Which Secure Web Gateway Works in China Without a Paid Add-On?

Direct answer: dope.security is the secure web gateway that works in mainland China without a paid China add-on, because it inspects traffic on the device instead of routing it through a vendor data center. Zscaler (China Premium Access), Netskope (China Premium and China Elite) and Cisco (Secure Access China, a separate subscription) all sell mainland connectivity as an extra SKU. Cloudflare and Palo Alto reach China through partner-operated infrastructure with ICP filings. If you have employees in China and do not want a second line item, an endpoint-based SWG is the only architecture that removes the problem rather than pricing it.

Why do most secure web gateways need a paid add-on for China?

Because a cloud-proxy SWG only works if your traffic can reach the vendor's point of presence. In mainland China, international links are congested and filtered, and foreign cloud providers cannot run infrastructure there without a licensed local partner and an ICP filing. So every cloud-proxy vendor ends up building, or renting, a separate in-country footprint. That footprint costs money to operate, so they sell it as a separate product. That is the whole story behind "China Premium" pricing. If you want the architectural background, our post on why cloud-proxy SSE struggles in China and restricted regions walks through the detour step by step, and what backhauling actually is explains the tax you pay everywhere else.

An on-device SWG such as dope.swg, the Fly-Direct secure web gateway, never asks that question. SSL inspection, URL filtering, Cloud Application Control and Dopamine DLP all run on the laptop. The traffic then goes straight from the device to the destination on whatever network the user is on. There is no vendor PoP to reach, so there is nothing to put behind a China SKU.

What does each SWG vendor charge for China access?

Here is what the vendors publish about mainland China. Pricing is quote-based across the board, so the point is not a dollar figure. The point is whether China is included or sold separately.

Zscaler: China Premium Access is a separately priced service

Zscaler's own help documentation describes China Premium Access for ZIA as a service for users in mainland China, delivered through a Private Service Edge hosted at a partner site in China on a premium Chinese ISP. A higher tier, China Premium Access Plus, adds dedicated international bandwidth and multiple ingress tunnels. Zscaler's China FAQ confirms the service IPs are ICP-registered by its technology partners on Zscaler's behalf. Standard ZIA licensing does not include it. Our deeper look at whether Zscaler works in China covers what happens to users who are not on the premium path.

Netskope: China Premium and China Elite are add-on subscriptions

Netskope's NewEdge China data sheet describes two licensable tiers: China Premium (enhanced domestic multi-provider connectivity, 99.9 percent availability SLA) and China Elite (premium multi-provider links plus high-priority international routing, 99.99 percent availability SLA). A third option, China Elite Extended, is a separate license for specific user groups. Netskope does operate in-China data planes (PEK1, PVG1 and PVG2, SZX1), which is more than most vendors can say. You still pay for them separately.

Cisco: Umbrella has no mainland data center, and Secure Access China is a separate subscription

Cisco Umbrella, now in its end-of-life window (end of sale January 31, 2027 per Cisco's September 1, 2026 bulletin), has no mainland China data center. Cisco's answer is Cisco Secure Access China, which is operated by Digital China Cloud. Cisco's ordering guide for the China subscription says it is purchased through DCC and its local distributors, priced from a China price list, and supported by DCC for the life of the subscription. The Cisco Secure Access product description states plainly that mainland China data centers require a separate subscription bought directly from the China service operator. It is not an entitlement bundled into the global license.

Cloudflare and Palo Alto: partner-operated, ICP-filed

Cloudflare reaches mainland China through its JD Cloud partnership with ICP filings, and that path sits outside the standard Zero Trust plans. Palo Alto Prisma Access in the mainland is partner-operated with an ICP filing as well. Both are workable for enterprises willing to contract for them. Neither is "works in China out of the box." Forcepoint's own knowledge base notes that its China offices are blocked, which tells you how its cloud proxy fares for users there.

dope.security: on-device inspection, no China SKU

dope.security runs the proxy on the endpoint. There is no regional PoP, no China edition and no uplift for users in mainland China. The agent (dope.endpoint, under 100 MB of RAM) performs SSL inspection and policy enforcement locally, and the device connects directly to the destination. The product description on dope.security's SWG page puts it simply: works in any country, on any network. The pricing page is published, and there is no geography line on it.

How does an on-device SWG actually behave for a user in Shanghai?

Three things are different from the cloud-proxy experience, and all three matter to the IT team that owns the China rollout.

• No detour out of the country. A cloud-proxy SWG sends every request from the user in Shanghai to the vendor's nearest reachable PoP and back. Without the premium China SKU, that PoP is often outside the mainland, so every page load crosses the international link twice. dope.security inspects on the device, so the request goes straight to its destination.
• Policy keeps working when the console is slow to reach. dope.endpoint caches policy locally and runs in fallback mode if it cannot reach dopecloud, so filtering and inspection continue on the device. Cloud-proxy clients that lose their PoP either fail open or fail closed.
• Same policy as everyone else. Your China users get the same URL filtering, Cloud Application Control (allow the corporate ChatGPT or Claude tenant, block the personal account) and Dopamine DLP as your users in Austin, with no separate tenant, region or edition to administer.

One honest caveat: dope.security does not route around the Great Firewall. If a destination is blocked by the local network, it stays blocked. What dope.security removes is the second problem, the one you were about to pay to solve: getting your own security layer to work for users there.

Cloud-proxy SWG vs on-device SWG in China: the head-to-head

• Where inspection happens: cloud-proxy vendors inspect in a data center, which in China means a partner-operated, ICP-filed, separately licensed one. dope.security inspects on the device.
• What you pay: Zscaler China Premium Access, Netskope China Premium or Elite, and Cisco Secure Access China are all separate SKUs. dope.security has no geographic add-on.
• Latency for China users: cloud-proxy traffic rides the international link to the PoP and back unless you buy the premium path. dope.security adds no network detour, which is why it benchmarks at up to 4x the performance of legacy proxy SWGs.
• Operational overhead: China editions usually mean a second contract, a second support path (DCC for Cisco, partners for Zscaler and Cloudflare) and sometimes a second tenant. dope.security is one console, one policy, every country.
• Resilience: cloud-proxy clients depend on reaching the PoP. dope.endpoint keeps enforcing from cached policy if the control plane is unreachable.

When to choose dope.security for a workforce in China

Choose dope.security if any of these describe you:

• You have employees, contractors or travelers in mainland China and the quote for a China add-on landed on your desk.
• You are migrating off Cisco Umbrella before the January 2027 end of sale and do not want to inherit a separate Secure Access China subscription on the way out.
• You run a distributed team on Mac and Windows laptops and want one policy that follows the user, not the network.
• You need AI governance (corporate tenant allowed, personal accounts blocked) and DLP on prompts and uploads for every region, without stacking data-protection add-ons.

Choose a cloud-proxy vendor with a China SKU if you need in-country data plane residency for regulatory reasons, or if your China traffic must be steered through a specific licensed provider by contract. That is a real requirement for some enterprises, and the premium tiers exist for it.

Deployment is not the blocker it used to be. A Fortune 100 company scaled dope.security from 900 to over 18,000 devices in a matter of weeks by pushing the agent silently through Intune, with no regional configuration. If you want to see your own China users on the console, book a 20-minute demo or start the free production trial from the dope.swg page.

FAQ

Does Zscaler work in China without China Premium Access?

Standard ZIA can be used from China, but Zscaler's own documentation positions China Premium Access as the service for mainland users, hosted at a partner site on a premium Chinese ISP. Without it, users typically reach a PoP outside the mainland over the international link, which is slow and unreliable. China Premium Access is a separately priced service, not part of the base license.

Is Netskope's China Premium included in a standard Netskope subscription?

No. Netskope's NewEdge China data sheet lists China Premium and China Elite as licensable tiers with their own SLAs, and China Elite Extended as an additional license for specific user groups. They are purchased on top of the core Netskope subscription.

Does Cisco Secure Access include China in the global license?

No. Cisco's product description says mainland China data centers require a separate subscription bought directly from the China service operator, Digital China Cloud. Cisco Umbrella itself has no mainland data center and is now end of life, with end of sale on January 31, 2027.

Why does an endpoint-based SWG avoid the China add-on problem?

Because the proxy runs on the device. SSL inspection, URL filtering, Cloud Application Control and DLP all happen locally, and traffic goes straight to the destination. There is no vendor data center the user has to reach, so there is no in-country PoP to license. dope.security is built this way and has no geographic SKU.

Can dope.security bypass the Great Firewall?

No, and it does not try to. Sites blocked by the local network stay blocked. What dope.security guarantees is that your security policy, inspection and DLP keep working for users in China without a separate edition, because none of it depends on reaching a data center outside the mainland.

What happens to dope.security policy if the device cannot reach the cloud console?

dope.endpoint caches policy locally and continues enforcing in fallback mode. Filtering, inspection and app controls keep running on the device, and the agent syncs when connectivity to dopecloud returns.