Does Tinybird Work in China? Data Residency, PIPL & Your Event Data
Tinybird runs no region inside mainland China — it stores the events and user data you stream in on AWS and GCP across the US, Europe, Hong Kong and Sydney, all offshore — so the personal information it holds on your Chinese users is a PIPL cross-border transfer with a data-localization question attached. A compliance-first look at where your data is allowed to live.
Does Tinybird work in China?
Yes — Tinybird is reachable and runs fine, but it stores the events and user data you stream into it in an offshore region, and it offers none inside mainland China. The compliance exposure is data residency, not reachability.
Tinybird calls itself "the real-time data platform," says it "runs all services on AWS, Google, and Microsoft data centers," and states that every workspace "belongs to a region" — with published regions in the US, Europe, Hong Kong and Sydney, not one inside the mainland. So the personal information your app streams in from Chinese users — IDs, IP addresses, behavioral events — is held offshore: a cross-border transfer PIPL governs (Articles 38–43), with an in-country storage duty for CIIOs and high-volume handlers (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). ICP filing isn't Tinybird's layer — a data backend serves no public site — so that door sits on the application in front of it. The table below is Tinybird's own wording and the rule each line triggers.
This is a risk map, not a verdict — which duties bind you turn on your entity, your data volumes and whose data it is. Our China team can map your exposure with you →
What Tinybird's own documentation says about China
| Fact | Primary source |
|---|---|
| Tinybird runs on offshore clouds, with no mainland-China region. It "runs all services on AWS, Google, and Microsoft data centers," and each workspace "belongs to a region." Its published regions span the US (Virginia, Oregon), Europe (London, Frankfurt, Ireland), Hong Kong and Sydney on AWS and GCP — and the nearest to the mainland, Hong Kong, is a separate jurisdiction China's cross-border rules still treat as outside it. None is inside mainland China. | Tinybird — Security & API reference (Regions and endpoints), retrieved 2026-10-07 |
| Tinybird stores the data you stream into it — including personal information. It describes itself as "the real-time data platform," built to ingest and query your events, and confirms that "all data volumes, including backups, are encrypted at rest." Those events routinely carry personal data — user IDs, IP addresses, behavioral signals — so the records Tinybird keeps for your Chinese users are personal information under Chinese law, held wherever your workspace's region sits. | Tinybird — Security, retrieved 2026-10-07 |
| Streaming China users' data into an offshore workspace is a cross-border transfer. Because the region you choose is outside the mainland, the personal information Tinybird stores for your Chinese users leaves the country — a cross-border transfer under PIPL requiring notice, separate consent and one transfer mechanism (Articles 38–43). For a critical information infrastructure operator or a high-volume handler, that data must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty no AWS or GCP region Tinybird offers can meet. | PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37); Tinybird regions, retrieved 2026-10-07 |
| ICP filing isn't Tinybird's layer — but data residency is. An ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33 attaches to a public-facing website and its mainland hosting; a data backend queried over an API carries none of its own. So the ICP obligation sits on the application in front of Tinybird, if that app faces China — while Tinybird's own compliance weight lands squarely on where the data lives. | State Council Order No. 292; MIIT Order No. 33 (ICP regime); Tinybird API reference, retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the question about Tinybird is not whether it answers quickly — it is where the data it holds is allowed to live. Tinybird is a real-time data platform built on ClickHouse: you stream events into it and query them back through its API, which means it keeps your application’s records, your Chinese users’ personal information among them. Tinybird answers the residency question in its own documentation — every workspace runs in a region you pick on AWS or GCP, and it operates none inside mainland China. The endpoint is reachable; the exposure is that the personal data it stores, and the ingestion endpoint you stream it through, both sit offshore, where China’s cross-border and data-localization rules reach them.
Tinybird in China at a glance
| What decides it | In Tinybird's own terms |
|---|---|
| Where it runs | Managed workspaces run on AWS and GCP, in regions across the US (Virginia, Oregon), Europe (London, Frankfurt, Ireland), plus Hong Kong and Sydney. “A workspace belongs to a region.” None is inside mainland China; the nearest, Hong Kong, is a separate jurisdiction outside it. |
| Where your data physically sits | Tinybird “runs all services on AWS, Google, and Microsoft data centers,” and “all data volumes, including backups, are encrypted at rest.” Your events live in the offshore region your workspace sits in — Tinybird offers none in the mainland. |
| Your China users' data | The user IDs, IP addresses and behavioral events you stream in are personal information. Stored offshore, they are a cross-border transfer PIPL governs (Articles 38–43), kept out of the country they were collected in. |
| Data localization | A CIIO or high-volume handler must keep China-collected personal data in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). No Tinybird region can satisfy that duty. |
| ICP filing | Not Tinybird's door. A data backend serves no public site, so the ICP filing a mainland audience needs sits on the application in front of your pipeline, not on Tinybird. |
No mainland region, so your data cannot sit in China
Tinybird runs your workspace on Amazon Web Services and Google Cloud, in whichever region you choose. Its published Regions and endpoints list reaches across the US — Virginia and Oregon — through Europe in London, Frankfurt and Ireland, and on into Hong Kong and Sydney, and Tinybird states plainly that “a workspace belongs to a region,” with “the API for each region has a specific API base URL.” Mainland China is not on that list, and the closest entry, Hong Kong, is a separate jurisdiction that China’s own cross-border rules still treat as outside the mainland. On the infrastructure side Tinybird confirms it “runs all services on AWS, Google, and Microsoft data centers,” and that “all data volumes, including backups, are encrypted at rest” — which is exactly the point: whichever region you select, the data is encrypted, durable, and offshore. Because a real-time pipeline binds its ingestion endpoint to that same region, both where the data lands and where you stream it to live outside China. This is the data-residency question in its sharpest form — the platform is not a cache sitting in front of your records, it holds them, and Tinybird has nowhere in the mainland to keep them.
Your China users’ event data is a cross-border transfer
Because that workspace stores personal information collected from people in China — the user IDs, IP addresses and behavioral events a real-time analytics stream is built on — keeping it in an offshore region is a cross-border transfer under the Personal Information Protection Law. The handler here is you, not Tinybird: you have to give notice, obtain separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–43). And if you are a critical information infrastructure operator, or you process personal information above the regulators’ volume thresholds, that data has to be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore AWS or GCP region cannot meet, however well it performs. Tinybird’s SOC 2 Type II attestation and its statement that it “fully complies with GDPR” speak to how it protects data; neither answers where Chinese law says that data must physically sit.
ICP isn’t Tinybird’s door — and keeping that honest matters
It would be easy to staple an ICP-filing warning onto every China page, but it does not belong on Tinybird. An ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33 attaches to a public-facing website and the mainland hosting that serves it — and a data backend queried over an API serves no public site of its own. That obligation therefore lands on the application sitting in front of your Tinybird pipeline, if that application faces a Chinese audience, not on the data layer. Tinybird’s compliance weight is narrower and concentrated in one place: data residency. Keeping the two doors apart is the whole point — it tells you exactly which risk lives on which layer, rather than blurring a storage question into a licensing one.
This is a risk map, not a verdict: whether a localization duty binds you, and which cross-border mechanism fits, depends on your entity, how much personal data you hold, and whose it is — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep Tinybird as your real-time data platform. We add the layer it was never meant to provide: compliant, ICP-filed delivery from inside the mainland for the application in front of your pipeline, together with any in-China storage your data-residency obligations call for — fitted around your existing stack, with no rebuild, no second codebase, and no move off Tinybird. Our China team maps your PIPL cross-border and data-localization exposure against your entity and data volumes, then stands up the in-country delivery and storage a lawful China presence needs, while your events keep streaming into the workspace you already run.
Related reading:
