Does Silverstripe CMS Work in China? ICP, Self-Hosted PHP & Where You Host It
Silverstripe CMS is open-source PHP software you install on your own server — so whether a Silverstripe site works in mainland China is decided by where you host it (ICP and data residency), not by the CMS sending anything offshore. Installing and updating it reaches Composer, Packagist and GitHub offshore, a lighter reachability point. A compliance-first look at the layers.
Does Silverstripe CMS work in China?
For a public, mainland-China audience the honest answer is "yes — but what decides it is where you host the site, not Silverstripe itself." Silverstripe CMS is open-source, platform-agnostic PHP software you run on your own server, so China's rules respond to your host and your ICP, not to the CMS relaying anything offshore.
In its own words Silverstripe is "released under the Open Source BSD license" and "is based on open standards and technologies (HTML, CSS, PHP, JavaScript) and is platform-agnostic" — it runs wherever you install it. Two doors follow for a public China site, set against Silverstripe's own wording in the table below: the site needs an ICP filing on in-country hosting, which self-hosted software cannot carry; and any mainland personal data your site collects follows that host under PIPL, so an offshore host means an offshore, cross-border flow. A lighter, Silverstripe-specific point rides along — Composer, Packagist and GitHub, which install and update the CMS, sit offshore, so those build-and-update tasks depend on reaching them, though the live pages your host serves do not.
This is a risk picture to take to counsel, not a verdict — what applies turns on where you host, whether you serve the public in China, your entity, and the data your site handles. Our China team can map the Silverstripe hosting + ICP path with you →
What SilverStripe CMS's own documentation says about China
| Fact | Primary source |
|---|---|
| Silverstripe CMS is open-source software you host yourself — not a hosted service with a region of its own. On its own Software page Silverstripe states that "Silverstripe CMS and Silverstripe Framework are released under the Open Source BSD license" and that the software "is based on open standards and technologies (HTML, CSS, PHP, JavaScript) and is platform-agnostic." Platform-agnostic is the crux: it runs wherever you install it, so the China question doesn't resolve inside the CMS — it is decided by the host you run it on. Choosing Silverstripe settles your China standing no more than choosing a programming language would. | Silverstripe — Software (product page), retrieved 2026-10-08 |
| A public mainland-China site needs an ICP filing, and self-hosted software gives it nothing to attach to. Under State Council Order No. 292 (Article 4) and MIIT Order No. 33, an ICP filing (备案) attaches to a hosting resource physically inside mainland China and to a mainland legal entity. Silverstripe is code you run on a host of your choosing; it adds no mainland host and no entity, and a server hosted offshore has neither — so the ICP door is opened at your host, not in the CMS. This is a licensing-and-location boundary, not a defect in Silverstripe. | State Council Order No. 292 (Measures for the Administration of Internet Information Services), Article 4; MIIT Order No. 33 (ICP filing measures) |
| Because Silverstripe keeps your content and data in your own database, data residency follows your host — not the CMS. Silverstripe's own Software page describes it as "architected to safeguard your data" with "support for multi-server cloud configurations" — all on infrastructure you choose. Any personal information your site collects from mainland visitors therefore lives wherever you host it. Host offshore and that is a cross-border transfer under PIPL (Chapter III, Articles 38–43: notice, separate consent, and one permitted transfer mechanism — a CAC security assessment, the CAC standard contract, or certification). A CIIO or large-volume handler also carries an in-country storage duty (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). The CMS itself does not move your visitor data across the border — your hosting choice does. | PIPL Chapter III, Articles 38–43 and Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| Installing and updating Silverstripe reaches offshore developer services — a lighter reachability point, and only for the build-and-update side. Silverstripe's documentation states that "Composer is a package management tool for PHP that lets you install and upgrade Silverstripe CMS and its modules," that "Composer uses Git to check out the code dependencies you need to run your Silverstripe CMS website from the code repositories maintained on GitHub," and that you can find "thousands of Silverstripe CMS modules on Packagist." GitHub and Packagist sit outside the mainland, so if they are slow or unreachable from inside China, installs and updates can stall — but the public pages, served by your own host from your own database, do not depend on them. This is a delivery / operations matter, separate from licensing. | Silverstripe CMS Documentation — Composer, retrieved 2026-10-08 |
Sources verified by the 21YunBox compliance team on 2026-10-08.
For a mainland-China audience, the first thing to settle about Silverstripe CMS is what it is: open-source software you install and run on your own server, not a hosted service someone operates for you. In its own words it is “released under the Open Source BSD license” and “is based on open standards and technologies (HTML, CSS, PHP, JavaScript) and is platform-agnostic” — and that last phrase is the whole point. Platform-agnostic means it runs wherever you put it: a server in Frankfurt or a server in Shanghai alike. So “does Silverstripe work in China” is not really a question about the CMS. It is a question about the host you run it on — which decides whether the site is reachable from the mainland and whether it can carry the ICP filing a public mainland site needs — with a lighter question riding alongside about whether the offshore developer services Silverstripe reaches to install and update itself can be reached from inside China. The software is the portable part; the licensing and the host are the exposure.
Silverstripe CMS in China at a glance
| What decides it | In Silverstripe's own terms |
|---|---|
| What it is | Open-source PHP software “released under the Open Source BSD license,” “platform-agnostic” and self-hosted. It is the CMS; where you run it is a separate decision you make. It runs no mainland-China region of its own, because it is software, not a host. |
| Where it runs | Wherever you install it. Host it offshore and there is no mainland hosting resource for an ICP filing to attach to; host it in-country and there is. Silverstripe adds no region either way. |
| Serving the public | A site served to mainland visitors from inside China needs an ICP filing tied to a mainland host held by a mainland entity. Self-hosted software cannot hold it; the host must. |
| Installing & updating | Composer “lets you install and upgrade Silverstripe CMS and its modules,” checking out code “from the code repositories maintained on GitHub” and pulling modules from Packagist. Those are offshore developer services — slow or unreachable from inside China, builds and updates stall, while the live pages your host serves do not. |
| Your visitors' data | Silverstripe keeps your content and data in your own database on your own host, so where mainland personal data lives follows that host. Offshore host — a cross-border transfer under PIPL; in-country host — it stays on the mainland. The residency question follows your host, not the CMS. |
Silverstripe is self-hosted software — so the ICP question sits at your host
Silverstripe is code you install and run; it is not somewhere your site lives on Silverstripe’s behalf. Its own Software page is explicit that it is “released under the Open Source BSD license” and “platform-agnostic” — you supply the server, and the server is where China’s licensing rules land. A public-facing website delivered to mainland visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically inside the mainland, held by a mainland entity. Silverstripe supplies neither, and a server hosted offshore has neither — so there is simply nothing for the filing to sit on.
That is where “we run Silverstripe” runs out. Being reachable in China and being cleared to operate there are two separate things, and the choice of CMS decides neither — any more than the choice of PHP version would. Re-skinning the templates, swapping modules, or tuning the cache does not create the mainland hosting footing a filing needs; that footing is created at the host.
Data residency follows your host — not the CMS
Because Silverstripe stores your content and data in your own database — its Software page describes it as “architected to safeguard your data” with “support for multi-server cloud configurations,” all on infrastructure you choose — the question of where your users’ data lives is answered by where you host, not by the CMS. Serve the mainland from an offshore server and the personal information your site collects — form submissions, member accounts, a visitor’s IP — sits abroad, which under China’s Personal Information Protection Law is a cross-border transfer: the handler (you, not Silverstripe) gives notice, obtains separate consent, and clears one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. A critical information infrastructure operator or large-volume handler also carries an in-country storage duty (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)).
This is the honest distinction from a hosted platform that relays each request through its own servers: Silverstripe itself does not move your visitor data across the border — your hosting choice does. Which is why the compliant answer is about where your site is served from, not about swapping out the CMS.
The offshore part is the build-and-update path — Composer, Packagist, GitHub
Silverstripe does reach offshore, and it is worth being precise about where. Its documentation states that “Composer is a package management tool for PHP that lets you install and upgrade Silverstripe CMS and its modules,” that “Composer uses Git to check out the code dependencies you need to run your Silverstripe CMS website from the code repositories maintained on GitHub,” and that you can find “thousands of Silverstripe CMS modules on Packagist.” GitHub and Packagist sit outside the mainland. If they are slow or unreachable from inside China, installing the CMS, adding a module, and pulling updates can stall — and any front-end asset you choose to load from an offshore CDN is the same kind of reachability point.
But — and this is the point — the public pages a visitor sees are not waiting on any of it: they are served from your own database by your own host. So reachability of these developer services is an operations question for your build and deployment workflow, distinct from both the licensing door and the live visitor experience. It is a real consideration for keeping a China deployment patched, not a reason the site fails to render.
This is a risk map, not a verdict: whether you need an ICP filing, in-country delivery, in-country storage, or some combination depends on where you host, what you serve, how much personal data you hold, and who your users are — all worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Silverstripe exactly as it is — the same codebase, the same modules, the same database, and the same deploy workflow. What we add is the layer self-hosted software cannot create on its own: compliant, ICP-filed delivery from inside the mainland, set in front of your existing Silverstripe origin so your pages reach mainland readers from a licensed in-country presence — no rebuild, no second codebase, and no move off Silverstripe. Our China team maps your ICP, hosting and data-residency obligations against your entity and the data you handle, then stands up the in-country delivery and storage a lawful China presence needs, while Silverstripe stays your CMS and your server stays where it is.
Related reading:
