Does Heroku work in China?
Not as a compliant mainland presence. Heroku runs no region inside mainland China — its Common Runtime is only the United States and Europe, and Private Spaces only a fixed set of offshore Amazon Web Services regions — so "we're on Heroku" gives a China-facing app no mainland footing.
On its own Regions page Heroku lists two Common Runtime regions, "United States" and "Europe," and states that "Both the Cedar and Fir Private Spaces runtimes share the same regions" — ten locations from Dublin to Tokyo, none inside mainland China. It even cautions that "Specifying an app's region does not guarantee restriction of data residency for Heroku products, services, and add-ons to that region." Serve mainland visitors from those offshore dynos and two things follow: the public site has no mainland hosting resource to carry an ICP filing, and your Chinese users' personal information lives outside the mainland — a cross-border transfer PIPL governs. The table below pairs Heroku's own wording with the rule each one triggers.
This is a risk map, not a verdict — which obligations bite depends on your entity, your data volumes and who your users are. Our China team can map your exposure with you →
What actually decides whether a Heroku app works in mainland China
| Fact | Primary source |
|---|---|
| Heroku runs no region inside mainland China. On its own Regions page Heroku lists only two Common Runtime regions — "United States" and "Europe" — and ten Private Spaces regions: Dublin, Frankfurt, London, Montreal, Mumbai, Oregon, Singapore, Sydney, Tokyo and Virginia. None is in the mainland, and a new app defaults offshore — "Apps in the Common Runtime are created in the us region unless a different region is specified." | Heroku Dev Center — Regions (devcenter.heroku.com), retrieved 2026-10-07 |
| Even Heroku's private runtime sits on offshore AWS regions. Heroku documents that "Both the Cedar and Fir Private Spaces runtimes share the same regions," and a sample query on the same page shows "the Frankfurt region maps to the Amazon Web Services eu-central-1 region." Dynos run on AWS infrastructure in the Americas, Europe and Asia-Pacific — the nearest, Tokyo and Singapore, are still offshore from the mainland. | Heroku Dev Center — Regions (devcenter.heroku.com), retrieved 2026-10-07 |
| A public site on offshore dynos has nothing to ICP-file against. A website served to mainland visitors from inside China needs an ICP filing bound to a hosting resource physically in the mainland (State Council Order No. 292; MIIT Order No. 33). Heroku's dynos sit in the US, Europe and offshore AWS regions, so "we already run on Heroku" leaves no mainland resource for a filing to attach to. | Heroku Dev Center — Regions (devcenter.heroku.com), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
| Heroku won't promise where your data physically rests — and for China users that is a PIPL question. Heroku states "Specifying an app's region does not guarantee restriction of data residency for Heroku products, services, and add-ons to that region," and that "No guarantees are made about the physical location of Heroku's control surface APIs." Personal information of Chinese users handled on offshore Heroku is a cross-border transfer under PIPL (notice, separate consent and a transfer mechanism, Articles 38–43); for a CIIO or large-volume handler it must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). | Heroku Dev Center — Regions (devcenter.heroku.com), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
If you are planning to serve mainland China, the question that matters about Heroku is not how quickly a dyno answers — it is whether you are licensed to operate there at all, and where your users’ data is permitted to live. Heroku, the Salesforce-owned platform-as-a-service, settles the first part in its own documentation: it runs no region inside mainland China. Its Common Runtime is the United States and Europe; its Private Spaces are a fixed set of offshore Amazon Web Services regions. A China-facing Heroku app is therefore served entirely from outside the mainland — which leaves a public site with no footing for the ICP filing China requires, and turns any personal data you hold for Chinese users into a cross-border transfer the law governs. Whether it loads is the smaller half; the permission to operate and the place your data rests are where the risk actually sits.
Heroku in China at a glance
| What decides it | In Heroku's own terms |
|---|---|
| Where it runs | Two Common Runtime regions — “United States” and “Europe” — and ten Private Spaces locations from Dublin to Tokyo. No region sits inside mainland China; the nearest, Tokyo and Singapore, are still offshore. |
| What the dynos run on | Offshore Amazon Web Services infrastructure. Heroku's own docs map the Frankfurt Private Space to “the Amazon Web Services eu-central-1 region,” and neither runtime lists a mainland entry. |
| Serving the public | A site shown to mainland visitors from inside China needs an ICP filing tied to a mainland hosting resource. With no mainland region, Heroku offers no footing of its own to file against. |
| Your data on Heroku | Personal data of Chinese users rests in the US, Europe or an offshore AWS region — a cross-border transfer PIPL governs. Heroku adds that specifying a region “does not guarantee restriction of data residency.” |
| The working design | Keep Heroku as your origin and add an ICP-filed, in-country entry in front of it for mainland visitors — an overlay, not a migration: no rebuild, no second codebase. |
No mainland region means no footing to file against
Heroku is explicit about where it runs. Its Regions page lists two Common Runtime regions — “United States” and “Europe” — and states that “Both the Cedar and Fir Private Spaces runtimes share the same regions,” ten of them: Dublin, Frankfurt, London, Montreal, Mumbai, Oregon, Singapore, Sydney, Tokyo and Virginia. A sample API call on the same page shows those Private Spaces sit on Amazon Web Services — “the Frankfurt region maps to the Amazon Web Services eu-central-1 region.” Not one of these locations is in mainland China, and a new app defaults to the us region unless you say otherwise.
That list settles the licensing question before speed is even on the table. A public-facing website delivered to mainland visitors from inside China turns on an ICP filing (备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically located in the mainland. Heroku has none — its dynos are offshore by design — so there is simply nothing on Heroku to file against. This is where “we already run on Heroku” stops short: being able to reach Chinese users is not the same as being licensed to serve them, and no amount of dyno tuning conjures the mainland footing a filing has to attach to.
Your China users’ data sits outside the mainland
Serve China from Heroku and your users’ personal information lives in the United States, Europe or an offshore AWS region — never in the mainland. China’s Personal Information Protection Law treats that as a cross-border transfer, and the obligation lands on the handler — you, not Heroku — to give notice, secure separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). Heroku is candid that it will not pin this down for you: in its own words, “Specifying an app’s region does not guarantee restriction of data residency for Heroku products, services, and add-ons to that region,” and “No guarantees are made about the physical location of Heroku’s control surface APIs.” And if you are a critical information infrastructure operator or a large-volume handler, personal information gathered in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty no offshore Heroku region can meet.
Fast or slow, the compliance gaps don’t close
The old way to frame Heroku in China was to ask how to make it quick and dependable behind the firewall. That is the wrong gate to fixate on. Even if an app paints promptly for a visitor in Shanghai, the offshore dynos still give a public site no ICP footing, and they still carry Chinese users’ personal data across the border. Those are licensing and data facts, not latency numbers, and they do not improve when the page gets faster. Reachability is worth having — but it is the delivery half of the question, never the half that decides whether you are allowed to operate.
This is a risk map, not a verdict: whether you owe an ICP filing, in-country storage, or both turns on what your app serves, how much personal data it holds, and who uses it — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
Heroku stays your platform: the same git push deploys, the same dynos, the same Salesforce-backed PaaS you build on today. What it cannot hand you is a mainland footing, because it operates no region there. 21YunBox supplies precisely that missing piece — compliant, ICP-filed delivery from inside the mainland, placed in front of your existing Heroku origin, with no rebuild, no second codebase, and no move off Heroku. Our China team works out which obligations land on your entity and your data volumes, carries the ICP filing, and stands up the in-country delivery and storage a lawful China presence requires, while your app keeps running exactly where it does now.
Related reading:
