live rather than copying it wholesale, and that genuinely limits how much raw data lands in the platform. But it does not move the residency question off the table. The instance still holds its search index, the in-memory models it builds, query caches, your saved answers and Liveboards, the result sets of scheduled deliveries it emails or writes out, and your user accounts — all in its offshore region. And the natural-language search layer that defines the product works by indexing the data you expose to it, so result sets that contain personal information come to rest somewhere: in the managed instance’s offshore region, or in whatever warehouse you point it at. Either way, where those copies live is the legal question.
What it holds is personal information
A search-and-AI analytics platform is a concentrator. It pulls from every source system — your warehouse, your transactional databases, your event streams — into one indexing and modeling layer, then builds extracts, in-memory models, a search index and scheduled outputs on top. That makes a ThoughtSpot deployment one of the largest single concentrations of personal information a company holds: customer records, user accounts, transactions, support history, employee data. Most of it is personal information under PIPL, and some — contact, financial and identity data — is sensitive personal information that draws heightened duties.
That is why residency, not reachability, is the test. When the personal information of people in China rests in an offshore ThoughtSpot Cloud instance — or in an offshore warehouse it indexes from — you are making a cross-border transfer, and PIPL Articles 38–40 govern it: notice, separate consent, and one lawful transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. The security-assessment measures set when that assessment is mandatory rather than optional.
On top of the transfer rules sits a harder duty. A critical-information-infrastructure operator or a high-volume handler must store China personal information inside the mainland — PIPL Article 40 and the data-localization rule in Cybersecurity Law Article 39 (formerly Article 37). Because search analytics concentrates data, a single ThoughtSpot deployment can itself tip a handler over the large-volume threshold that triggers that duty. An offshore managed instance cannot satisfy it, because the data is, by definition, not in the country.
Running it on a no-China-region managed service doesn’t meet the residency duty — and what does
The fix is not to make an offshore ThoughtSpot endpoint reachable from China. Reachability was never the problem; residency is. If your obligations require China personal information to stay on the mainland, the lawful lever is to run the analytics layer in-country.
Here the two ThoughtSpot products diverge. ThoughtSpot Cloud offers no mainland-China region and no customer-hosting — so for Cloud the in-country route means standing up a lawful in-country equivalent. ThoughtSpot Software, by contrast, is the self-managed edition: software you operate on infrastructure you control. ThoughtSpot’s own deployment guide states, “You can install ThoughtSpot Software on a cloud provider or VMware,” with documented environments including AWS EC2, Microsoft Azure, Google Cloud Platform, VMware and your own operating system. Because you choose where those nodes run, the Software edition can be deployed on mainland-China infrastructure, so the index and result layer stays in-country, with the sources it reads from in-country too. (ThoughtSpot has stopped selling and renewing hardware appliances, so plan the Software route on a cloud or virtualization platform you control rather than on an appliance.) The self-managed edition carries its own operational burden versus the managed service — you own the hardware, OS and upgrades — so weigh that, but the point stands: the engine runs where you deploy it, and nothing here is blocked.
Either way this is not a re-platforming project. You keep the stack you already run and place a compliant, in-country analytics layer where the data must live, then put the China-facing reporting surfaces — the Liveboards, embedded search and reporting portals your mainland users open — on ICP-filed, in-country delivery in front of it. Localize means an in-country deployment, not a route back to an offshore endpoint.
This page maps exposure; it is not a legal ruling. Your actual duties turn on your entity, how you classify the data, your transfer volumes and whether you are a critical-information-infrastructure operator — so settle those specifics with qualified China counsel before you rely on any single path.
The lawful path — map, localize, deliver
21YunBox is a compliant overlay, not a migration — and a partner to your cloud providers and your analytics team, not a competitor to them.
- Map. We read the PIPL cross-border, data-residency, data-localization (CII) and ICP obligations against your entity, your data volumes and whose personal information actually flows into ThoughtSpot — so you know which duties bite before you move anything.
- Localize. We run the analytics layer in-country so the personal information stays on mainland soil — a self-managed ThoughtSpot Software deployment on mainland infrastructure where that fits, or a licensed in-country equivalent, with the connected sources in-country — and keep consented, in-country storage for what must stay. For ThoughtSpot Cloud, which has no China region, localize means standing up a lawful in-country equivalent, not a route back to the offshore service.
- Deliver. Any China-facing surface in front of the analytics layer — the Liveboards, the embedded search, the admin and reporting portals your mainland users hit — runs over ICP-filed, in-country delivery (the 21YunBox Optimizer), in front of the stack you already run. No rebuild, no second codebase.
The result is an analytics layer that runs legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind.
Related reading
- Cross-border data transfers under PIPL
- China’s Personal Information Protection Law
- China’s Cybersecurity Law and data localization
- China’s data-export security assessment measures
- How to get an ICP license for a website in China
