Does Veracode Work in China? Data Residency, ICP & Cross-Border Rules
Veracode is cloud-only app-security (SAST/DAST/SCA): to scan an app you upload its code and binaries to the Veracode Platform, hosted only in US, European and US-federal regions — none in mainland China. A compliance-first look at where your uploaded code may lawfully rest under PIPL and China's data-localization law.
Does Veracode work in China?
Whether you can use Veracode in China is a data-residency question about your own source code, not a speed one. Veracode scans fine from inside the mainland — the risk is legal, and it is unusually direct for a security tool: to test your software, Veracode has you upload it.
By Veracode's own documentation, "You upload a packaged artifact of your application to the Veracode Platform, we prescan or scan your code" — and its platform runs only in US, European and US-federal regions, with no mainland-China region and no self-hosted option. So the code and binaries you send from China are analyzed and come to rest offshore: your proprietary IP (which compiled artifacts routinely carry as embedded secrets), and any personal information in test data or logs, cross the border. PIPL governs that transfer, and for a CIIO or high-volume handler, in-country storage (Article 39, formerly Article 37) is owed. The irony is exact: the tool bought to protect your application is itself the channel that carries it out of China.
This is a risk picture, not a verdict — your obligations turn on your entity, your data volumes and whose personal information your code carries. Our China team can map your Veracode exposure with you →
What Veracode's own documentation says about China
| Fact | Primary source |
|---|---|
| In Veracode's own words: "You upload a packaged artifact of your application to the Veracode Platform, we prescan or scan your code, and generate scan results." Static, dynamic and software-composition analysis all run after your code and binaries are uploaded to Veracode's hosted platform — the artifact is your proprietary source, and compiled binaries routinely embed secrets such as keys and connection strings. | Veracode Docs — Veracode Upload and Scan, retrieved 2026-10-14 |
| Veracode's own API documentation enumerates its platform regions as the Commercial Region (analysiscenter.veracode.com), the European Region (.eu) and the United States Federal Region (.us). None is in mainland China, and Veracode offers no self-hosted scanner that would keep the uploaded code in-country — so code sent from China is analyzed and stored offshore. | Veracode Docs — Region Domains for Veracode APIs, retrieved 2026-10-14 |
| Uploading code and binaries from China to Veracode's offshore platform is a cross-border transfer the PIPL governs whenever that code carries personal information — and it often does, through test data, logs, configuration and embedded identifiers. The personal-information handler on the hook is you, the Veracode customer, not Veracode: PIPL requires notice, separate consent, and one transfer mechanism (Articles 38–40), with Article 28 setting a higher bar where the data is sensitive. | PIPL (Personal Information Protection Law), Articles 28 and 38–40 |
| For a critical information infrastructure operator or a high-volume handler, personal information collected in the mainland must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) — the 2025 amendment in force January 1, 2026 renumbered the data-localization article, substance unchanged). A cloud-only scanner with no China region and no self-host cannot meet that duty: the uploaded code is, by definition, in the wrong country. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-14.
For a team shipping software to mainland China, the question about Veracode was never whether the scanner reaches the service or whether a build from Shanghai can upload — it can, and reachability is the delivery half, not the question. The real question is a residency one, and it is unusually pointed for an application-security tool: to test your software, Veracode has you hand over the software. Static analysis, dynamic analysis and software-composition analysis all run after you upload a packaged artifact of your application to the Veracode Platform, Veracode’s hosted service, where it is scanned. That artifact is your proprietary code — a commercial secret — and compiled binaries and bytecode routinely carry embedded secrets such as hardcoded keys, tokens and connection strings. With the Veracode Platform offered only in US, European and US-federal regions, with no mainland-China region and no self-hosted scanner to run in-country, the code you send from China comes to rest and is analyzed offshore. So the tool you bought to secure your application is itself the cross-border channel your source takes out of the country.
Veracode in China at a glance
| What decides it | In Veracode's own terms — and China's law |
|---|---|
| Where your code is scanned and rests | Veracode is cloud-only: you upload a packaged artifact of your application to the Veracode Platform and it is scanned there. Its own API documentation enumerates the platform's regions — the Commercial Region (US), the European Region and the United States Federal Region — and none sits in mainland China. There is no self-hosted Veracode scanner you can stand up in-country, so the uploaded code is analyzed and held on one of those offshore regions. |
| What it ingests, and why residency bites | An application-security platform sees the whole of what it tests: your source, your compiled binaries and your third-party dependencies. That is proprietary IP and a commercial secret, and binaries routinely embed secrets — keys, tokens, connection strings. It also commonly carries the personal information of people in China through test data, logs, configuration and embedded identifiers, including Article 28 sensitive fields. The upload is therefore both an IP export and, often, a personal-information transfer under PIPL. |
| Your mainland code and data | Code and binaries uploaded from China and scanned offshore are a cross-border transfer PIPL governs: notice, a separate consent, and one transfer mechanism (PIPL Articles 38–40), with Article 28 raising the bar where the personal information is sensitive. The handler on the hook is you, the operator — not Veracode. |
| In-country storage duty | A critical information infrastructure operator or high-volume handler owes an in-country storage duty an offshore, cloud-only scanner cannot meet — mainland personal information and important data must stay in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged. |
| Is it reachable? | Treat reachability as the delivery half, not the question — builds upload to the platform fine. Because Veracode is cloud-only with no self-hosted scanner, the lawful lever is to run the code-scanning data layer in-country on a licensed in-country or sovereign equivalent, and any China-facing surface in front of it — the admin console, the reporting portal your users hit — needs an ICP filing tied to a mainland hosting resource (State Council Order No. 292; MIIT Order No. 33). |
Where your code actually gets analyzed
Veracode does not run on infrastructure you control; it runs as a hosted platform you send your application to. Its own Upload and Scan documentation is plain about the flow: “You upload a packaged artifact of your application to the Veracode Platform, we prescan or scan your code, and generate scan results.” The companion region documentation then fixes where that platform lives — it enumerates the Commercial Region, the European Region and the United States Federal Region domains, and there is no mainland-China region to select and no self-hosted scanner to deploy in-country. Point a China build pipeline at Veracode and the artifact lands on one of those offshore regions, where it is scanned and its results are stored.
What crosses the border, then, is not telemetry about your code — it is the code. Under the Personal Information Protection Law, moving any China personal information carried in that artifact — test fixtures, logs, configuration, embedded identifiers — out of the country is a cross-border transfer, and the handler responsible is you. And where an export is permitted at all, crossing a volume or sensitivity threshold can trigger a CAC-led security assessment before any of it lawfully leaves.
What it ingests is your IP — and the irony is exact
Veracode earns this scrutiny because of what an application-security platform concentrates. Most tools touch one slice of your data; this one ingests the thing itself — your source, your compiled binaries, your dependency tree — and the secrets those binaries carry. That is the most sensitive technical asset an engineering organization owns, and routinely it is wrapped around the personal information of people in China: real records in test data, identifiers in logs, Article 28 sensitive fields where health, financial or government-ID data appear. The moment that artifact is uploaded and scanned on an offshore region, both your IP and that personal information have left the mainland.
The irony is the whole point for a security buyer: the platform you deployed to protect your application is itself the offshore path your application takes. For a critical information infrastructure operator, and for a handler whose volumes cross the regulators’ thresholds, personal information and important data collected in the mainland must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). A cloud-only scanner with no China region structurally cannot satisfy that duty — the code is, by definition, in the wrong country.
Why a reachability check misses this
Asking “can a Shanghai runner reach api.veracode.com and upload?” answers the wrong question. The upload succeeding is precisely the problem, not the reassurance: a clean, fast upload is your source code and any embedded personal information leaving China on a lawful-transfer analysis you may not have run. Reachability tells you the delivery path works; it tells you nothing about where the artifact is allowed to come to rest, on what legal basis, or whether a separate consent and a transfer mechanism are in place. The compliance question lives entirely on the residency axis, and a latency chart cannot see it.
The lawful path — map, localize, deliver
You do not have to drop Veracode to run application security lawfully for mainland China. 21YunBox is a compliant overlay, not a migration — and, for a platform you already run, a partner that sits alongside your stack, not a competitor to it. There are three moves, and they fit together.
Map. Our China compliance team reads your PIPL cross-border, data-residency and data-localization (CII) obligations against your actual entity, your scan volumes, and whose personal information your code and test data carry — so the exposure is written down before anything is uploaded.
Localize. Because the risk is where the code and artifacts rest, and because Veracode is cloud-only with no self-hosted scanner, the in-country lever is not “run the vendor’s binary locally.” It is to run the code-scanning data layer in-country another way — a lawful in-country or licensed sovereign-cloud equivalent that keeps the sensitive source and artifacts on mainland soil — while only a minimized, consented, lawfully transferable subset ever crosses the border. Localize means a lawful in-country deployment of the security-testing layer, never a mainland connector pointed back at the offshore platform.
Deliver. For any China-facing surface in front of the platform — the admin console, the reporting portal, the findings dashboard your mainland users hit — the 21YunBox Optimizer provides ICP-filed, in-country delivery, in front of the stack you already run. No rebuild, no second codebase. 21YunBox never uses or suggests circumvention of any kind; the entire point is a lawful, filed, in-country path.
The goal is plain: your application security runs legally and compliantly for your users in China.
Related reading:
- How to get an ICP filing for China
- Cross-border data transfers under PIPL
- China’s Personal Information Protection Law
- China’s Cybersecurity Law and data localization
