Does Cognito Forms Work in China? PIPL, Data Residency & an Offshore Form
Cognito Forms embeds your form on your site and stores every entry on Microsoft Azure in US datacenters — no mainland-China region. For China visitors each submission is a cross-border transfer of personal data under PIPL, plus a data-residency question. A compliance-first look at reachability and where your entries live.
Does Cognito Forms work in China?
Whether you can use Cognito Forms in China is first a question of where the entries your visitors submit are allowed to live — not how fast the form paints. Cognito Forms embeds your form on your page and stores every entry it collects, so the deciding fact is where that data is held.
Cognito Forms answers that in its own Privacy Policy: "All customer data, and the servers that process this data, are securely managed by Microsoft Azure, geo-replicated in real time to multiple datacenters in the US," and "Our servers and data are securely stored in geo-redundant datacenters in the United States." It also tells you who carries the obligation for what your forms gather: it has "no direct relationship with your customers, so you are responsible for making sure you have obtained the appropriate permission for us to collect and process information about these individuals." So entries submitted by your China visitors leave the country the moment they are sent — a cross-border transfer of personal information that PIPL governs. The table below is Cognito Forms' own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on what your forms collect, your data volumes and your role. Our China team can map your Cognito Forms exposure with you →
Compliance snapshot
- ! Reachable, but your form is embedded as offshore JavaScript served from US datacenters — every render is a cross-border round trip
- ! The entries your visitors submit — names, emails, whatever a form collects — are stored as "customer data" on Microsoft Azure in the US
- ! Storing China respondents' entries offshore is a cross-border transfer of personal information — PIPL applies
- ✕ No mainland-China region; Cognito Forms' own cross-border framework covers the EU, UK and Switzerland, not China
- ✓ A compliant, ICP-filed in-country delivery and storage path exists — no rebuild, no migration
What Cognito Forms's own documentation says about China
| Fact | Primary source |
|---|---|
| In Cognito Forms' own words: under "Cognito-Managed Third Parties → Hosting," its Privacy Policy states "all customer data, and the servers that process this data, are securely managed by Microsoft Azure, geo-replicated in real time to multiple datacenters in the US." Under "We Operate in the United States" it adds that "our servers and data are securely stored in geo-redundant datacenters in the United States." There is no mainland-China region — the embedded form and the entries it collects both sit offshore. | Cognito Forms — Privacy Policy (Hosting; "We Operate in the United States"), modified 29 May 2026, retrieved 2026-10-08 |
| Cognito Forms draws a clear line between its own data and the data you collect through your forms: "You are responsible for obtaining consent and maintaining any personal information you collect with your forms," and because it has "no direct relationship with your customers," "you are responsible for making sure you have obtained the appropriate permission for us to collect and process information about these individuals." In PIPL terms that makes you, the form owner, the personal-information handler — not Cognito Forms. | Cognito Forms — Privacy Policy (Data Collected by You), modified 29 May 2026, retrieved 2026-10-08 |
| Cognito Forms' published cross-border framework is built for Europe, not China. It states it "participate[s] in the EU-U.S. & Swiss-U.S Data Privacy Frameworks to meet the privacy adequacy provisions of the GDPR," and that it "complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF)." It publishes no equivalent mechanism for mainland China — so a transfer of your China respondents' data is left to PIPL, and to you as the handler. | Cognito Forms — Privacy Policy (Data Transfers from the EU, the UK and Switzerland to the United States), modified 29 May 2026, retrieved 2026-10-08 |
| Because the entries and contact details collected from users in China are stored on US servers, they leave the country. PIPL governs that cross-border transfer: the handler — you, Cognito Forms' customer — must give notice, obtain separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside mainland China (CSL Article 39 (formerly Article 37); PIPL Article 40). Cognito Forms stores all customer data in US datacenters and publishes no mainland-China region, so keeping your China respondents' entries on Chinese soil means running that collection and its storage on infrastructure inside the mainland — which is where an ICP filing enters the picture. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-08.
For a mainland-China audience, the deciding question about Cognito Forms is not how quickly a form paints — it is where the entries your visitors type into that form are allowed to live. Cognito Forms answers that in its own Privacy Policy: all customer data is stored on Microsoft Azure in datacenters in the United States, and it runs no region inside mainland China. A China-facing form is therefore reachable but entirely offshore — it is embedded from abroad, and every entry it collects is stored abroad. The reachability is real; the cross-border transfer of personal information and the missing data residency are the exposure.
Cognito Forms in China at a glance
| What decides it | In Cognito Forms' own terms |
|---|---|
| Where it runs | “All customer data, and the servers that process this data, are securely managed by Microsoft Azure, geo-replicated in real time to multiple datacenters in the US.” No region is inside mainland China, so both the embedded form and the entries it collects sit offshore. |
| What it collects from your visitors | Whatever your form asks for. Cognito Forms notes that “you may collect a wide variety of information from your customers using the forms you create with our service” — names, emails and potentially sensitive details, all held as “customer data.” |
| Who is responsible | Cognito Forms states it has “no direct relationship with your customers, so you are responsible for making sure you have obtained the appropriate permission for us to collect and process information about these individuals” — so under PIPL you are the personal-information handler. |
| Your respondents' data residency | Stored in US datacenters; no mainland-China option. A CIIO or large-volume handler must keep China-collected personal information inside the mainland (PIPL Art. 40; CSL Art. 39 (formerly Art. 37)). |
| Is it reachable? | Yes, but the form is JavaScript embedded from Cognito Forms' US-hosted service, so it renders only when a visitor's browser completes an offshore round trip; there is no mainland origin behind it to fall back on. |
Reachable, but every form is embedded from offshore
Cognito Forms works by embedding your form on your page — a small piece of JavaScript pulls the form from Cognito Forms’ own service. That service, in its words, keeps “all customer data, and the servers that process this data” on “Microsoft Azure, geo-replicated in real time to multiple datacenters in the US.” Nothing on that path touches mainland China. For a China audience the practical consequence is that the form appears only when a visitor’s browser can complete a round trip to that offshore service — there is no in-country origin to serve it instead. It is not blocked; it is answered from abroad, which makes rendering a function of an offshore connection rather than a given. But reachability was never the compliance question. The next two doors are.
Your respondents’ entries cross the border
The moment a visitor in China submits a form, the details they entered — name, email, and whatever else the form asks for — are sent to and stored on Cognito Forms’ US servers. They leave the country. Under China’s Personal Information Protection Law that is a cross-border transfer, and the obligations fall on the handler. Cognito Forms is explicit about who that is: it has “no direct relationship with your customers,” so “you are responsible for making sure you have obtained the appropriate permission for us to collect and process information about these individuals.” In PIPL terms the handler is you, the form owner, not Cognito Forms — so you are the one who must give notice, obtain separate consent for the transfer, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. It is worth noting that Cognito Forms’ own published cross-border framework — the EU-U.S., UK and Swiss-U.S. Data Privacy Frameworks — is built for Europe; it offers no equivalent mechanism for China.
Residency — where the entries are allowed to live
For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored inside the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40). Cognito Forms publishes no mainland-China server — its own policy says “our servers and data are securely stored in geo-redundant datacenters in the United States” — so there is no setting that keeps your China respondents’ entries on Chinese soil. Meeting a residency duty means running the collection and its storage on infrastructure inside the mainland.
This is a risk map, not a verdict: whether you face a cross-border-transfer duty, an in-country storage duty, or both depends on what your forms collect, how much personal data you hold, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building and embedding with Cognito Forms exactly as you do now. What an offshore form cannot give you, we add alongside it: compliant, ICP-filed delivery from inside mainland China, placed in front of the site that carries your form — no rebuild, no second codebase, and no move off Cognito Forms. Our China team weighs your PIPL cross-border and data-residency obligations against your entity and your data volumes, then stands up in-country delivery and — where the law requires your China respondents’ entries to stay on the mainland — in-country storage, so your lawful China presence rests on infrastructure that belongs inside the border.
Related reading:
Frequently Asked Questions
Where does Cognito Forms store the entries my visitors submit?
In the United States. Its Privacy Policy states that "all customer data, and the servers that process this data, are securely managed by Microsoft Azure, geo-replicated in real time to multiple datacenters in the US," and that "our servers and data are securely stored in geo-redundant datacenters in the United States." Cognito Forms publishes no mainland-China region, so the names, emails and any other details your China visitors submit through a form are stored offshore.
Is it against the law to use Cognito Forms in China?
Not inherently. The exposure is the cross-border transfer of the personal information your forms collect, which PIPL permits if you give notice, obtain separate consent and satisfy one of its transfer mechanisms. Whether you also face a data-localization duty depends on your role — for example whether you are a critical information infrastructure operator — and the volume of personal information you handle. Treat it as a risk to confirm with counsel, not a blanket prohibition.
Can 21YunBox help make our Cognito Forms setup compliant in China?
Yes. Our China team can assess the cross-border and data-residency exposure for what your forms collect and your data volumes, and stand up compliant, ICP-filed in-country delivery — and, where the law requires your China respondents' data to stay on the mainland, in-country storage. Get in touch to work through your specific case.
