How to Host an App or Website Inside Mainland China

Hosting inside mainland China can reduce latency and routing variability for Chinese users, but it changes the operating model. You need an eligible service operator, filing, a China cloud account, domestic dependencies and a data-governance plan. This guide is for teams deciding whether that trade is justified.

What you need to know

• Hong Kong is not mainland hosting and does not use the mainland ICP filing process.
• A mainland public website or app backend commonly needs the relevant ICP/APP filing path before service opens.
• Alibaba Cloud, Tencent Cloud and Huawei Cloud have broad mainland offerings; telecom operators provide connectivity and enterprise services.
• China regions of global cloud brands may be legally and technically separate. Azure China, for example, is operated by 21Vianet as a physically separate service.
• Replace blocked or unreliable global dependencies before moving only the server.
• Data residency and cross-border transfer results depend on data, scale, operator and sector—not one universal slogan.

When mainland hosting is worthwhile

Measure from target provinces and carriers. Mainland hosting is most useful when latency-sensitive APIs, large downloads, media, conversion-critical pages or enterprise requirements cannot tolerate offshore routing. A small company testing demand may learn faster from Hong Kong or Singapore, accepting less consistent performance while avoiding premature infrastructure duplication.

Hong Kong is outside the mainland ICP system rather than an “ICP-free mainland region.”

Separate the workloads

Inventory the marketing site, web app, mobile API, authentication, database, object storage, media/transcoding, CDN, notifications, email/SMS, payments, analytics and administration. They need not all move together. A mainland static site can still feel broken if login calls a blocked identity provider; a local API gains little if every image comes from an offshore origin.

Cloud and account choices

Alibaba Cloud, Tencent Cloud and Huawei Cloud provide mainland compute, managed databases, object storage, CDN, security and filing workflows. China Telecom, China Unicom and China Mobile matter for connectivity, IDC and enterprise network services. Product availability differs by region and account.

Foreign cloud providers can operate through Chinese partners. Azure China is transacted and independently operated by 21Vianet and uses separate accounts/endpoints; feature parity is not guaranteed. Verify the operating entity, contract, console, service catalogue, support and data paths for any global-brand service.

Filing and domain work

Choose the real mainland operator and complete domain real-name verification, website ICP filing, APP备案 and public-security filing as applicable. A commercial service or regulated category may need a licence/pre-approval beyond filing. Read ICP Filing for Foreign Developers before provisioning production.

Use the access provider's current province-specific checklist. When changing providers, complete access filing before traffic cutover.

Architecture options

Marketing website

Use a mainland static/object origin and licensed mainland CDN when conversion and search performance justify it. Keep builds reproducible from a global source repository mirror. Remove Google-hosted fonts, analytics and reCAPTCHA.

SaaS product

Operate a separate China environment with controlled configuration and a limited, documented cross-border interface. Keep tenant, identity, billing and observability boundaries explicit. A database stretched synchronously across the border is usually fragile and slow.

Mobile application

Place latency-sensitive APIs, object downloads, domestic push, SMS and payments near users. APP filing links the service to domains and resources. Test manufacturer devices without GMS.

Media-heavy product

Use approved object storage, transcoding and CDN; analyse content licences and moderation before architecture. Egress, storage, transcoding, moderation and CDN bandwidth drive cost.

Demand test

Start in Hong Kong with a small dependency surface, measure real users, and migrate only when performance/business evidence supports a mainland operator.

Data and cross-border transfers

China's Personal Information Protection Law, Data Security Law and Cybersecurity Law affect collection, security, retention and transfers. Sector rules can add localisation. Map controller/processors, data categories, sensitive information, important data, recipients, transfer purpose and retention. Then determine whether certification, standard contract, security assessment or another route applies to the actual case.

Selective data movement is safer than replicating the entire global data lake into China or exporting every production log by default. Minimise fields, tokenize identifiers, aggregate telemetry and enforce regional access. Obtain specialist advice for thresholds and sector rules that can change.

Replace unreliable dependencies

GitHub, npm registries, container registries and package downloads can be slow or intermittent. Mirror approved dependencies, lock versions, scan artefacts and build in-region from a controlled registry. Public packages should pass the same approval and scanning controls as other production dependencies.

Deployment, security and operations

Use infrastructure as code but expect provider-specific modules. Maintain a China artefact registry, secrets manager, certificate renewal, DDoS/WAF controls, vulnerability process and local on-call escalation. Monitor from multiple mainland carriers and from the global side of any cross-border API.

Back up within a second mainland region where business continuity requires it, encrypt backups and test restoration. Cross-border backup is a data transfer, not merely a resilience choice.

Cost categories

Estimate compute, database, object storage, CDN traffic, public bandwidth, load balancers, WAF/DDoS, SMS, monitoring, backups, licences, filing-compatible resource commitments, local support, security testing and engineering duplication. Prices vary by provider, region, contract and promotion; obtain current quotes instead of using a fixed monthly figure.

Launch process

1. Measure offshore performance and define SLOs.
2. Select operator, province, provider and workload boundary.
3. Complete legal/category and data-transfer assessment.
4. Align domain, cloud account and filing records.
5. Build a separate China environment and dependency mirror.
6. Replace blocked integrations and add domestic push/SMS/payment paths.
7. Complete filing and required post-launch registrations.
8. Run carrier, province, device, security and load tests.
9. Migrate a controlled cohort with rollback.
10. Monitor, reconcile data and review requirements continuously.

Frequently asked questions

Is Hong Kong the same as mainland hosting?

No. It has different network routing and is outside the mainland ICP filing system.

Must all China user data stay in China?

There is no single universal rule for every datum and company. Localisation and transfer requirements depend on the facts and sector.

Can I use my global cloud account in a China region?

Often not. China services can have separate accounts, contracts, APIs and product availability.

Does a CDN remove filing requirements?

No. Mainland CDN enablement and origins have their own provider and regulatory prerequisites.

Conclusion

Move to mainland hosting only after proving the performance/business need and selecting a genuine operator. The winning architecture is usually a deliberately bounded China environment, not a blind clone of the global stack.

This article is for general informational purposes and is not legal, tax, accounting, or regulatory advice.

Sources and official documentation

• Tencent Cloud ICP filing starter guide
• Tencent Cloud filing resource requirements
• Huawei Cloud ICP overview
• Azure China operated by 21Vianet
• MIIT mobile-app filing notice