Does Commerce Layer Work in China? ICP, PIPL & an Offshore Commerce API

Commerce Layer is a headless commerce API hosted offshore on AWS, with no region inside mainland China — so your shoppers' accounts, orders and payment records sit outside the mainland under PIPL, and the storefront you build on top still needs its own ICP filing. A compliance-first look at the two doors.

By the 21YunBox Compliance Team · Reviewed 2026-10-07 · Verified against Commerce Layer's own documentation · Measured from inside mainland China

Does Commerce Layer work in China?

Whether you can use Commerce Layer in China is first a data-residency and licensing question, not a speed one. Commerce Layer is a headless commerce API — it holds the customers, carts, orders and payment records your store runs on — so where that data lives, and whether the storefront you build on top is licensed to serve the mainland, is what China's law responds to.

By its own security account Commerce Layer protects your store by "running AWS cloud services on two continents" and has achieved "SOC 2, ISO 27001, PCI DSS" certification — a hosted SaaS whose regions sit offshore, with none in mainland China. So the personal information of your China shoppers — accounts, addresses, order history and payment records — is held and processed outside the mainland: a cross-border transfer PIPL governs, needing notice, separate consent, a transfer mechanism, and for a CIIO or large-volume handler, in-country storage. Separately, because the platform is headless, the public storefront you build on the API still needs its own ICP filing to serve mainland visitors. The table below is Commerce Layer's own wording and the rules it triggers.

This is a risk picture, not a verdict — your obligations turn on your data volumes and your role. Our China team can map your Commerce Layer exposure with you →

Compliance snapshot

! Reachable from the mainland, but every cart, checkout and order call is a live round trip to an offshore API
! Holds customer, order and payment data on offshore AWS regions — the mainland is not one of them
! That offshore commerce data is a cross-border transfer of personal information PIPL governs
✕ No mainland-China region or data-residency option, and the storefront you build still needs its own ICP filing
✓ A compliant, ICP-filed in-country delivery path exists — no rebuild, no migration off Commerce Layer

Get a compliance assessment

No China entity required to start

What Commerce Layer's documentation says, and what we measured from inside China

Fact	Primary source
In Commerce Layer's own words, it secures your store by "running AWS cloud services on two continents" and has achieved "SOC 2, ISO 27001, PCI DSS" certification — including a "full PCI DSS Level 1 provider certification" with "tokenization of sensitive payment information." It is a hosted SaaS commerce API, and none of its regions is in mainland China.	Commerce Layer — Our commitment to trust and security, retrieved 2026-10-07
Commerce Layer stores the personal information a store is built on — customer accounts, shipping and billing addresses, order history and payment records. Held on its offshore AWS regions, data gathered from shoppers in China leaves the country. PIPL governs that cross-border transfer: the personal-information handler (you, the merchant — not Commerce Layer) must give notice, obtain separate consent, and satisfy one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification.	PIPL Chapter III, Articles 38–43
For a CIIO or large-volume handler, personal information collected in China must be stored inside mainland China (CSL Article 39 (formerly Article 37); PIPL Article 40). Commerce Layer publishes no mainland-China region, so keeping that commerce data on Chinese soil means running the storage on infrastructure inside the mainland. And because the platform is headless, the public storefront you build on it is the property that must carry an ICP filing to serve mainland visitors — the API does not supply one.	PIPL Article 40; CSL Article 39 (formerly Article 37); State Council Order No. 292; MIIT Order No. 33
The exposure scales with volume, not merely with using the platform: under the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification — but payment data is sensitive personal information, which carries stricter thresholds, and a live store's order flow reaches volume quickly.	CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024
Reachability is a delivery matter, not the compliance question. Requested from a probe inside mainland China (Alibaba Cloud `cn-zhangjiakou`) on 2026-08-28, Commerce Layer answered and finished loading on all 3 attempts — median time to first byte 629ms, largest-contentful-paint 3,732ms. It is reachable; but because the platform is a live API, every cart, checkout and order call is still a round trip to those offshore regions, and what decides whether you may use it is where the commerce data lives and whether your storefront is ICP-filed.	21YunBox — 280-site China delivery census, measured from inside mainland China

Sources verified by the 21YunBox compliance team on 2026-10-07.

For a store selling into mainland China, the deciding question about Commerce Layer is not how quickly its API answers — it is where your shoppers’ data is allowed to live, and whether the storefront you serve them is licensed to operate inside China. Commerce Layer is a headless commerce platform: it holds the customers, carts, orders and payment records, and your own front end calls it over the network. By its own security account that back end runs on AWS across two continents, and it publishes no region inside mainland China. The API is reachable from the mainland; the data residency and the licensing are the exposure.

Commerce Layer's trust and security page describing the platform running AWS cloud services on two continents and holding SOC 2, ISO 27001 and PCI DSS certifications, with no mainland-China region — Commerce Layer's own security commitment: it protects your store by “running AWS cloud services on two continents” and has achieved “SOC 2, ISO 27001, PCI DSS” certification — a hosted commerce API whose regions sit offshore, with none in mainland China. Source: commercelayer.io/blog

Commerce Layer in China at a glance

What decides it	In Commerce Layer's own terms
Where it runs	A hosted, API-first SaaS. In Commerce Layer's words it runs by “running AWS cloud services on two continents”; its regions sit offshore and none is in mainland China.
What it holds	The data a store is built on — customer accounts, shipping and billing addresses, order history, and payment records it tokenizes and orchestrates (“full PCI DSS Level 1 provider certification”).
Serving the public	Commerce Layer is headless — the API back end. The public storefront you build on it and serve to mainland visitors is what needs an ICP filing, tied to a mainland hosting resource. The API supplies none.
Your shoppers' data	Held on offshore AWS regions, personal information collected from China shoppers is a cross-border transfer PIPL governs — with in-country storage duties for CIIOs and large-volume handlers that offshore regions cannot meet.
Is it reachable?	Yes — it answered and finished loading on every attempt measured from inside mainland China. But each cart, checkout and order call is a live round trip to those offshore regions.

A headless API, served from offshore

Commerce Layer is reached, not blocked. In 21YunBox’s own measurements from inside the mainland it answered and finished loading on every attempt, so the Great-Firewall question people ask first is not where the risk sits. The architecture is the point instead: Commerce Layer is API-first, so a storefront does its work through live calls — list a product, add to cart, price an order, take a payment — and each of those calls travels to Commerce Layer’s offshore AWS regions and back. By its own security account the platform runs on AWS across two continents and publishes no region inside mainland China. Reaching an offshore API is not the same as being resident in China, and tuning the network moves neither the data nor the region.

Your shoppers’ data crosses the border

Serve China from Commerce Layer and the personal information a store is built on — customer accounts, shipping and billing addresses, order history, and the payment records it tokenizes and orchestrates — is held and processed on those offshore regions. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, the merchant, not Commerce Layer — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. Payment and order data raise the stakes, because payment information is sensitive personal information under Chinese law — it carries stricter cross-border thresholds, and a live store reaches real volume quickly. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty no offshore region can satisfy. Commerce Layer’s PCI, SOC 2 and ISO 27001 posture is real security engineering; it is a different thing from Chinese data residency, which is about where the data physically sits.

The storefront, not the API, is what carries the ICP filing

Because Commerce Layer is headless, the piece that faces mainland visitors is the storefront you build and host yourself, and that is the property an ICP filing (ICP 备案) attaches to under State Council Order No. 292 and MIIT Order No. 33. The filing must be tied to a hosting resource physically inside the mainland — something a storefront served from offshore does not have, and something the Commerce Layer API neither supplies nor stands in for. So “our commerce runs on Commerce Layer” settles the back end but not the front door: a public store open to shoppers in China still needs its own licensed, in-country delivery.

This is a risk map, not a verdict: whether you need an ICP filing, in-country storage, or both turns on what you sell, how much personal data you hold, and who your shoppers are — worth settling with counsel before you build.

Where 21YunBox fits — a compliant overlay, not a migration

You keep building on Commerce Layer’s API. We add the parts a headless, offshore platform leaves to you: compliant, ICP-filed delivery from inside the mainland for the storefront you serve to China, set in front of your existing setup — no rebuild, no second codebase, and no move off Commerce Layer. Our China team maps your ICP and cross-border obligations against your entity and your order and customer volumes, then stands up the in-country delivery and, where the law requires it, the in-country storage a lawful China store needs — while your Commerce Layer back end stays exactly where it already runs.

Get a compliance assessment →

Related reading:

Frequently Asked Questions

Does Commerce Layer store Chinese shoppers' data in China?

No. By its own security documentation Commerce Layer runs on AWS "on two continents," and it publishes no mainland-China region. So the accounts, addresses, orders and payment records of your China shoppers are held and processed offshore — which is what makes it a cross-border transfer of personal information under PIPL.

Does using Commerce Layer give our store an ICP filing?

No. Commerce Layer is a headless commerce API — the back end. The public storefront you build and serve to mainland visitors is the property that needs an ICP filing, and that filing has to attach to a hosting resource inside mainland China. The API neither supplies nor replaces it; serving the storefront compliantly from inside China is a separate step.

Can 21YunBox help make our Commerce Layer store compliant in China?

Yes. Our China team can assess your cross-border and data-residency exposure for your data volumes and role, stand up the compliant, ICP-filed in-country delivery for the storefront you build on Commerce Layer, and — where the law requires your China shoppers' data to stay on the mainland — in-country storage, all without moving off Commerce Layer's API. Get in touch to work through your specific case.