Does Coda Work in China? Data Residency, PIPL & an Offshore Workspace
Coda keeps your team's docs — and the personal data in them — on its own offshore AWS cloud, with no mainland-China region. For a China team that makes Coda a PIPL cross-border and data-residency question before it is a speed one. A compliance-first look at the doors.
Does Coda work in China?
Coda loads in mainland China — but that is not the question. Coda keeps your team's docs, and the personal data your team types into them, on its own offshore AWS cloud with no mainland-China region. For a China team, Coda is a cross-border data problem before it is a speed one.
On its own security page Coda says it is "built from the ground up using AWS security best practices," running on "AWS CloudFront, AWS WAF, AWS security groups, and VPCs" — infrastructure that lists no region inside mainland China. Its trust/privacy link now resolves to the policy covering "Docs" (formerly known as "Coda"), whose data controller is a San Francisco company and which states plainly: "We may transfer and process your data outside of the country where you live." So the customer lists, employee records and contact tables your team keeps in Coda docs leave the mainland — a cross-border transfer of personal information PIPL governs (Articles 38–43), on servers that cannot be kept in-country. The table below pairs Coda's own wording with the rule each line triggers.
This is a risk map, not a verdict — what applies turns on your entity, your data volumes and who your users are. Our China team can map your exposure with you →
What Coda's own documentation says about China
| Fact | Primary source |
|---|---|
| Coda runs entirely on AWS, and names no mainland-China region. On its own Product security page Coda states it is "built from the ground up using AWS security best practices" and "follows AWS best practices for network security, using services like AWS CloudFront, AWS WAF, AWS security groups, and VPCs." Nowhere does it list a region inside mainland China — AWS's China regions are a separate, Chinese-operated partition a global workspace does not run in — so your docs are served from offshore cloud, not from inside the country your users sit in. | Coda — Product security (coda.io/trust/security), retrieved 2026-10-07 |
| Coda's data handling is governed by a US-based controller that moves data out of your country. Coda's own trust/privacy link now resolves to the privacy policy covering "Docs" (formerly known as "Coda"), whose listed data controller is a San Francisco company and which states: "We may transfer and process your data outside of the country where you live." For your Chinese users' personal information sitting in Coda docs, that offshore processing is a cross-border transfer under PIPL — requiring notice, separate consent and a transfer mechanism (Articles 38–43). | Coda / Superhuman — Privacy Policy reached from coda.io/trust/privacy, retrieved 2026-10-07; PIPL Articles 38–43 |
| Keeping your data in-country can be a legal duty — and Coda offers no way to meet it. Because Coda stores workspace content on offshore AWS with no mainland region to choose, personal information collected in China cannot be held inside the mainland on Coda. For a critical information infrastructure operator or a large-volume handler, that data must be stored in China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency obligation an offshore workspace structurally cannot satisfy. | Coda — Product security (coda.io/trust/security), retrieved 2026-10-07; PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| ICP usually lands on what you publish, not on the internal workspace. Coda is a tool your team signs in to, so the ICP filing a public mainland site requires (State Council Order No. 292; MIIT Order No. 33) normally attaches to any public-facing site you build — not to Coda itself. The exception: publish a Coda doc to the public for a mainland audience and that page is served from Coda's offshore hosting, with no mainland resource to file an ICP against. | Coda — Product security (coda.io/trust/security), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a team working in mainland China, the question that matters about Coda is not how quickly a doc paints — it is where that doc, and the personal data your team types into it, is allowed to live. Coda answers the first half in its own security documentation: the platform runs on AWS, and it lists no region inside mainland China. Every customer list, employee table and contact database kept in a Coda doc therefore sits on offshore cloud — reachable from China, but stored outside it. The reachability is a delivery matter; the cross-border transfer and the data residency are the compliance exposure, and they are what decide whether a mainland team may lawfully rely on Coda at all.
Coda in China at a glance
| What decides it | In Coda's own terms |
|---|---|
| Where it runs | Coda is “built from the ground up using AWS security best practices,” using “AWS CloudFront, AWS WAF, AWS security groups, and VPCs.” No region is inside mainland China; AWS's China regions are a separate, Chinese-operated partition a global workspace does not run in. |
| Who holds your data | Coda's trust/privacy link now resolves to the policy covering “Docs” (formerly known as “Coda”), whose data controller is a San Francisco company that “may transfer and process your data outside of the country where you live.” |
| Your China users' data | Customer lists, employee records and contact tables in Coda docs are personal information. Held offshore, they are a cross-border transfer PIPL governs — notice, separate consent and a transfer mechanism (Articles 38–43). |
| Serving the public | Coda is an internal workspace, so an ICP filing usually attaches to any public site you build — not to Coda. But a Coda doc published to a mainland audience is served from Coda's offshore hosting, with no mainland resource to file against. |
| Is it reachable? | Yes — the app loads from offshore AWS. The cross-border distance shows up as a slower, less predictable workspace for a mainland team, not as a block. |
Offshore by design — Coda runs on AWS, with no mainland region
Coda sets out its own infrastructure on its Product security page: the service is “built from the ground up using AWS security best practices,” and it “follows AWS best practices for network security, using services like AWS CloudFront, AWS WAF, AWS security groups, and VPCs.” What that page never lists is a region inside mainland China — and it cannot, because AWS’s mainland-China regions are a separate, Chinese-operated partition, run by local partners under a distinct account, that a global AWS workspace like Coda’s does not run in. So wherever your colleagues sit, their Coda workspace is fetched from, and stored on, cloud outside the mainland.
That settles the residency question before performance is ever reached. There is no in-country option to switch on and no mainland hosting resource underneath your workspace. If you are a critical information infrastructure operator or a large-volume handler, personal information gathered in China has to stay in China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — and an offshore workspace has nowhere to keep it. “We already run everything in Coda” is where that runs out: using the tool from China and being cleared to hold Chinese personal data in it are two different things.
Your team’s Coda docs are full of personal data — and it leaves the mainland
A Coda workspace is rarely just notes. Teams build customer tables, employee trackers, vendor contact lists and CRM-style databases inside it, and every one of those is personal information under Chinese law. Coda’s data handling is now governed by the privacy policy its own trust/privacy link resolves to — the policy covering “Docs” (formerly known as “Coda”), whose data controller is listed as a San Francisco company and which states plainly that it “may transfer and process your data outside of the country where you live.”
For your Chinese users, that offshore processing is a cross-border transfer under the Personal Information Protection Law. The handler — you, the company whose team fills the docs, not Coda — has to give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–43). None of that is something network tuning can supply; it is a lawful basis and the paperwork behind it, carried by you.
Internal workspace or published page — where ICP actually lands
Coda is primarily a tool your team signs in to, not a public-facing website, so the ICP filing a mainland site needs (State Council Order No. 292; MIIT Order No. 33) usually attaches to the public site you build — not to Coda itself. Be honest about the edge case, though: Coda can publish a doc to the open web, and if you point a mainland audience at that published page, it is served from Coda’s offshore hosting, with no in-country resource to bind an ICP filing to. The rule of thumb is to treat the internal workspace and the published surface as two separate questions, and to keep anything you publish for mainland visitors on infrastructure that can actually be filed.
Reachable, not the same as cleared
Coda is not blocked in China; it loads. But because every doc, table and automation is fetched from AWS outside the mainland, a China-based team meets it across the border — a workspace that can paint slowly and behave less predictably than it does elsewhere. That is the delivery half of the question, and it is real. It is also not the half that decides whether you may lawfully use Coda: a workspace that opened instantly would carry exactly the same cross-border-transfer and residency exposure. Speed is the symptom people notice first; the compliance duties are what actually gate the decision.
This is a risk map, not a verdict: whether you owe notice and consent, an in-country storage duty, an ICP filing on a published surface, or some combination depends on what your team keeps in Coda, how much personal data that is, and who your users are — worth settling with counsel before you commit.
Where 21YunBox fits — a compliant overlay, not a migration
You keep Coda as your team’s workspace. What we add is the layer Coda has no way to provide from offshore: a reading of the personal data your team actually holds in it, mapped against your entity and your data volumes, and — for any Coda page you publish or any public site you stand up for the mainland — ICP-filed delivery from inside the mainland, placed in front of your own origin, with no rebuild and no second codebase. Our China team works out which duties bite, handles the cross-border and residency paperwork that falls on you as the handler, and stands up the in-country, lawful presence an offshore SaaS workspace cannot. Coda stays exactly where it is.
Related reading:
