Documents, photos, and videos show TikTok's US datacenters have faced security failures and use servers made by Inspur, which the US sanctioned in March 2023
Emily Baker-White / Forbes :
Context & Ripple Effects
TikTok has spent months selling Washington on Project Texas, its plan to keep operating in the US by moving user data into a domestic subsidiary on Oracle Cloud. The pitch was already strained by its own admission that China-based employees who clear internal protocols can access certain US-user information.
This reporting cuts at the plan's foundation rather than its edges: Forbes' documents, photos, and videos show the US datacenters themselves have had security failures and run on servers from Inspur, which the US sanctioned a month earlier. Baker-White's subsequent reporting found creator financial data stored in China and Project Texas staff routed around official channels, making this the first crack in an infrastructure story.
First-order effects
- TikTok must now explain to regulators vetting Project Texas why its flagship US facilities use hardware from a company the Commerce Department sanctioned weeks earlier — a direct contradiction of the localization narrative it is pitching to lawmakers.
- The documented physical and procedural security failures give Oracle and any other US partners a compliance problem: their cloud is being marketed as the trust layer for a facility whose operations don't match the sales deck.
Second-order effects
- Rivals like Meta and YouTube gain a concrete talking point with advertisers and creators, shifting competition for ad dollars and talent toward data-handling credibility rather than product features alone.
- US server procurement teams at foreign-owned platforms face forced audits of supply chains against sanction lists, raising costs for anyone whose infrastructure was assembled before the Inspur ban.
Third-order effects
- If the pattern holds — claims of data sovereignty undermined by hardware and personnel ties — the credible end state is forced divestiture or ownership restructuring as the only way a ByteDance-owned app keeps US data inside US control, with localization pledges alone no longer sufficient for regulators.
- Sanction-list enforcement would extend beyond chips and telecoms into commodity datacenter equipment, making vendor provenance a standing diligence item for every platform storing sensitive consumer data.
The trend: Data-localization schemes are being tested not just on where data sits but on who builds and operates the infrastructure underneath it, with sanctioned-hardware disclosures becoming the next front in the TikTok standoff.