Does Airbase Work in China? PIPL, Cross-Border Finance Data & Data Residency
Airbase is now a Paylocity company — a US spend-management platform that stores and processes your expense, corporate-card and vendor-payment data in the United States, with no mainland-China region. A compliance-first look at the PIPL cross-border and data-residency exposure for your China finance data.
Does Airbase work in China?
Whether you can use Airbase in mainland China is first a data-residency and cross-border-data question, not a speed one. Airbase is a spend-management platform — it carries your employees' expenses and reimbursements, your corporate-card activity, and your vendors' contact and bank details — and where that personal and financial data lives is what China's law responds to.
Airbase is now a Paylocity company, and Paylocity's own privacy notice states it is "an organization established in the United States of America (USA)," and that for people outside the US "your personal information will likely be transferred to, stored, and processed in the USA." So the expense, card and vendor-payment records of your China-based staff and suppliers are held offshore — a cross-border transfer of personal information that PIPL governs, and because bank and payment details are sensitive personal information, the bar is higher still. The table below is the vendor's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on your data volumes, your role, and how much sensitive data you move. Our China team can map your Airbase exposure with you →
What Airbase's own documentation says about China
| Fact | Primary source |
|---|---|
| In the vendor's own words: Airbase is now a Paylocity company, and Paylocity's privacy notice states it is "an organization established in the United States of America (USA)," and that for "individuals located outside the United States, your personal information will likely be transferred to, stored, and processed in the USA or other countries outside of where you live." The same notice lists "Airbase Inc." among the entities certified to process personal information in the United States — none of it in mainland China. | Paylocity — Special Notice for Residents of the EEA, UK and Switzerland (International Transfer), retrieved 2026-10-07 |
| Airbase holds personal information — employee names and expense claims, reimbursement and corporate-card activity, and vendor contacts and bank-account details — and keeps it in the US. Personal data gathered from people in China therefore leaves the country. PIPL governs that cross-border transfer: the personal-information handler (you, Airbase's customer — not Airbase) must give notice, obtain separate consent, and satisfy one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 |
| Bank-account numbers and payment details are "sensitive personal information" under PIPL (Article 28, which names financial accounts expressly), and that raises the bar: a handler needs a specific, necessary purpose, separate consent, and a personal-information protection impact assessment before moving them (Articles 29 and 55). A spend-management tool moves exactly this class of data across the border every time a China employee or vendor is paid. | PIPL Articles 28, 29 and 55 |
| The exposure scales with volume, sensitivity and role, not merely with using the tool. Under the CAC's March 2024 cross-border rules, a non-CIIO moving fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification — but sensitive personal information (bank and payment data) falls outside that exemption and is counted against far lower thresholds. For a CIIO or large-volume handler, personal information collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — which an offshore US platform cannot do. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024; PIPL Article 40; CSL Article 37 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a finance team running Airbase from mainland China, the deciding question is not how quickly the dashboard paints — it is where your finance data is allowed to live. Airbase is a spend-management platform: it carries your employees’ expense claims and reimbursements, your corporate-card activity, and your vendors’ contact and bank-account details. Airbase is now a Paylocity company, and Paylocity answers the location question in its own privacy notice — it is a US organization, and the personal data of people outside the United States is transferred to, stored, and processed there. The app is reachable from China; the exposure is that reaching it moves personal — and financial — data of your China staff and suppliers across the border, with no mainland region to keep it in.
Airbase in China at a glance
| What decides it | In the vendor's own terms |
|---|---|
| Where it runs | Airbase is now a Paylocity company; Paylocity is “an organization established in the United States of America (USA).” No mainland-China region is offered, and data of people outside the US is stored and processed in the USA. |
| What data it holds | Employee expense and reimbursement records, corporate-card activity, and vendor contacts and bank-account details — personal information, much of it financial. |
| Your China data | Personal data of China employees and vendors is transferred offshore to the US — a cross-border transfer PIPL governs, requiring notice, separate consent, and a transfer mechanism. |
| Sensitive data | Bank and payment details are “sensitive personal information” under PIPL, carrying a higher bar — specific necessity, separate consent, and an impact assessment — than ordinary personal data. |
| Is it reachable? | Yes — it is an offshore web application reached from China like any other US-hosted SaaS. Reachability is a delivery matter, not the compliance question. |
Door one — an offshore finance app, with your China data processed in the US
Airbase does not run inside mainland China. It is now a Paylocity company, and Paylocity states plainly that it is “an organization established in the United States of America (USA),” and that for people outside the US “your personal information will likely be transferred to, stored, and processed in the USA or other countries outside of where you live.” Its privacy notice lists “Airbase Inc.” among the entities that have certified to the U.S. Department of Commerce that they process personal information in the United States. There is no mainland-China region to assign your account to, so the finance records of your China staff and suppliers are held offshore by design.
That geography settles the data-residency question before performance ever enters it. Reaching an app is not the same as being cleared to move your people’s data to where it runs, and tuning the network does not create a mainland home for data that is held in the US.
Door two — personal and financial data crossing the border
Run Airbase from China and you are, on every pay run and every expense report, sending personal information out of the country: employee names and reimbursements, corporate-card activity, and vendor contacts and bank-account numbers. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, Airbase’s customer, not Airbase — has to give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification.
Financial data sharpens this. Bank-account and payment details are sensitive personal information under PIPL, which attaches a higher bar — a specific, necessary purpose, separate consent, and a protection impact assessment — to moving them at all. And if you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must stay in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore US platform cannot meet.
This is a risk map, not a verdict: whether you need a transfer mechanism, in-country storage, or both turns on how much personal and sensitive data you move, who your users are, and your role under the law — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Airbase. We add the piece an offshore finance platform cannot: a compliant, in-country path for the data China’s law wants kept close, set alongside your existing stack — no rebuild, no second system, and no move off Airbase. Our China team maps your PIPL cross-border and data-residency obligations against your entity, your data volumes, and the sensitive financial data you handle, then stands up the in-country delivery and storage a lawful China presence needs — on our ICP-filed infrastructure — while your finance workflows stay exactly where they already run.
Related reading:
