Does Umbraco Work in China? ICP, Data Residency & an Offshore CMS
Umbraco Cloud hosts every project on Microsoft Azure regions outside mainland China — West Europe, East US, UK South, Australia East — so a China-facing site is served offshore with no ICP-filing path, and your users' data lands abroad under PIPL. Self-hosting shifts the same question onto your own infrastructure. A compliance-first look at the doors.
Does Umbraco work in China?
Reachable, yes — compliant on its own, no. Umbraco Cloud hosts every project on Microsoft Azure regions that sit outside mainland China, so a China-facing site is served offshore: no footing for an ICP filing, and your users' data lands abroad under PIPL. Self-hosting the open-source CMS doesn't dissolve that question — it just moves it onto whatever infrastructure you pick.
In Umbraco's own words, "Up until today, Umbraco Cloud has been exclusively hosted in the West Europe region on Azure" — a data center "located in the Netherlands" — and the regions added since (East US, UK South, Australia East) are each a named Azure location, none in the mainland. Serve China from any of them and your Chinese users' personal information is stored offshore: a cross-border transfer PIPL governs, on a host that cannot carry the ICP filing a public mainland site requires. The table below is Umbraco's own wording and the rule each door triggers.
This is a risk map, not a verdict — which door fits turns on your entity, your data and who your users are. Our China team can map your exposure with you →
What Umbraco's own documentation says about China
| Fact | Primary source |
|---|---|
| Umbraco Cloud runs on Microsoft Azure, and its home region is offshore. In Umbraco's own words, "Up until today, Umbraco Cloud has been exclusively hosted in the West Europe region on Azure" — a data center "located in the Netherlands" — with East US added as the first expansion. Every region Umbraco Cloud offers is a Microsoft Azure location, and none is inside mainland China. (Microsoft does run a separate, walled-off Azure in the mainland through the partner 21Vianet, but that is not a region Umbraco Cloud provisions into — inference.) | Umbraco — "Umbraco Cloud expands with US regional hosting" (umbraco.com), retrieved 2026-10-07 |
| The regions are Azure data centers in Europe, the US, the UK and Australia — a data-residency menu with no China option. Announcing the Australia region, Umbraco says it "allows you to utilize the Australia East Azure data center," joining West Europe, East US and UK South — and frames the whole feature around residency: "Australia has a robust set of data privacy rules and there are sectors and types of data that have hard requirements for data sovereignty." With no mainland-China region on that menu, Chinese users' personal data can't be localized in China on Umbraco Cloud — a cross-border transfer under PIPL (notice, separate consent and a transfer mechanism, Articles 38–43), and for a CIIO or large-volume handler, data that by law must stay in China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). | Umbraco — "Umbraco Cloud expands with regional hosting option in Australia" (umbraco.com), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
| A site served from Umbraco Cloud's offshore regions has nothing to file an ICP against. A public website shown to mainland visitors needs an ICP filing (ICP 备案) bound to a hosting resource physically inside China — the regime under State Council Order No. 292 and MIIT Order No. 33. Umbraco Cloud's regions are all offshore Azure data centers, so there is no in-country resource for the filing to attach to, and no ICP path on the platform itself. | Umbraco Cloud regional hosting (umbraco.com), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
| Self-hosting Umbraco doesn't remove the question — it moves it onto your own infrastructure. Umbraco is an open-source .NET CMS you can run off Umbraco Cloud on servers you control, so the ICP and data-residency outcome is decided by where you host it: a mainland, ICP-filed host can open those doors, while an offshore host inherits the same cross-border and no-ICP exposure as Umbraco Cloud. The CMS is portable; the obligations attach to the hosting location, not the software. | Umbraco (umbraco.com), retrieved 2026-10-07; PIPL Articles 38–43; State Council Order No. 292 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience the decisive question about Umbraco is not how quickly it paints — it is where the site is allowed to be hosted and where your users’ data is allowed to live. Umbraco answers the first in its own documentation: Umbraco Cloud runs on Microsoft Azure, and every region it offers sits outside mainland China. A China-facing Umbraco Cloud site is therefore reachable but wholly offshore — no footing for the ICP filing a public mainland site requires, and every record of personal data you hold for Chinese users becomes a cross-border transfer China’s law governs. Self-hosting the open-source CMS doesn’t dissolve that question; it hands it to whatever infrastructure you choose. Reachability is the delivery half; the licensing and the data residency are the exposure.
Umbraco in China at a glance
| What decides it | In Umbraco's own terms |
|---|---|
| Where it runs | Every Umbraco Cloud project runs on Microsoft Azure. Umbraco: it “has been exclusively hosted in the West Europe region on Azure” (the Netherlands), now joined by East US, UK South and Australia East — each an Azure data center, none inside mainland China. |
| Serving the public | A public site shown to mainland visitors needs an ICP filing tied to a mainland hosting resource. With no in-China region, Umbraco Cloud offers no footing for one. |
| Your data on Umbraco Cloud | Chinese users' personal data lives in an offshore Azure region — a cross-border transfer PIPL governs, plus an in-country storage duty for CIIOs and large-volume handlers that no offshore region can meet. |
| Self-hosted instead | Umbraco is open-source; run it yourself and the ICP and residency outcome follows your host — mainland and ICP-filed, or offshore with the same gaps as the Cloud. |
| Is it reachable? | Generally yes — Azure's global regions aren't wholesale-blocked, so the site loads from offshore. But reachability is the delivery half; it creates neither an ICP filing nor in-country data residency. |
Umbraco Cloud runs on Azure — and none of those regions is in the mainland
Umbraco Cloud is a managed platform on Microsoft Azure. In Umbraco’s own words, “Up until today, Umbraco Cloud has been exclusively hosted in the West Europe region on Azure” — a data center “located in the Netherlands” — and the regions added since are each a named Azure location: East US, UK South, and Australia East, which “allows you to utilize the Australia East Azure data center for hosting your Umbraco projects.” Not one of them is inside mainland China.
Microsoft does operate a separate Azure cloud in the mainland, run by the local partner 21Vianet, but it is a walled-off partition — not one of the regions Umbraco Cloud provisions into. So the practical fact stands: choose any region Umbraco Cloud offers and your project lives offshore.
That geography settles the licensing question before performance is ever measured. A public-facing website delivered to mainland visitors turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically inside the mainland. Umbraco Cloud has none, so there is nothing on it to file against — and “we already run on Umbraco Cloud” is exactly where that reasoning stops.
Your China users’ data stays offshore
Serve China from Umbraco Cloud and your users’ personal information is stored in an Azure region abroad — the Netherlands, the US, the UK or Australia, depending on the one you picked. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, not Umbraco — has to give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–43). If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be kept in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty no offshore Azure region can satisfy.
Umbraco itself treats region choice as a data-residency control. Launching the Australia region it noted that “Australia has a robust set of data privacy rules and there are sectors and types of data that have hard requirements for data sovereignty.” That is the very logic that exposes the mainland-China gap — because there is no China region on the menu to localize Chinese users’ data into.
Self-hosted Umbraco moves the question, it doesn’t answer it
Umbraco is an open-source .NET CMS, so you are free to run it off Umbraco Cloud on infrastructure you control. That changes who decides the compliance outcome, not whether there is one. Put your self-managed Umbraco on a mainland server that carries its own ICP filing and keeps data in-country, and the licensing and residency doors can be opened; leave it on an offshore host and you inherit precisely the cross-border and no-ICP exposure that Umbraco Cloud has. The software is portable; the obligations attach to where the bytes are served and stored, not to the CMS.
This is a risk map, not a verdict: whether you need an ICP filing, in-country storage, or both depends on what you publish, how much personal data you hold, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building in Umbraco — Cloud or self-hosted, the same content model, the same codebase. We add the one piece an offshore CMS platform cannot: compliant, ICP-filed delivery from inside the mainland, set in front of your existing Umbraco origin — no rebuild, no second codebase, and no move off Umbraco. Our China team maps your ICP and data-residency obligations against your entity and your data volumes, then stands up the in-country delivery and storage a lawful China presence needs, while your Umbraco site stays exactly where it already runs.
Related reading:
