| Mainland China cloud or dedicated server |
Websites whose primary audience is located in mainland China and requires consistently low network latency. |
A mainland-hosted public website generally requires an ICP filing before normal commercial operation.
Additional obligations may apply depending on content, industry, and services offered.
|
✓ Confirm that the hosting location is physically in mainland China.
✓ Ask who supports the filing process.
✓ Verify whether the account holder, domain, and website information must match the filing record.
|
Often provides lower domestic latency than overseas hosting. Buyers should check bandwidth limits,
traffic billing, backup regions, disaster recovery, and the process for changing the filed website.
|
Best for domestic trafficFiling required |
| Hong Kong or other nearby-region hosting |
International websites that need relatively convenient access from mainland China without using a mainland data center. |
Mainland ICP filing is generally not required when the website is hosted outside mainland China,
but the website remains subject to applicable laws in the jurisdictions where it operates and serves users.
|
✓ Confirm the actual data-center country or region.
✓ Request recent mainland-China connectivity test results.
✓ Check whether cross-border traffic is subject to congestion or route changes.
|
Setup is usually simpler than mainland hosting. Actual latency and packet loss can vary by carrier,
route, time of day, and network conditions; buyers should test from multiple mainland networks.
|
Good for mixed audiencesNo mainland filing |
| Overseas hosting or global cloud region |
International websites, global applications, development environments, and content mainly consumed outside China. |
Mainland filing is generally not applicable when the service is hosted outside mainland China.
Buyers must still meet privacy, consumer-protection, tax, export-control, and sector-specific requirements that apply to their business.
|
✓ Check the provider’s data-processing terms.
✓ Identify the countries where data is stored and backed up.
✓ Confirm support for required security controls and incident response.
|
Provides broader global reach but may deliver less predictable access for mainland users.
A content-delivery strategy or regional architecture may be needed for China-facing traffic.
|
Best for global usersChina access must be tested |
| Content Delivery Network (CDN) |
Static files, images, video, software downloads, and web assets served to users in multiple locations. |
CDN use does not automatically remove filing or content obligations. If delivery uses mainland nodes,
the buyer should confirm the provider’s eligibility, filing support, and content-management requirements.
|
✓ Check node locations and mainland coverage.
✓ Verify HTTPS, cache purge, origin protection, and access-control features.
✓ Confirm whether dynamic requests are accelerated or only static content.
|
Can reduce load on the origin server and improve asset delivery. Cache rules must be configured carefully
so that private, personalized, or rapidly changing content is not unintentionally cached.
|
Useful with any hosting typeImproves scalability |
| ICP filing and website registration |
Websites hosted on mainland China infrastructure, including many commercial, informational, and application websites. |
The buyer should determine whether an ICP filing is required and whether the website is commercial or non-commercial.
A filing is not a substitute for sector licenses or other regulatory approvals.
|
✓ Confirm the filing category and responsible entity.
✓ Keep domain, entity, contact, and website information accurate.
! Ask whether changing the domain, entity, or website purpose requires an update.
|
Launch schedules may depend on document preparation and review. The buyer should obtain written confirmation
of what the host will submit and which steps remain the buyer’s responsibility.
|
Essential for mainland hosting |
| Public security filing |
Websites operated within mainland China that fall within the applicable public-security filing requirements. |
Depending on the website and its operation, an additional public-security filing may be required after the relevant ICP process.
The exact obligation should be confirmed with the competent authority or qualified local adviser.
|
✓ Ask for the applicable deadline and filing sequence.
✓ Confirm whether the operator must display or retain filing information.
✓ Maintain accurate operator and contact details.
|
Non-compliance can create operational and enforcement risk. Build time into the launch plan for documentation,
record retention, and responses to official requests.
|
Check applicabilityCompliance-sensitive |
| Data privacy and personal-information handling |
Websites collecting names, phone numbers, account details, payment information, location data, or other user information. |
The operator should identify the applicable personal-information, cybersecurity, consumer-protection,
and cross-border data-transfer requirements before collecting or exporting user data.
|
✓ Map the data collected and its purpose.
✓ Publish an appropriate privacy notice and consent mechanism where required.
✓ Confirm retention, deletion, access, and breach-response procedures.
|
Hosting contracts should identify the provider’s role, security responsibilities, subprocessors,
access controls, audit support, and data-location options.
|
Required for user-data sites |
| Security controls |
Business websites, online stores, customer portals, APIs, and applications that must protect accounts and transactions. |
Buyers should assess applicable cybersecurity, sector, payment, and contractual requirements.
The hosting service should support a documented security-management process.
|
✓ Require TLS certificates and modern encryption support.
✓ Check firewall, DDoS mitigation, malware monitoring, and vulnerability handling.
✓ Confirm multi-factor authentication and role-based administration.
|
Security features may be optional add-ons. Review service limits, alerting, log retention,
patch responsibilities, and the provider’s incident-notification timeline.
|
Essential for commercial sites |
| Backup and disaster recovery |
Websites that cannot tolerate data loss, long outages, or accidental deletion. |
The buyer should define its own recovery obligations and contractual requirements, including retention
and incident records where applicable.
|
✓ Confirm backup frequency, retention period, and backup location.
✓ Ask whether backups are isolated or immutable.
✓ Request recovery-time and recovery-point targets in writing.
|
A backup is not a disaster-recovery plan unless restoration is tested. Ask for restoration testing,
failover design, status monitoring, and the cost of emergency recovery.
|
Recommended for all business sites |
| Technical support and service-level terms |
Buyers that need predictable uptime, quick incident response, or assistance with migration and compliance tasks. |
Service-level commitments should be documented in the contract. Marketing claims should not be treated as
a guaranteed service level unless remedies and measurement methods are clearly stated.
|
✓ Check support hours, languages, escalation paths, and ticket response targets.
✓ Review uptime measurement, exclusions, credits, and maintenance notices.
✓ Confirm account termination and data-export procedures.
|
A low introductory price may exclude backups, security services, traffic, IP addresses, migration,
premium support, or compliance assistance. Compare the full monthly and annual cost.
|
Important for production use |
| Scalability and architecture |
Growing stores, media sites, SaaS products, APIs, and campaigns with variable traffic. |
The buyer should ensure that expansion, data processing, and third-party integrations remain compliant
as the system grows or moves between regions.
|
✓ Check upgrade paths for CPU, memory, storage, bandwidth, and managed databases.
✓ Confirm load balancing, auto-scaling, container, and API support where needed.
✓ Verify that migration between regions is technically and contractually possible.
|
Separate application, database, storage, and delivery layers where practical. Test peak traffic,
deployment rollback, monitoring, and database recovery before launch.
|
Best for long-term projects |
