Does Your SaaS Stack Work in China? We Checked 763 Tools Against China's Own Rules

Ask “does [your tool] work in China?” and the answer you usually get is about speed: a latency number, a loading screen, a note that the dashboard opens. That answer is measuring the wrong thing. Whether you may lawfully run a tool for a China audience is not a reachability question — it is a compliance question, and it turns on where the data lives, whether the public-facing service is filed, and what licences the activity needs.

So we did the systematic version. Across 763 of the SaaS services teams actually run — hosting, CMSes, databases, analytics, CDNs, identity, payments, learning, HR, security and more — we checked each one against its own public documentation (where it hosts, whether it has a mainland-China region, what data it collects) and against China’s own law. This is, as far as we know, the largest first-party compliance survey of its kind. Here is what it found.

Across ~763 of the SaaS tools teams actually run, we checked each one against its own documentation and China’s own law. The pattern is almost universal: the service is reachable, but it runs outside mainland China, it has no ICP filing to give you, and for your Chinese users the data it holds is a cross-border transfer under PIPL. “Does it work in China” is a compliance question — and for most tools, the honest answer is not as-is.

What we actually checked (and what we left out)

This is the half a speed test cannot do, so it is worth being precise about the method.

For every service we read the vendor’s own words first — its security page, trust centre, data-processing agreement, sub-processor list, regions/locations documentation — to establish three facts: where it hosts, whether it operates a mainland-China region, and what personal data it holds. We then read those facts against the Chinese instruments that actually govern the question:

• ICP filing (备案) — the Measures for the Administration of Internet Information Services (State Council Order No. 292) and the Measures for Filing (MIIT Order No. 33): any public-facing service to mainland users must be filed, on a mainland hosting resource, by a mainland entity.
• PIPL Articles 38–40 — moving Chinese users’ personal information to an offshore service is a cross-border transfer (数据出境): notice, a lawful basis, a separate consent where consent is the basis, and one transfer mechanism all fall on you, the handler.
• Cybersecurity Law Article 39 (formerly Article 37) and PIPL Article 40 — for a critical-information-infrastructure operator or a large-volume handler, personal information generated in the mainland must be stored in the mainland.
• Sector licences on top of ICP where they apply — a payments licence for handling mainland payments, a value-added telecom licence for real-time communications, a 信息网络传播视听节目许可证 for delivering audio-visual programmes, a surveying qualification for maps, and so on.

Where a vendor’s documentation was silent, we inferred from its infrastructure and said so, and framed every page as a risk picture to settle with counsel — never legal advice. We deliberately excluded dead or discontinued products and pure network-workaround “solutions,” and we never name a customer: the anonymised unit is the tool, never the company that uses it. Each of the 763 services below links to its own page, where the specific evidence and the verbatim source quote live.

A note on what this is not: it is not a ranking, and it is not “these tools are bad.” Most of them are excellent at their job. The finding is narrower and more useful — that “works in China” has a compliance meaning most stacks have never been checked against.

The one pattern: two doors, almost everywhere

Strip away the categories and the same two doors decide nearly every case.

Door one — where the data rests. 99% of the services hold personal data that, for your Chinese users, is a cross-border transfer under PIPL the moment it leaves the mainland; 83% operate no mainland-China region for the core service, so that data has nowhere in-country to rest; and 94% pull a data-residency or localization question into scope. The service being reachable from Shanghai tells you nothing about whether its data was ever allowed to sit where it sits.

Door two — whether the public service is filed and licensed. 89% pull an ICP filing into the decision, and 41% carry a further licence gate beyond ICP — payments, value-added telecom, audio-visual, surveying. A foreign vendor generally cannot hold these for you.

Put together, 601 of the 763 (79%) have no self-serve in-country path for the core service — the honest answer for them is not as-is. That is not a reachability failure. It is a residency-and-filing fact that a “can I open the dashboard” check never surfaces, and it is exactly the half competitors who measure only speed or load-completion cannot answer.

By category

The pattern holds across the stack, but the shape of the fix differs by layer. Hosting, eCommerce, streaming video and customer-experience tools are almost entirely offshore-only. Databases, DevOps, identity and the open-source runtimes are where in-country levers actually exist. The full breakdown:

A few categories are worth calling out. Hosting and eCommerce are where the ICP door bites hardest — the public store or site is itself the filed service, and a global edge, however fast, is not an ICP-filed mainland presence. Streaming video, learning, customer-experience and finance are almost uniformly offshore with a second licence gate (audio-visual, payments) on top. And DevOps, databases, identity and the backend runtimes are the categories where a real in-country path exists most often — because the software is something you can run yourself.

The honest exceptions

A survey that found every tool non-compliant would be a sales pitch, not research. It did not. 162 of the 763 (21%) have a genuine in-country lever, and the distinction matters:

• Self-hostable software (10%). Open-source databases, search engines, CI runners, the backend runtimes and frameworks — software you deploy on infrastructure you control. Run it in a mainland data centre and the data stays resident; the lever is real. These are the Backend Frameworks and Runtimes, the self-managed databases and much of DevOps.
• A genuine mainland region or sovereign partition (12%). A handful of providers run a real China region — AWS China (operated by Sinnet/NWCD), Azure China (21Vianet), and the domestic Chinese clouds. Here residency is satisfied by design — but, crucially, in-country infrastructure is not automatic compliance. You still owe your own ICP filing, the mainland entity it requires, and MLPS obligations as operator; and if you replicate that data back to an offshore HQ, that round-trip is itself a PIPL cross-border transfer.
• Assets that hold no user data. A pure code, font or library CDN does not hold your users’ personal information at all; its only China question is in-country delivery, and the ICP duty sits with the site that embeds it — not with the CDN.

In other words: the answer is not uniformly “no.” It is “no as-is for most, with a real in-country path for a fifth — and the path is different for a self-hostable database than for a cloud-only video API.” That is the distinction this survey exists to draw, tool by tool.

Where 21YunBox fits

21YunBox is not a replacement for any of these tools. It is the compliant China-delivery overlay that sits in front of the stack you already run: an ICP-filed, in-country presence; PIPL-aware handling of visitor and user data at the border; and compliant in-country delivery — with the rest of your stack left exactly where it runs. For the 79% with no in-country path, that is how a China-facing surface becomes lawful without a re-platform. For the 21% with a lever, it is how the lever is actually stood up — the ICP, the entity, the residency design, the back-haul governance — rather than left as a line in a trust centre. We never use or suggest circumvention of any kind.

The full reference: all 763 services

Every service we checked, grouped by category, each linking to its own page with the verbatim vendor source and the specific compliance reading. “No in-country path” means the core service is offshore-only; “in-country lever” means a self-host, sovereign-region or mainland-region path exists (which still requires the ICP, entity and residency work). This is a risk picture to confirm with counsel, not legal advice.

Hosting — 82 services

• Acast — no in-country path
• Altis — no in-country path
• Amazon Web Services (AWS) — no in-country path
• AWS Amplify — no in-country path
• AWS DynamoDB — mainland region exists — not automatic compliance
• AWS S3 — mainland region exists — not automatic compliance
• Azure Cosmos DB — no in-country path
• Bluehost — no in-country path
• Buzzsprout — no in-country path
• Captivate — no in-country path
• Castos — no in-country path
• Cloudways — no in-country path
• Cockroachdb — no in-country path
• Contabo — no in-country path
• Couchbase Capella — no in-country path
• DigitalOcean — no in-country path
• DreamHost — no in-country path
• EdgeDB — no in-country path
• Fauna — no in-country path
• Fly.io — no in-country path
• Flywheel — no in-country path
• GitHub Pages — no in-country path
• Glitch — no in-country path
• GoDaddy — no in-country path
• Google Cloud — no in-country path
• Google Cloud Function — no in-country path
• Hasura — no in-country path
• Hello Audio — no in-country path
• Heroku — no in-country path
• Heroku — no in-country path
• Hetzner — no in-country path
• Hostinger — no in-country path
• Kinsta — no in-country path
• Kong Gateway — no in-country path
• Libsyn — no in-country path
• Linode — no in-country path
• Megaphone — no in-country path
• Mia-Platform — no in-country path
• Microsoft Azure — no in-country path
• MongoDB Atlas — no in-country path
• Neon Postgres — no in-country path
• Netcup — no in-country path
• Netlify — no in-country path
• Nexcess — no in-country path
• Oracle — no in-country path
• Oracle Cloud — no in-country path
• OVHcloud — no in-country path
• Pantheon — no in-country path
• Pinecone — no in-country path
• PlanetScale — no in-country path
• Platform.sh — no in-country path
• Plesk — in-country lever
• Podbean — no in-country path
• Pressable — no in-country path
• Railway — no in-country path
• Render — no in-country path
• Replit — no in-country path
• Rocket.net — no in-country path
• Salesforce Cloud — no in-country path
• SAP Cloud Platform (SAP BTP) — no in-country path
• Scaleway — no in-country path
• Singlestoredb Cloud — no in-country path
• SiteGround — no in-country path
• Spotify for Podcasters — no in-country path
• Stepzen — no in-country path
• Streamlit Community Cloud — no in-country path
• Supabase — no in-country path
• Surge.sh — no in-country path
• Thin Backend — no in-country path
• Tigris — no in-country path
• Tinybird — no in-country path
• Transistor — in-country lever
• UpCloud — no in-country path
• uPress — no in-country path
• Upstash — no in-country path
• Vercel — no in-country path
• Virtuozzo — no in-country path
• Vultr — no in-country path
• WordPress VIP — no in-country path
• WPengine — no in-country path
• Xata — no in-country path
• Zenlayer — no in-country path

CMS — 57 services

• Acquia — no in-country path
• Adobe Experience Manager — no in-country path
• Adobe Experience Manager (AEM) — self-host / in-country lever
• Adobe Experience Manager (AEM) — no in-country path
• Adobe Experience Manager (AEM) — no in-country path
• Agility — no in-country path
• Bloomreach — no in-country path
• ButterCMS — in-country lever
• ClickFunnels — no in-country path
• Coda — no in-country path
• Contentful — no in-country path
• Contentstack — no in-country path
• CoreMedia — no in-country path
• Cosmic — no in-country path
• Craft CMS — self-host / in-country lever
• Crafter CMS — self-host / in-country lever
• Crownpeak — no in-country path
• Directus — self-host / in-country lever
• Drupal — no in-country path
• Elementor — no in-country path
• Elucidat — no in-country path
• Ghost — no in-country path
• Google Docs — no in-country path
• Hivebrite — no in-country path
• Hygraph — no in-country path
• Jetpack — no in-country path
• Joomla — self-host / in-country lever
• Kentico — no in-country path
• Kontent.ai — no in-country path
• Liferay — no in-country path
• Magnolia — mainland region exists — not automatic compliance
• Northpass — no in-country path
• Notion — no in-country path
• Optimizely — no in-country path
• Optimizely (Episerver) — no in-country path
• Payload CMS — self-host / in-country lever
• Pimcore — no in-country path
• Prisma — no in-country path
• Prismic — mainland region exists — not automatic compliance
• Sanity — in-country lever
• Sanity — no in-country path
• Silverstripe CMS — no in-country path
• Sitecore Content Hub DAM — no in-country path
• Sitecore XM Cloud — no in-country path
• Sitefinity — no in-country path
• Stackbit — no in-country path
• Statamic — self-host / in-country lever
• Storyblok — no in-country path
• Strapi — self-host / in-country lever
• Strapi Cloud — no in-country path
• TYPO3 — self-host / in-country lever
• Umbraco — no in-country path
• Webflow — no in-country path
• Weebly — no in-country path
• Weglot — no in-country path
• Wix — no in-country path
• WordPress — no in-country path

Analytics — 37 services

• Adobe Analytics — in-country lever
• Adobe Target — no in-country path
• AdTrace — no in-country path
• Amplitude — mainland region exists — not automatic compliance
• AppDynamics — no in-country path
• Better Stack — no in-country path
• Branch — mainland region exists — not automatic compliance
• Bugsnag — no in-country path
• Cloudflare Analytics Insight — in-country lever
• Datadog — no in-country path
• Fathom — no in-country path
• FullStory — no in-country path
• Google Analytics — no in-country path
• Grafana — no in-country path
• Honeycomb — no in-country path
• Hotjar — no in-country path
• Intercom — in-country lever
• LogRocket — no in-country path
• Matomo — mainland region exists — not automatic compliance
• Microsoft Clarity — no in-country path
• Middleware.Io — no in-country path
• Mixpanel — no in-country path
• Ninetailed — mainland region exists — not automatic compliance
• Opsgenie — no in-country path
• PagerDuty — no in-country path
• Pendo — mainland region exists — not automatic compliance
• Pingdom — no in-country path
• Plausible — mainland region exists — not automatic compliance
• Podtrac — in-country lever
• Prometheus — self-host / in-country lever
• Rollbar — no in-country path
• Segment — no in-country path
• Sentry — no in-country path
• Simple Analytics — in-country lever
• Statuspage — no in-country path
• Tealium — mainland region exists — not automatic compliance
• Tidio — no in-country path

Security — 36 services

• 1Password — no in-country path
• Auth0 — no in-country path
• AWS WAF — mainland region exists — not automatic compliance
• Bitwarden — mainland region exists — not automatic compliance
• Check Point — mainland region exists — not automatic compliance
• Citrix — no in-country path
• Cloudflare Turnstile — no in-country path
• Cookiebot — no in-country path
• CrowdStrike — mainland region exists — not automatic compliance
• DataDome — in-country lever
• Didomi — no in-country path
• Fortinet — mainland region exists — not automatic compliance
• Google Authenticator App — no in-country path
• hCaptcha — mainland region exists — not automatic compliance
• KnowBe4 — no in-country path
• Microsoft Authenticator App — mainland region exists — not automatic compliance
• Microsoft Defender — mainland region exists — not automatic compliance
• Microsoft Intune — mainland region exists — not automatic compliance
• Mimecast — no in-country path
• Okta — no in-country path
• OneLogin — no in-country path
• OneTrust — no in-country path
• Osano — no in-country path
• Proofpoint — no in-country path
• Qualys — no in-country path
• Rapid7 — no in-country path
• ReCaptcha — no in-country path
• Securiti — no in-country path
• Snyk — mainland region exists — not automatic compliance
• Tanium — no in-country path
• Tenable — no in-country path
• TrustArc — no in-country path
• Usercentrics — no in-country path
• Varonis — no in-country path
• Veracode — no in-country path
• Zscaler — in-country lever

DevOps — 31 services

• Ansible — self-host / in-country lever
• Bitbucket — no in-country path
• CircleCI — no in-country path
• Composer (Packagist) — self-host / in-country lever
• Docker Hub — mainland region exists — not automatic compliance
• Gitea — self-host / in-country lever
• GitHub — no in-country path
• GitHub Actions — self-host / in-country lever
• GitHub Container Registry — mainland region exists — not automatic compliance
• GitHub Enterprise Server — mainland region exists — not automatic compliance
• GitLab — no in-country path
• GitLab CI/CD — self-host / in-country lever
• Harness — mainland region exists — not automatic compliance
• HashiCorp Vault — no in-country path
• Helm — self-host / in-country lever
• Homebrew — self-host / in-country lever
• Jenkins — no in-country path
• JFrog Artifactory — mainland region exists — not automatic compliance
• Kubernetes — self-host / in-country lever
• Maven Central — self-host / in-country lever
• npm — mainland region exists — not automatic compliance
• NuGet — self-host / in-country lever
• Perforce (Helix Core) — self-host / in-country lever
• Podman — self-host / in-country lever
• Pulumi — mainland region exists — not automatic compliance
• PyPI — self-host / in-country lever
• Quay — mainland region exists — not automatic compliance
• Red Hat OpenShift — in-country lever
• RubyGems — self-host / in-country lever
• SonarQube — mainland region exists — not automatic compliance
• Terraform — no in-country path

eCommerce — 27 services

• Adobe Commerce — no in-country path
• Bazaarvoice — mainland region exists — not automatic compliance
• BigCommerce — no in-country path
• Commerce Layer — no in-country path
• Ecwid — no in-country path
• Findify — no in-country path
• HelloRetail — no in-country path
• Joy: Rewards & Loyalty Program — no in-country path
• Magento — no in-country path
• Medusa — no in-country path
• PageFly — no in-country path
• Pre-order Now by Shopify — no in-country path
• PrestaShop — no in-country path
• Salesforce Commerce Cloud — no in-country path
• Shogun — no in-country path
• Shopify — no in-country path
• Shopify — no in-country path
• Shopify Plugin: Easygift: Auto Add To Cart — no in-country path
• Shopify Plugin: Langify — no in-country path
• Shopify Plugin: Multi Country Pricing — no in-country path
• Shopify Plus — no in-country path
• Shopware — no in-country path
• Sitecore Ordercloud — no in-country path
• Squarespace — no in-country path
• VTEX — no in-country path
• WooCommerce — no in-country path
• WordPress Multilingual Plugin — no in-country path

Data and Analytics — 27 services

• Airbyte — mainland region exists — not automatic compliance
• Alteryx — no in-country path
• Apache Airflow — self-host / in-country lever
• Apache Kafka / Confluent — no in-country path
• Boomi — no in-country path
• Celonis — no in-country path
• Collibra — no in-country path
• Databricks — no in-country path
• dbt — mainland region exists — not automatic compliance
• Fivetran — mainland region exists — not automatic compliance
• Google BigQuery — no in-country path
• IBM Cognos Analytics — no in-country path
• Informatica — no in-country path
• Looker — no in-country path
• Metabase — mainland region exists — not automatic compliance
• Microsoft Power BI — mainland region exists — not automatic compliance
• MicroStrategy (Strategy) — no in-country path
• MuleSoft — mainland region exists — not automatic compliance
• Qlik — no in-country path
• SAP Analytics Cloud — no in-country path
• SAS — no in-country path
• SnapLogic — no in-country path
• Snowflake — mainland region exists — not automatic compliance
• Tableau — no in-country path
• Talend (now Qlik Talend Cloud) — no in-country path
• ThoughtSpot — mainland region exists — not automatic compliance
• Workato — no in-country path

Communications — 23 services

• 100ms — no in-country path
• 8x8 — no in-country path
• Agora — in-country lever
• Amazon Connect — no in-country path
• Amazon SES — no in-country path
• Avaya — no in-country path
• Azure AI Speech — mainland region exists — not automatic compliance
• Daily — no in-country path
• Dialpad — no in-country path
• LiveKit — no in-country path
• Mailgun — no in-country path
• MessageBird — no in-country path
• Postmark — no in-country path
• Resend — no in-country path
• RingCentral — no in-country path
• Sendbird — no in-country path
• SendGrid — mainland region exists — not automatic compliance
• Talkdesk — no in-country path
• Twilio — no in-country path
• Twilio Video — no in-country path
• Vonage — no in-country path
• Vonage Video API — no in-country path
• ZEGOCLOUD — no in-country path

AI and ML — 20 services

• Anthropic Claude — no in-country path
• AWS Bedrock — mainland region exists — not automatic compliance
• Azure OpenAI Service — mainland region exists — not automatic compliance
• Cohere — no in-country path
• Cursor — no in-country path
• GitHub Copilot — in-country lever
• Google Gemini — no in-country path
• Groq — no in-country path
• Hugging Face — no in-country path
• LangChain — mainland region exists — not automatic compliance
• Microsoft Copilot — no in-country path
• Midjourney — no in-country path
• Mistral AI — no in-country path
• NVIDIA NGC — no in-country path
• OpenAI (ChatGPT) — no in-country path
• OpenRouter — no in-country path
• Perplexity — no in-country path
• Replicate — no in-country path
• Stability AI — no in-country path
• Together AI — no in-country path

CDN — 19 services

• Adobe Scene7 (Dynamic Media) — in-country lever
• Akamai — no in-country path
• AWS Cloudfront — no in-country path
• Azure Front Door — no in-country path
• Bootstrapcdn — self-host / in-country lever
• Bunny CDN — no in-country path
• cdnjs — self-host / in-country lever
• Cloudflare — no in-country path
• Cloudinary — in-country lever
• Fastly — no in-country path
• Google Hosted Libraries — no in-country path
• Imgix — no in-country path
• Imperva — no in-country path
• jQuery CDN — no in-country path
• jsDelivr — no in-country path
• KeyCDN — no in-country path
• Microsoft Ajax CDN — no in-country path
• StackPath — no in-country path
• UNPKG — no in-country path

Streaming Video — 19 services

• BigMarker — no in-country path
• Brightcove — no in-country path
• Cloudflare Stream — no in-country path
• Cvent — no in-country path
• Go To Webinar — no in-country path
• JW Player — no in-country path
• Kaltura — no in-country path
• Loom — no in-country path
• Matterport — no in-country path
• Mux — no in-country path
• On24 — no in-country path
• Sendspark — no in-country path
• THEOplayer — no in-country path
• Vidyard — no in-country path
• Vimeo — no in-country path
• Webex — no in-country path
• Wistia — no in-country path
• YouTube — no in-country path
• Zoom — no in-country path

Identity and Collaboration — 19 services

• Asana — no in-country path
• Atlassian Confluence — no in-country path
• Atlassian Jira — no in-country path
• Box — no in-country path
• Clerk — no in-country path
• ClickUp — no in-country path
• CyberArk — mainland region exists — not automatic compliance
• Dropbox — no in-country path
• Google Workspace — no in-country path
• JumpCloud — mainland region exists — not automatic compliance
• Linear — no in-country path
• Microsoft 365 — mainland region exists — not automatic compliance
• Microsoft Entra ID — mainland region exists — not automatic compliance
• Microsoft OneDrive — mainland region exists — not automatic compliance
• Microsoft SharePoint — mainland region exists — not automatic compliance
• monday.com — no in-country path
• Ping Identity — no in-country path
• SailPoint — no in-country path
• WorkOS — mainland region exists — not automatic compliance

WebOps — 17 services

• Amazon Cloudwatch — mainland region exists — not automatic compliance
• Auvik — no in-country path
• Azure Monitor — no in-country path
• BugHerd — no in-country path
• Dynatrace — no in-country path
• Gatsby JS — no in-country path
• LogicMonitor — no in-country path
• n8n — no in-country path
• New Relic — no in-country path
• Ngrok — no in-country path
• PRTG — no in-country path
• Solarwinds — self-host / in-country lever
• Splunk — no in-country path
• Visual Studio App Center — no in-country path
• Vmware Vsphere — in-country lever
• Yottaa — no in-country path
• Zapier — no in-country path

Forms, Surveys & Interactive — 15 services

• Barracuda — no in-country path
• Bombbomb — no in-country path
• Builder.Io — no in-country path
• Canny — no in-country path
• Canvasjs — in-country lever
• Convertkit — no in-country path
• Cookie Information — no in-country path
• Drip — no in-country path
• Everviz — no in-country path
• GemPages — no in-country path
• Opinion Stage — no in-country path
• Salesforce Knowledge — no in-country path
• ShareThis — no in-country path
• Spline — no in-country path
• VWO — no in-country path

Learning Management Systems (LMS) — 13 services

• Blackboard — no in-country path
• Canvas — no in-country path
• Coursera — no in-country path
• Degreed — no in-country path
• Docebo — no in-country path
• LinkedIn Learning — no in-country path
• Litmos — no in-country path
• Moodle — no in-country path
• Piazza — no in-country path
• Skillsoft — no in-country path
• Teachable — no in-country path
• Thinkific — no in-country path
• Udemy — no in-country path

Email Marketing — 13 services

• ActiveCampaign — no in-country path
• Aweber — no in-country path
• Beehiiv — no in-country path
• Benchmark Email — no in-country path
• Brevo — no in-country path
• Constant Contact — no in-country path
• Eloqua — no in-country path
• GetResponse — no in-country path
• Klaviyo — no in-country path
• Mailchimp — no in-country path
• Mailerlite — no in-country path
• Pardot — no in-country path
• Salesforce Marketing Cloud — no in-country path

Databases — 13 services

• Amazon RDS — no in-country path
• Amazon Redshift — mainland region exists — not automatic compliance
• Azure SQL Database — no in-country path
• ClickHouse — no in-country path
• Cloudera — self-host / in-country lever
• Microsoft SQL Server — mainland region exists — not automatic compliance
• MongoDB — no in-country path
• MySQL — no in-country path
• Oracle Database — mainland region exists — not automatic compliance
• PostgreSQL — no in-country path
• Redis — no in-country path
• Teradata — mainland region exists — not automatic compliance
• TiDB — mainland region exists — not automatic compliance

Advertising — 12 services

• Adobe Audience Manager — in-country lever
• Adobe Dynamic Tag Management — no in-country path
• AdRoll — mainland region exists — not automatic compliance
• Bitly — no in-country path
• Criteo — no in-country path
• Google Ads — no in-country path
• Google Tag Manager — no in-country path
• LinkedIn Insight Tag — no in-country path
• Meta Pixel — no in-country path
• Microsoft Advertising (Bing Ads) — no in-country path
• Taboola — no in-country path
• The Trade Desk — no in-country path

CRM — 12 services

• 6sense — mainland region exists — not automatic compliance
• Clubexpress — no in-country path
• Demandbase — mainland region exists — not automatic compliance
• Drift — no in-country path
• Freshdesk — no in-country path
• HubSpot — no in-country path
• Marketo — no in-country path
• Microsoft Dynamics 365 Customer Engagement — mainland region exists — not automatic compliance
• ServiceNow — no in-country path
• Wildapricot — no in-country path
• Zendesk — no in-country path
• Zoho CRM — mainland region exists — not automatic compliance

Payments — 12 services

• Adyen — no in-country path
• Airbase — no in-country path
• Airwallex — in-country lever
• Authorize.Net — no in-country path
• Braintree — no in-country path
• Checkout.com — no in-country path
• Klarna — no in-country path
• Paddle — in-country lever
• PayPal — in-country lever
• Razorpay — no in-country path
• Square — no in-country path
• Stripe — no in-country path

Customer Experience — 12 services

• Crisp — no in-country path
• Five9 — no in-country path
• Genesys Cloud CX — no in-country path
• Gorgias — no in-country path
• Help Scout — no in-country path
• LiveChat — no in-country path
• LivePerson — no in-country path
• NICE CXone — no in-country path
• Oracle CX — no in-country path
• Pega — no in-country path
• Sprinklr — no in-country path
• Verint — no in-country path

Social Media — 11 services

• Discord — no in-country path
• Facebook — no in-country path
• Instagram — no in-country path
• Medium — no in-country path
• Pinterest — no in-country path
• Reddit — no in-country path
• Snapchat — no in-country path
• Substack — no in-country path
• Twitch — no in-country path
• Twitter — no in-country path
• X — no in-country path

Backend and Low-Code Platforms — 11 services

• Airtable — no in-country path
• Apollo GraphQL — no in-country path
• Appwrite — self-host / in-country lever
• Bubble — no in-country path
• Firebase — no in-country path
• Firebase — no in-country path
• Firebase — no in-country path
• Make — no in-country path
• PocketBase — self-host / in-country lever
• Postman — no in-country path
• Retool — mainland region exists — not automatic compliance

HCM — 11 services

• ADP — in-country lever
• BambooHR — no in-country path
• Cornerstone OnDemand — no in-country path
• Dayforce — no in-country path
• Deel — no in-country path
• Gusto — no in-country path
• Oracle HCM Cloud — mainland region exists — not automatic compliance
• Rippling — no in-country path
• SAP SuccessFactors — in-country lever
• UKG — no in-country path
• Workday — mainland region exists — not automatic compliance

Maps and Location — 10 services

• Apple MapKit JS — no in-country path
• Bing Maps — no in-country path
• Google Maps — no in-country path
• HERE Maps — no in-country path
• IPinfo — mainland region exists — not automatic compliance
• Leaflet — no in-country path
• Mapbox — no in-country path
• MaxMind — mainland region exists — not automatic compliance
• OpenWeather — no in-country path
• TomTom — no in-country path

Reviews and Loyalty — 10 services

• Back in Stock — no in-country path
• Judge.Me — no in-country path
• Loox — no in-country path
• LoyaltyLion — no in-country path
• Okendo — no in-country path
• Reviews.Io — mainland region exists — not automatic compliance
• Smile.Io — no in-country path
• Stamped — no in-country path
• Trustpilot — no in-country path
• Yotpo — no in-country path

Procurement — 10 services

• Blue Yonder — no in-country path
• Coupa — no in-country path
• Esker — no in-country path
• Ivalua — no in-country path
• JAGGAER — no in-country path
• Kinaxis — no in-country path
• Manhattan Associates — no in-country path
• o9 Solutions — no in-country path
• SAP Ariba — mainland region exists — not automatic compliance
• SAP Concur — in-country lever

Collaboration and Productivity — 9 services

• Calendly — no in-country path
• Canva — mainland region exists — not automatic compliance
• Figma — no in-country path
• Google Meet — no in-country path
• Grammarly — no in-country path
• Microsoft Teams — no in-country path
• Miro — no in-country path
• Slack — no in-country path
• Smartsheet — no in-country path

ERP — 9 services

• Epicor Kinetic — no in-country path
• IFS — no in-country path
• Infor CloudSuite — no in-country path
• Microsoft Dynamics 365 Finance — mainland region exists — not automatic compliance
• Oracle E-Business Suite — no in-country path
• Oracle Fusion Cloud ERP — no in-country path
• Oracle NetSuite — mainland region exists — not automatic compliance
• Sage Intacct — no in-country path
• SAP S/4HANA — self-host / in-country lever

Finance and Accounting — 9 services

• Anaplan — no in-country path
• BILL — no in-country path
• BlackLine — no in-country path
• Expensify — no in-country path
• OneStream — no in-country path
• Oracle EPM Cloud — no in-country path
• Ramp — no in-country path
• Tipalti — no in-country path
• Workiva — no in-country path

Enterprise Content Management — 8 services

• Aprimo — no in-country path
• Bynder — no in-country path
• Hyland OnBase — no in-country path
• iManage — no in-country path
• M-Files — no in-country path
• NetDocuments — no in-country path
• OpenText — no in-country path
• OpenText Documentum — no in-country path

Translation and Localization — 8 services

• Amazon Translate — no in-country path
• Crowdin — no in-country path
• DeepL — no in-country path
• Google Cloud Translation — no in-country path
• Lokalise — no in-country path
• Microsoft Translator — no in-country path
• Phrase — no in-country path
• Smartling — no in-country path

E-Signature — 7 services

• Adobe Acrobat Sign — no in-country path
• Authentisign — no in-country path
• DocuSign — no in-country path
• Dropbox Sign (HelloSign) — no in-country path
• Onespan — no in-country path
• PandaDoc — no in-country path
• SignNow — no in-country path

Surveys and Feedback — 7 services

• Alchemer — no in-country path
• Medallia — no in-country path
• Qualtrics — no in-country path
• Survey Junkie — no in-country path
• SurveyMonkey — no in-country path
• Surveysavvy — no in-country path
• Typeform — no in-country path

Identity Verification — 7 services

• Jumio — no in-country path
• Onfido — no in-country path
• Persona — no in-country path
• Plaid — no in-country path
• Stripe Identity — no in-country path
• Sumsub — no in-country path
• Veriff — no in-country path

Governance Risk and Compliance — 7 services

• Archer — no in-country path
• AuditBoard (now Optro) — no in-country path
• Diligent — no in-country path
• Icertis — no in-country path
• Ironclad — no in-country path
• LogicGate Risk Cloud — no in-country path
• NAVEX — no in-country path

Voice and Speech — 7 services

• Amazon Polly & Transcribe — no in-country path
• AssemblyAI — no in-country path
• Deepgram — no in-country path
• ElevenLabs — no in-country path
• Google Cloud Speech-to-Text — no in-country path
• OpenAI Whisper — no in-country path
• Speechmatics — no in-country path

Document and Vision AI — 7 services

• Amazon Rekognition — no in-country path
• Amazon Textract — no in-country path
• Azure AI Document Intelligence — mainland region exists — not automatic compliance
• Google Cloud Vision AI — no in-country path
• Google Document AI — no in-country path
• Hive — no in-country path
• Mindee — no in-country path

Collaboration and Enablement — 7 services

• Guru — no in-country path
• Highspot — no in-country path
• Microsoft Viva — no in-country path
• Mural — no in-country path
• Seismic — no in-country path
• Simpplr — no in-country path
• Staffbase — no in-country path

Backend Frameworks and Runtimes — 7 services

• Bun — self-host / in-country lever
• Deno — self-host / in-country lever
• Django — self-host / in-country lever
• Laravel — self-host / in-country lever
• Node.js — self-host / in-country lever
• Ruby on Rails — self-host / in-country lever
• Spring Boot — mainland region exists — not automatic compliance

Cloud Platforms — 7 services

• Baidu AI Cloud — mainland region exists — not automatic compliance
• Gcore — no in-country path
• Google Cloud CDN — no in-country path
• Huawei Cloud — mainland region exists — not automatic compliance
• IBM Cloud — no in-country path
• Tencent Cloud — mainland region exists — not automatic compliance
• Volcano Engine — mainland region exists — not automatic compliance

Feature Flags and CDP — 6 services

• Heap — no in-country path
• LaunchDarkly — no in-country path
• mParticle — no in-country path
• PostHog — no in-country path
• Split — no in-country path
• Statsig — no in-country path

Push and Realtime Messaging — 6 services

• Ably — no in-country path
• Braze — no in-country path
• Firebase Cloud Messaging — no in-country path
• Iterable — no in-country path
• OneSignal — no in-country path
• Pusher — no in-country path

Billing, Tax and Logistics — 6 services

• AfterShip — no in-country path
• Avalara — no in-country path
• Chargebee — no in-country path
• Recurly — no in-country path
• Shippo — no in-country path
• Zuora — no in-country path

Marketing and Audience Data — 6 services

• Adjust — no in-country path
• AppsFlyer — in-country lever
• Hootsuite — no in-country path
• Khoros — no in-country path
• Sprout Social — no in-country path
• TikTok Pixel — no in-country path

Identity and Access Management — 6 services

• BeyondTrust — mainland region exists — not automatic compliance
• Cisco Duo — no in-country path
• Delinea — mainland region exists — not automatic compliance
• ForgeRock — mainland region exists — not automatic compliance
• Keycloak — mainland region exists — not automatic compliance
• Saviynt — no in-country path

Forms — 5 services

• Cognito Forms — no in-country path
• Formstack — no in-country path
• Google Forms — no in-country path
• Jotform — no in-country path
• Microsoft Forms — no in-country path

Site Search — 5 services

• Algolia — no in-country path
• Algolia — mainland region exists — not automatic compliance
• Coveo — no in-country path
• Meilisearch — no in-country path
• Sitecore Search — no in-country path

Search and Vector — 5 services

• Elasticsearch — no in-country path
• OpenSearch — no in-country path
• Qdrant — no in-country path
• Typesense — no in-country path
• Weaviate — no in-country path

IT Service Management — 5 services

• BMC Helix — mainland region exists — not automatic compliance
• Freshservice — no in-country path
• Ivanti Neurons for ITSM — mainland region exists — not automatic compliance
• Jira Service Management — mainland region exists — not automatic compliance
• ManageEngine ServiceDesk Plus — mainland region exists — not automatic compliance

Digital Experience and Commerce — 5 services

• Adobe Experience Cloud — no in-country path
• Adobe Experience Platform — no in-country path
• commercetools — no in-country path
• Salesforce Commerce Cloud — no in-country path
• SAP Commerce Cloud — mainland region exists — not automatic compliance

DNS — 4 services

• AWS Route 53 — mainland region exists — not automatic compliance
• Cloudflare DNS — no in-country path
• Edgecast — no in-country path
• NS1 — no in-country path

Other — 4 services

• Cloudinary — no in-country path
• DatoCMS — no in-country path
• Gatsby Cloud — no in-country path
• PageSpeed Insights — no in-country path

Testing — 4 services

• BrowserStack — no in-country path
• Cypress — self-host / in-country lever
• Playwright — self-host / in-country lever
• Sauce Labs — no in-country path

Fonts — 3 services

• Adobe Typekit — in-country lever
• Font Awesome — in-country lever
• Google Fonts API — no in-country path

Design and Creative — 3 services

• Adobe Creative Cloud — mainland region exists — not automatic compliance
• Frame.io — no in-country path
• Sketch — in-country lever

Global Accelerator — 2 services

• Alibaba Cloud Global Accelerator — in-country lever
• AWS Global Accelerator — no in-country path

Virtualization and EUC — 2 services

• Nutanix — mainland region exists — not automatic compliance
• VMware Horizon — mainland region exists — not automatic compliance

Website Builders — 1 service

• Framer — no in-country path

---

Does your stack appear above? Our China compliance team will map your specific tools — what must stay resident, what may lawfully leave, where an ICP filing and licence apply, and the in-country delivery path — for your entity and your China audience.

Get a free compliance assessment →

Methodology: 763 services with a published “Does it work in China?” compliance assessment as of 2026-10-15, each verified against the vendor’s own documentation and the Chinese instruments cited above; signals are extracted from each assessment and counted programmatically. Figures move as the corpus grows. This is a compliance risk picture, not legal advice — confirm your obligations, which turn on your data volumes and your role, with qualified counsel.