Does Sentry Work in China? Error Data, Data Residency & PIPL
Sentry stores your error events, session replays and performance data only in its US (Iowa) or EU (Frankfurt) region — never mainland China — and that choice can't be changed. For China users those events carry personal data across the border, so using Sentry is first a PIPL cross-border-transfer and data-residency question, not a speed one.
Does Sentry work in China?
Whether you can use Sentry in China is first a data-residency and cross-border-data question, not a speed one. Sentry is error and performance monitoring — it ingests the events your apps emit, and those events carry the context that makes a crash useful: IP addresses, user identifiers, request data, even full session replays.
By Sentry's own Data Storage Location documentation, that data is kept only in the region you choose — the United States ("Iowa, USA") or the European Union ("Frankfurt, Germany") — and "Once selected, your data storage location can't be changed." Neither is in mainland China. So events from your China users are posted to an offshore ingest endpoint and stored offshore: a cross-border transfer of personal information that PIPL governs, needing notice, separate consent, a transfer mechanism, and for a CIIO or large-volume handler, in-country storage. The table below is Sentry's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on your data volumes and your role. Our China team can map your Sentry exposure with you →
What Sentry's own documentation says about China
| Fact | Primary source |
|---|---|
| In Sentry's own words: a Sentry organization's data is stored in one of two regions — the United States ("Iowa, USA") or the European Union ("Frankfurt, Germany") — and "Once selected, your data storage location can't be changed." Neither region is in mainland China, and there is no mainland-China data-residency option. | Sentry — Data Storage Location (US or EU), retrieved 2026-10-07 |
The data held in that offshore region is the monitoring payload itself: Sentry lists "Error events, activity, and issue links," transactions, profiles, logs and "Session replays" as stored in your selected location, while a set of account data — "User accounts, notification settings, and 2FA authenticators," access tokens and organization settings — is always kept in the US regardless of the region you pick. Those events routinely carry personal data — IP addresses, user identifiers and request data — which Sentry itself addresses in its Scrubbing Sensitive Data guidance and SDK controls (send_default_pii, before-send hooks). Whatever is not scrubbed before it leaves the device is stored offshore. | Sentry — Data Storage Location; Scrubbing Sensitive Data, retrieved 2026-10-07 |
| Data collected from users in China and stored in Iowa or Frankfurt leaves the country. PIPL governs that cross-border transfer: the personal-information handler (you, Sentry's customer — not Sentry) must give notice, obtain separate consent, and satisfy one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 |
| The exposure scales with volume and role, not merely with using the tool: under the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024 |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside mainland China (PIPL Article 40; CSL Article 37). Sentry publishes no mainland-China region, so the only way to keep your China users' error data on Chinese soil is to run that collection and storage on infrastructure inside the mainland — and standing that up legally is what brings an ICP filing into the picture. | PIPL Article 40; CSL Article 37; Sentry — Data Storage Location (no mainland region), retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Sentry is not how fast the dashboard loads — it is where the data Sentry collects is allowed to live. Sentry is error and performance monitoring: your apps emit events, and those events carry the detail that makes a crash worth reading — IP addresses, user identifiers, request data, and, with Session Replay, a recording of the user’s session. Sentry stores that data only in the region you pick when you create the organization, and it names just two: the United States and the European Union. Neither is in mainland China. So the question is not reachability — it is that every event from a Chinese user is sent offshore to be stored, which China’s law treats as a cross-border transfer of personal information. The delivery is the easy half; the data residency and the cross-border transfer are the exposure.
Sentry in China at a glance
| What decides it | In Sentry's own terms |
|---|---|
| Where your data lives | Two options only — the United States (“Iowa, USA”) or the European Union (“Frankfurt, Germany”). No region is inside mainland China, and “Once selected, your data storage location can't be changed.” |
| What is stored there | Your monitoring payload: “Error events, activity, and issue links,” transactions, profiles, logs, release health and “Session replays” are all held in your selected offshore region. |
| Account data | A set of data is always stored in the US regardless of the region you choose — “User accounts, notification settings, and 2FA authenticators,” access tokens and organization settings. Choosing the EU does not keep everything out of the US. |
| How events reach Sentry | Your SDK posts each captured event outbound to your region's ingest endpoint (on us.sentry.io or de.sentry.io). Error data from China leaves the mainland to be stored. |
| Your China users' data | Events carrying personal data (IP addresses, user context, request data) held offshore are a cross-border transfer PIPL governs; with no mainland region there is no in-country residency option. |
Door one — your error data is stored offshore, and the choice is permanent
Sentry keeps the data it ingests only in the region you select when the organization is created, and its own Data Storage Location page lists exactly two: the United States, stored in “Iowa, USA,” and the European Union, stored in “Frankfurt, Germany.” There is no mainland-China option, and Sentry is blunt that the decision sticks — “Once selected, your data storage location can’t be changed.” Error events, session replays, transactions, profiles and logs all live in that offshore region. Even picking the EU does not pull everything out of the US: a defined set of account data — “User accounts, notification settings, and 2FA authenticators,” access tokens and organization settings — is stored in the US regardless.
That geography answers the data-residency question on its own, no matter how quickly the dashboard paints. For a China audience none of this data sits on the mainland, and there is no Sentry region to place it there. “We already use Sentry” does not carry across the border: using it keeps your China users’ error data in Iowa or Frankfurt, which is precisely the fact China’s cross-border rules respond to.
Door two — those events carry personal data across the border
What makes this a compliance question rather than a performance one is what the events contain. Sentry’s SDKs capture the context that turns a stack trace into a fix — the request, the user, the environment — which routinely includes personal data: IP addresses, user identifiers or emails, request payloads, and, with Session Replay, a reconstruction of what the user did. Sentry addresses this directly in its Scrubbing Sensitive Data guidance and ships controls such as send_default_pii and before-send hooks precisely because that data would otherwise travel with the event. Whatever is not stripped before the event leaves the device is stored in your offshore region.
When those events originate with users in mainland China and come to rest in Iowa or Frankfurt, that is a cross-border transfer of personal information under China’s Personal Information Protection Law. The obligations fall on you, as the personal-information handler, not on Sentry: give notice, obtain separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. How heavy that is scales with volume and role. Under the CAC’s March 2024 cross-border rules, a non-CIIO moving fewer than 100,000 individuals’ non-sensitive personal information in a calendar year is exempt from those mechanisms; a critical information infrastructure operator or large-volume handler, by contrast, must store personal information collected in China inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore-only Sentry region cannot meet.
Reachable, but every event leaves the mainland
Sentry is not a page a visitor waits on; it runs in the background, and the part that matters is outbound. Each captured event is posted from the browser or server to the ingest endpoint for your region — an offshore host on us.sentry.io or de.sentry.io. So the compliance fact does not hinge on how quickly the dashboard answers: by design, the error and performance data of your China users travels out of the mainland to be stored. Reachability of that endpoint is a delivery concern — and a reliability one too, since an event generated while the network itself is failing is the event least likely to arrive — but it sits downstream of the real question, which is where the data is permitted to live. We publish no first-party latency figure for the ingest path, so we make no speed claim here; the compliance picture rests on Sentry’s own documentation and China’s statutes.
Treat this as a risk map, not a ruling: whether you owe notice and separate consent, which transfer mechanism applies, and whether an in-country storage duty attaches all turn on your entity, your data volumes and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Sentry. We add the piece a US- or EU-only monitoring service cannot: compliant, ICP-filed delivery and storage from inside the mainland, placed in front of your existing stack — no rebuild, no second codebase, and no move off Sentry. Our China team maps your PIPL cross-border and data-residency exposure against your entity and data volumes, then stands up the in-country delivery and — where the law requires your China users’ data to stay on the mainland — the in-country storage an offshore region cannot provide, while your application keeps reporting exactly as it does today.
Related reading:
