Foreign clients are buying distance from their data

In 2019 a typical security questionnaire from one of our Japanese clients had about forty questions, most of them about passwords, building access and staff confidentiality agreements. In 2025 the longest we received had 262. The new questions are of a different kind. They ask which laws of the People's Republic of China apply to us, whether Chinese authorities could require access to client data held or visible in China, which of our engineers can see production data, where our backups sit, and whether any work involves technology controlled for export by the United States, the European Union or Japan.

Many Chinese IT services firms treat these questionnaires as an obstacle to be negotiated, or as prejudice to be answered with assurances about the integrity of their staff. I understand the instinct. Our engineers in Dalian have handled Japanese banks' and insurers' systems for twenty-five years without a breach I know of, and it is galling to see that record set aside. But I think the instinct is wrong, and that a Chinese firm hoping to grow abroad needs to understand why.

The question behind the questionnaire

A client's lawyers are not asking whether our engineers are honest. They are asking what legal exposure the client takes on by allowing its data or technology to be reached from China, and whether they can defend that exposure to their own regulators, customers and board. Those are questions about law and architecture, and no assurance about people answers them.

The legal picture they are reading is real. Chinese law obliges organisations and citizens to support and cooperate with intelligence and national security work. China's data rules, including the security assessment that the Cyberspace Administration of China has required since 2022 for certain transfers of important data and large volumes of personal information out of the country, mean that data entering China can become harder to move out again. The rules were eased in 2024 for several common situations, but foreign lawyers read the direction as well as the detail. Separately, US export controls on advanced semiconductors and on some software and technology have been tightened repeatedly since 2022, and European clients whose products contain controlled US-origin items must decide for themselves who may access them.

None of this is for a services vendor to argue with. Our task is to make the client's legal problem smaller.

Three kinds of work, three places

Since 2023 Yanxiao has classified client work into three kinds before deciding where it is done.

The first kind needs neither personal data nor controlled technical data. Most development, testing and maintenance falls here, provided the test data is properly masked or synthetic. This work stays in China, where our deepest skills and lowest costs are, and we show clients how the masking is done and audited.

The second kind needs production data: investigating a live incident, reconciling real accounts, supporting users. This work is done from the client's own country, by our onshore staff in Japan or Germany, or inside environments the client controls and logs, where engineers in China work through screens that do not expose the data itself. It costs more, and we price it separately.

The third kind involves technology the client treats as export-controlled. This work is done outside China. We opened our Ho Chi Minh City centre in 2023 at the request of Japanese clients who wanted delivery from a second country, and it now also carries controlled scope for European clients. Our Munich office does the rest.

In 2025, 78 per cent of our revenue was delivered from China, 8 per cent from Vietnam and 14 per cent onshore. Five years earlier more than nine-tenths of it was delivered from China. The work that left did not leave because Chinese engineers are less capable. It left because the client could not defend having it there.

Plain speaking about the law at home

The harder part is candour. When clients ask whether Chinese law could require us to provide access to their data, the honest answer is that we are a Chinese company, subject to Chinese law like any other, and that this is precisely why our delivery is designed so that data the client would not want reachable from China is not reachable from China. An answer implying that we would refuse a lawful demand from our own government is neither credible nor fair to clients, who would rely on it. An answer that explains the architecture is both.

I have seen this approach work. When one of our German clients concluded in 2024 that part of its engineering scope could not be accessed from China, we moved about 150 roles to Vietnam and Munich within nine months. We kept the client, and its revenue with us grew. Two other European clients have since asked for the same arrangement, which they read as evidence that we understand their position.

The approach also has costs, and colleagues in Dalian feel them. Relocated work costs about 22 per cent more to deliver. Some of our engineers read the classification as a judgement on them, and a respected unit head left over it. Our municipal shareholder would prefer the jobs to stay in the city. And some peers argue that by designing around foreign suspicion we concede an argument Chinese firms should be contesting.

I disagree with that last point. We are not conceding that Chinese engineers are untrustworthy. We are accepting that our clients operate under laws we cannot change and must be able to defend their choices. The Indian and Eastern European firms we compete with abroad already answer the same questions about their own jurisdictions, and Chinese firms that want to compete with them must do the same.

For Chinese IT companies going abroad, the lesson I draw is that international growth will come less from lower rates or better engineers than from making each client's legal and compliance position simpler to defend. That means knowing which work can be done where, saying so before the client asks, and building centres outside China not as a hedge but as part of how the service is designed.