Does commercetools Work in China? Data Residency, ICP & Cross-Border Rules

For a brand running commercetools to sell into mainland China, the deciding question is not how quickly the storefront paints from Shanghai. It is where your data is allowed to live, who is licensed to move the money, and whether the storefront can be filed — because commercetools is the system of record for your China commerce. It holds the accounts of every China shopper you serve, their carts and orders, their shipping and billing addresses, the payment references kept against each transaction, and the catalog, prices and promotions behind the buying experience. commercetools is offshore composable-commerce SaaS: by its own documentation its Regions run on Google Cloud and AWS in North America, Europe and Australia, with none inside mainland China — so all of that is held and processed abroad. And because this is commerce, two further doors open that a reachability check never sees: a China-facing storefront is an internet information service that must be ICP-filed to mainland hosting, and collecting payment from mainland shoppers is a licensed activity that a foreign commerce platform cannot perform itself. That makes this a compliance-risk question first, not a performance one.

commercetools in China at a glance

What it actually holds — your China commerce, and the money path

commercetools is not a static asset like a font or a script; it is the commercial core of your China storefront, and it concentrates exactly the kinds of data and activity China’s law cares about. On the data side it holds personal and commercial information: the accounts of your China shoppers, their carts and orders, their shipping and billing addresses, the payment references kept against each transaction, and the catalog, prices and promotions behind the buying experience. On the activity side — the half a reachability check never sees — it sits at the center of two regulated flows: it powers a China-facing storefront that must be filed, and it orchestrates the collection of money from your China shoppers. Because commercetools is offshore composable-commerce SaaS whose Regions run on Google Cloud and AWS in North America, Europe and Australia, the customer and order data rests abroad by default; because a storefront served from those Regions has no mainland hosting, it has no ICP footing; and because commercetools is not a licensed Chinese payment institution, the money it orchestrates has to settle over a licensed domestic channel. None of the three is answered by the app loading quickly.

The doors: the storefront’s ICP filing, the payment license, and data residency

The first door is the one a composable storefront makes unavoidable, and it is where a reachability check is most blind. A storefront you serve to shoppers in mainland China is a public internet information service, and operating one turns on an ICP filing (ICP 备案) duty bound to a hosting resource physically inside the mainland. In a composable setup the front end calls commercetools’ APIs, but whatever renders the catalog, cart and checkout to China shoppers has to stand on mainland hosting to be filed — and a storefront served from commercetools’ offshore Regions offers no ICP footing of its own. Making the APIs merely reachable does not create the mainland footing a filing needs.

The second door is the one that makes a commerce platform different from an ordinary SaaS: commerce moves money. Collecting payment from customers in China is a licensed activity. Under China’s Regulations on the Supervision and Administration of Non-Bank Payment Institutions (State Council Order No. 768, in force May 1, 2024), providing payment services in China requires a payment business license (支付业务许可); Article 2 requires an offshore institution intending to provide cross-border payment services to users in China to establish a non-bank payment institution within China, and Article 19 requires domestic transaction processing, fund settlement and data storage to happen inside China. commercetools models each payment as a transaction and integrates payment service providers, but it orchestrates collection rather than being the licensed institution that settles the funds — so the actual money movement for your China shoppers must run over a licensed domestic payment path, with commercetools sitting on top of it. Treat the specifics as a question for qualified counsel, not a settled classification — but note that a speed test answers none of it.

The third door is personal-information residency. The shopper accounts, carts, orders, addresses and payment references your commercetools project collects from people in China are personal information under China’s Personal Information Protection Law, and holding them in an offshore Region is a cross-border transfer (数据出境). The duty lands on you, the handler, not on commercetools: Articles 13 and 23 require notice and a basis — with separate consent where it applies — to collect and transfer the data, and Articles 38–40 require a lawful transfer mechanism to send it abroad: a CAC security assessment, the CAC standard contract, or certification. Order and payment detail tied to an identified shopper can rise to sensitive personal information, where Articles 28–29 add a specific-purpose, necessity and separate-consent test. And for a critical information infrastructure operator or a high-volume handler, the Cybersecurity Law’s Article 39 (formerly Article 37 — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, its substance unchanged) requires personal information generated in China to be stored in the mainland, which an offshore Region cannot satisfy.

A reachability check never sees this

commercetools is not the kind of service that simply refuses to load in China — the exposure is quieter and more durable than a slow paint. Even if the storefront and checkout opened instantly, using them would still place your China shoppers’ accounts, orders and payment references outside the country, would still leave a China-facing storefront without an ICP filing, and would still route the money through a channel that, offshore, is not licensed to move it in China. A reachability test answers “did the page come back?”; it is blind to where the order and payment data come to rest, to whether the storefront can be filed, and to who is lawfully allowed to move the money. Where the data lives, whether the storefront is filed, and who holds the payment license — not how fast the page arrives — is what China’s law responds to.

This is a risk map, not a verdict that commercetools is “blocked” or “illegal” in China. Which duties bite your case turns on your entity, what your project actually holds, your role under Chinese law, your data volumes, and how your China storefront is served and paid — worth settling the specifics with counsel before your China revenue depends on it.

The lawful path — map, localize, deliver

There is a compliant way to run a composable commerce storefront for a China operation, and it sits in front of the commercetools your team already uses — no rebuild, no second system, no migration.

First, map: our China team inventories what your commercetools project holds — the shopper accounts, carts, orders, addresses and payment references, the catalog and prices, and any China-facing storefront — establishes where it is hosted (an offshore commercetools Region on Google Cloud or AWS), the ICP status of the storefront, and the consent, residency and payment-licensing basis each flow relies on. We build the technical picture; the legal conclusions are settled with counsel.

Then localize/govern: we help you keep the regulated data — China shopper, order and payment-related personal information — on a lawful in-country path, obtain the Article 13/23 notice-and-consent, honor the Articles 38–40 transfer basis for anything that must still move abroad, and route the actual money movement through a licensed domestic payment path and settlement rather than an offshore channel. Localize means keeping the data and the money path in-country — never a route that quietly ships either across the border.

Then deliver: a public China-facing storefront is an internet information service, so it carries an ICP filing duty bound to mainland hosting and needs compliant, in-country delivery. 21YunBox stands that up — the 21YunBox Optimizer — in front of what you already run, so your storefront serves users in China legally and compliantly. 21YunBox never uses or suggests circumvention of any kind — we keep in-country what the law says must stay, deliver the rest compliantly from inside the mainland, and never move personal information across the border by stealth. Making an offshore project merely reachable is not the answer; keeping the regulated data in-country, filing the storefront, using a licensed domestic payment path and delivering it compliantly is. 21YunBox is a compliance overlay and partner to the commerce platform you already run, not a competitor to it.

Get a compliance assessment →

Related reading:

• How to get an ICP filing for China
• Regulations on Non-Bank Payment Institutions (Order No. 768)
• Cross-border data transfers under PIPL
• China’s Personal Information Protection Law (PIPL)
• China’s Cybersecurity Law

RELATED TECHNOLOGIES

Adobe Experience Cloud

Adobe Experience Cloud

Adobe Experience Platform

Adobe Experience Platform

Salesforce Commerce Cloud

Salesforce Commerce Cloud

SAP Commerce Cloud

SAP Commerce Cloud