Does Bubble Work in China? Data Residency, ICP & Cross-Border Rules
Bubble is a SaaS-only no-code platform: your whole app and its user database run on Bubble-managed AWS in Oregon, US, with no mainland-China region, so your China users' data sits offshore under PIPL — and Bubble also holds your API keys and runs backend workflows abroad.
Does Bubble work in China?
The question is not whether the Bubble editor loads from Shanghai — it is where your application and its users' data live. Bubble is a SaaS-only no-code platform: your whole app and its database run on Bubble-managed AWS infrastructure (its main cluster is AWS West Region in Oregon, US) with no mainland-China region, so every record you hold for China users is a PIPL cross-border transfer the moment it is stored.
That exposure has two halves a reachability check never sees. First, your app's database rows, user and login records and form submissions — the personal information of your China users — sit offshore (PIPL Articles 38–40: notice, separate consent and a transfer mechanism; and for a critical information infrastructure operator or high-volume handler the Cybersecurity Law Article 39, formerly Article 37, wants that data stored in the mainland). Second, Bubble also holds the API keys and credentials your integrations use and runs your backend workflows on its offshore servers — a concentration of your secrets abroad and a pipe that carries China data across the border by design.
This is a risk map, not a verdict — what applies turns on your entity, data volumes and what your app collects. Our China team can map your exposure with you →
What Bubble's own documentation says about China
| Fact | Primary source |
|---|---|
| Bubble is SaaS-only and runs your whole app on its own AWS infrastructure, offshore. Bubble's support center states: “Bubble's main cluster applications are hosted on AWS West Region (Oregon, US; this can be customized if you're on a Dedicated Plan).” It adds that user data “is encrypted at rest (we're on AWS RDS)” — so both your app and its database run on Bubble-managed AWS servers in the United States, with no mainland-China region. | Bubble Support Center — “How is Bubble hosted?” (bubble.io/support), retrieved 2026-10-13 |
| The shared environment is US-only and cannot be moved; the only residency lever is which AWS region — never mainland China. Bubble's manual: “Bubble's servers are hosted on Amazon Web Services (AWS)”; “Bubble's shared server environment is hosted in the US, and we don't currently offer the possibility of changing that location”; and “Our Enterprise plan, on the other hand, lets you choose the AWS region where you want your app to be hosted.” Every option is an offshore, Bubble-operated AWS region — none in the mainland, and there is no path to take the app off Bubble's hosting. | Bubble Manual — “How Bubble hosting works” / “How Bubble hosts apps” (manual.bubble.io), retrieved 2026-10-13 |
| Your China users' app data held abroad is a cross-border transfer of personal information. Because the records, logins and form submissions of your mainland users — and the API keys and credentials Bubble holds for your integrations — live on Bubble's offshore AWS infrastructure, moving them out of China engages PIPL Articles 38–40: advance notice, a separate consent distinct from the user's agreement to use the app, and one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). | PIPL Articles 38–40 (cross-border provision of personal information) |
| If a localization duty applies to you, China-collected data must stay in the mainland — a bar an offshore-only platform cannot clear. For a critical information infrastructure operator or large-volume handler, the Cybersecurity Law Article 39 (formerly Article 37 — renumbered by the amendment in force January 1, 2026, its substance unchanged) requires personal information generated in the mainland to be stored there. A Bubble app whose only hosting is AWS regions outside China cannot meet it. Confirm scope with counsel. | Cybersecurity Law Article 39 (formerly Article 37), amended 2025, in force 2026-01-01 |
Sources verified by the 21YunBox compliance team on 2026-10-13.
Ask whether Bubble “works” in mainland China and the honest answer starts with where your application and its users’ data live, not with how fast the editor paints. Bubble is a SaaS-only no-code platform: you build in Bubble’s online editor and your finished app — the pages, the logic, and the database behind it — runs on infrastructure Bubble owns and operates. By Bubble’s own account that infrastructure is Amazon Web Services, with the main cluster in AWS West Region (Oregon, US) and no region inside mainland China. So for the Chinese people who use your app, the account records, logins and form submissions you collect are personal information held offshore the moment they are created — a cross-border transfer before it is ever a feature. And because Bubble also stores the API keys and credentials your integrations rely on and runs your backend workflows on those same offshore servers, the platform concentrates your secrets abroad and carries your China data across the border as part of normal operation. Reachability is real, but it is the least of what you are deciding.
Bubble in China at a glance
| What decides it | In Bubble's own terms — and China's law |
|---|---|
| Where it runs | Bubble's support center: “Bubble's main cluster applications are hosted on AWS West Region (Oregon, US; this can be customized if you're on a Dedicated Plan).” The shared environment is “hosted in the US,” and even an Enterprise/Dedicated plan only lets you “choose the AWS region” — all offshore and Bubble-operated, none in mainland China. |
| What it holds | Your whole app: database rows, user and login records, and form submissions — the personal information of your China users — plus the API keys and credentials your integrations use. That is a full application and its end-user data, concentrated on the vendor's platform. |
| Where that data sits | Bubble: user data “is encrypted at rest (we're on AWS RDS).” Offshore. For your mainland users that is a cross-border transfer PIPL governs, with a residency duty an offshore-only region cannot meet. |
| Connection secrets & the cross-border pipe | Bubble stores the API keys, tokens and credentials your app's integrations rely on and runs your backend workflows on its offshore servers — so when your app reads from or writes to your other systems, that processing happens abroad. The platform's normal operation is itself a cross-border flow a reachability check never sees. |
| Localization & filing | For a critical information infrastructure operator or high-volume handler, Cybersecurity Law Article 39 (formerly Article 37) requires China-generated personal information to be stored in the mainland. Any China-facing app or portal is also an internet information service carrying an ICP filing (备案) duty. |
| Reachability is not the axis | Whether the editor or app loads tells you nothing about where your app data and secrets sit, or whether that data may lawfully leave the country. 21YunBox keeps the regulated application and end-user data in-country, ICP-files the China-facing surface, and delivers it — the 21YunBox Optimizer — in front of the Bubble stack you already run. |
Where Bubble runs — and that settles the first question
Bubble is hosted software, and in its own documentation it names where. Its support center states that “Bubble’s main cluster applications are hosted on AWS West Region (Oregon, US; this can be customized if you’re on a Dedicated Plan),” and that user data “is encrypted at rest (we’re on AWS RDS).” Its manual adds that “Bubble’s servers are hosted on Amazon Web Services (AWS),” that “Bubble’s shared server environment is hosted in the US, and we don’t currently offer the possibility of changing that location,” and that “Our Enterprise plan, on the other hand, lets you choose the AWS region where you want your app to be hosted.” There is no mainland-China region anywhere in that picture. So wherever your tenant sits, both your application and the database it keeps for your Chinese users are held offshore — in the United States by default, or in whichever other AWS region a Dedicated plan selects. That single fact decides the compliance question before reachability is ever measured: this is not about whether a page paints in Shanghai, but about a full application and its end-user data leaving the country the moment Bubble stores them. And note what the region choice is not — picking a different AWS region keeps the app on Bubble-managed, offshore infrastructure; it is not in-country residency, and there is no documented way to take a Bubble app off Bubble’s hosting at all.
Prong one — your China users’ app and data are a cross-border transfer
Bubble’s purpose is to run your application end to end. The database rows, the user and authentication records, the form submissions and whatever else your app collects accumulate in the Bubble tenant, and Bubble holds all of it as data “encrypted at rest” on “AWS RDS” abroad. For your mainland users, moving that personal information out of China engages the Personal Information Protection Law: you must give notice, obtain separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (cross-border transfer rules, PIPL Articles 38–40). If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL localization duties) — a residency requirement an offshore-only Bubble cannot satisfy, because its only hosting options are AWS regions outside the country. This is your application’s real user data, not “can the editor open,” and it is the spine of the question.
Prong two — Bubble holds your secrets and is itself the cross-border pipe
There is a second half a speed test still cannot see. A Bubble app rarely lives alone: through its API Connector and plugins it calls external services, and through its backend workflows it reads from and writes to your other systems and databases. To do that, Bubble stores the API keys, tokens and credentials those connections rely on — and it runs the workflows that use them on the same offshore AWS servers your app runs on. Two consequences follow. First, your secrets are concentrated abroad: the keys that reach into your systems sit on a platform outside China. Second, the platform’s ordinary operation is itself a cross-border flow — when a backend workflow pulls records from a China-side system to process them, or pushes data back, that movement happens across the border by design, not as an exception. A reachability check — can I open the editor from Shanghai — sees none of this. Only keeping the regulated data and those secrets in-country, on an in-country backend, removes the exposure rather than relocating it.
Why a reachability check misses all of this
A probe that only asks “does Bubble load from Shanghai?” measures the wrong thing. It cannot see that your application and its user database are held on AWS outside the mainland, it cannot see the notice-consent-and-mechanism duties that attach to that cross-border transfer, and it cannot see that the API keys and backend workflows Bubble holds make the platform a standing cross-border pipe into your own systems. Making the offshore platform merely reachable does not move the regulated data in-country, and it does not pull your secrets back inside the border. Reaching a Chinese audience and being cleared to hold and move their data are two different tests — and only one of them shows up on a latency chart.
This is a risk map, not a verdict that Bubble is “blocked” or “illegal.” Which duties bite depends on your entity, what your app actually collects and sends, your role under Chinese law, and your data volumes — worth settling with counsel before a China-facing app goes live.
Where 21YunBox fits — map, localize, deliver
We do not ask you to leave Bubble. We add the layer a hosted, offshore no-code platform cannot. Map: we inventory what your tenant holds — user and account records, form and database rows, and the API keys, tokens and connection credentials your integrations and backend workflows use — where it is hosted, which of your own systems the platform reaches, and the consent and residency basis each flow relies on. We build the technical picture; the legal conclusions are settled with counsel. Localize and govern: we help you keep the regulated application and end-user data — and those secrets — in-country, on an in-country backend rather than an offshore control plane, set the Article 13/23 notice and separate-consent basis, and minimize what crosses the border. Localize means keeping the regulated data in-country; it never means a route that quietly ships personal information across the border. Deliver: we ICP-file any China-facing app or portal and stand up compliant, in-country delivery with the 21YunBox Optimizer in front of what you already run. 21YunBox never uses or suggests circumvention of any kind. Making an offshore platform merely reachable is not the answer — your app data and secrets would still be abroad and the platform would still carry China data across the border; keeping that data and those secrets in-country is. 21YunBox is a compliance overlay and partner to your Bubble stack, not a competitor to it.
Related reading:
- Cross-border data transfers under PIPL
- China’s Personal Information Protection Law (PIPL)
- China’s Cybersecurity Law
- How to get an ICP filing for China
