Does Expensify Work in China? Data Residency, ICP & Cross-Border Rules
Expensify is a cloud-only expense platform hosted on US servers — no mainland-China region, no self-hosted edition — so the receipts, reimbursement, bank and card details your China employees submit come to rest offshore as a PIPL cross-border transfer of financial records and sensitive personal information. A compliance-first look at Expensify and China's data-residency and cross-border rules.
Does Expensify work in China?
Using Expensify in China is a data-residency question, not a question of whether the app opens. Expensify is a cloud-only expense and reimbursement platform hosted on US servers, so the real issue is where your China employees' expense records are allowed to come to rest.
By Expensify's own privacy policy, the company "is based in the United States" and may "host, transfer, and process data, including Personal Data, in the United States and in other countries," and it collects "expense data, receipts" plus "current and historical financial information, such as bank account, payment card and other payment account" and mileage "geo-location data." There is no mainland-China region and no self-hosted option. So the receipts, reimbursement records, and bank and card details your China staff submit are stored offshore — a cross-border transfer of personal information that PIPL governs, and bank-account, payment-card and location data are sensitive personal information under Article 28.
This is a risk picture, not a ruling — your obligations turn on your data volumes and your role. Our China team can map your Expensify data exposure with you →
What Expensify's own documentation says about China
| Fact | Primary source |
|---|---|
| In Expensify's own words: the company "is based in the United States" and may "host, transfer, and process data, including Personal Data, in the United States and in other countries," with information submitted through the Service "stored on secure servers located in the United States of America." The privacy policy names no mainland-China region and no self-hosted or on-premise option — Expensify is a multi-tenant cloud service, so a China entity's expense reports, receipts and reimbursement records come to rest offshore. | Expensify — Privacy Policy, §13 Overseas Disclosure and §15.1.5 International and Onward Transfers of Data, retrieved 2026-10-14 |
| By its own data-collection section, Expensify holds "expense data, receipts," "current and historical financial information, such as bank account, payment card and other payment account," payroll "financial information (such as bank account and routing number, bank account balance and transaction information)," and "location-based information for the purpose of mileage tracking." These are financial records and sensitive personal information — financial-account and whereabouts data — so the stakes under China's rules are higher than for ordinary personal data. | Expensify — Privacy Policy, §3 Types of Personal Data We Collect and How It Is Collected, retrieved 2026-10-14 |
| Because Expensify stores China employees' expense and financial data on US servers, that data is transferred abroad. PIPL governs that cross-border transfer: the personal-information handler (you, the Expensify customer — not Expensify) must give notice, obtain separate consent, and meet one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. Bank-account, payment-card and location data are sensitive personal information (Article 28), which raises the bar further. | PIPL — cross-border transfer (Articles 38–40) and sensitive personal information (Article 28) |
| For a critical-information-infrastructure operator or high-volume handler, personal information collected in China must be stored inside the mainland (Cybersecurity Law Article 39 (formerly Article 37) — the 2025 amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged; PIPL Article 40). Expensify offers no China region to satisfy this, and any China-facing expense-submission surface also needs an ICP filing. | Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40; ICP filing |
Sources verified by the 21YunBox compliance team on 2026-10-14.
For a mainland-China workforce, the question to settle about Expensify is not whether an employee can open the app or submit a receipt on time — it is where the records inside it are allowed to come to rest. Expensify is an expense-management and reimbursement platform: it holds expense reports and the receipt images attached to them, and those images routinely carry employee and merchant names, card numbers, amounts, dates, and the place a purchase was made. Around them sit the reimbursement records — bank-account and routing details, payment-card data, and payroll-linked financial information — and, for mileage, the geo-location data of where staff drove. Much of that is personal information, and a good deal of it is the sensitive kind, because financial-account and whereabouts data are involved. Expensify runs all of this as a multi-tenant cloud service hosted in the United States, and there is no mainland-China region to select and no self-hosted edition to point at Chinese soil — so a China entity’s expense records come to rest offshore.
Expensify in China at a glance
| What decides it | In Expensify's own terms — and China's law |
|---|---|
| What it is | Expensify — a cloud-based expense-management and reimbursement platform. It is operated by Expensify as a multi-tenant service hosted in the United States; there is no Expensify mainland-China region and no self-hosted or on-premise edition you run from a China entity. |
| Where the records live | By Expensify's own privacy policy, the company is based in the United States and stores submitted information on US servers, hosting and processing data "in the United States and in other countries." No mainland-China region exists to select, so the expense reports, receipts, reimbursement records, and mileage data tied to your China entity come to rest offshore. |
| What it holds, and why it is personal (and sensitive) information | Expense reports and receipt images (employee and merchant names, card numbers, amounts, locations), reimbursement and payroll-linked bank-account and payment-card details, and mileage geo-location data. The identities in those records are personal information; financial-account and whereabouts data are sensitive personal information under PIPL Article 28. Held offshore, the personal data is a cross-border transfer (PIPL Articles 38–40): notice, a separate consent, and one transfer mechanism. |
| Your China data crossing the border, and the storage duty | Records sent from or about people in China to Expensify's US servers are a cross-border transfer of personal information (PIPL Article 40). In-country storage can also bite for a critical-information-infrastructure operator or high-volume handler (Cybersecurity Law Article 39 (formerly Article 37) — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged). Expensify is not "blocked"; it simply is not an in-country, China-resident option. |
| The lawful path | Whether the app loads is not the test; where the records rest is. Map the PIPL, residency, and sensitive-PI exposure; localize a consented, in-country footing for the expense, reimbursement, and bank records that must stay on mainland soil; and deliver any China-facing surface — an expense-submission portal or receipt upload — over ICP-filed, in-country infrastructure (the 21YunBox Optimizer), in front of the Expensify stack you already run. |
No mainland region, so the receipts and reimbursements leave the country
Expensify is operated as a cloud service from the United States. Its privacy policy says the company “is based in the United States” and may “host, transfer, and process data, including Personal Data, in the United States and in other countries,” and that information submitted through the Service is “stored on secure servers located in the United States of America.” There is no mainland-China region to select, and because Expensify is a multi-tenant cloud product there is no self-hosted edition to install on Chinese soil. So when a China-based employee photographs a receipt, files an expense, or enters bank details for reimbursement, that record is written to infrastructure outside the mainland. Sent from or about people in China to servers hosted offshore, that is a cross-border transfer of personal information under PIPL, and for a critical-information-infrastructure operator or a high-volume handler it can require a CAC security assessment before the data may leave.
Receipts, reimbursements, and bank details are personal — and sensitive — information
An expense platform is dense with exactly what China’s rules care most about. Expensify’s own data-collection section says it holds “expense data, receipts,” “current and historical financial information, such as bank account, payment card and other payment account,” payroll “financial information (such as bank account and routing number, bank account balance and transaction information),” and “location-based information for the purpose of mileage tracking.” Receipt images add another layer, because a photographed receipt carries the names, card digits, amounts, and the place and time of a purchase. Where those records reach bank-account, payment-card, or precise-location data, they are sensitive personal information under the Personal Information Protection Law (Article 28), which raises the bar: handling them requires a specific purpose, strict necessity, and a separate consent, and moving them across the border layers on the Article 38–40 duties of notice, a distinct cross-border consent, and one approved transfer mechanism. The duty to get the cross-border basis right falls on the handler — the business whose employees file the expenses — not only on Expensify as the vendor. None of this turns on how quickly a receipt uploads; it turns on whether that content had a lawful basis to leave the country, and whether it had to stay in the first place.
Why a reachability check misses this
A probe that confirms Expensify opens quickly from Shanghai answers a question nobody is really asking. Reachability is not the exposure here; residency is. Expensify gives you real levers to reduce what crosses — you can limit which fields employees enter, keep certain categories out of a workspace, and restrict who is onboarded — and each narrows what leaves the mainland. None of them changes that it leaves: as long as the service is hosted in the United States, a China entity’s expense and reimbursement records are crossing the border the moment they are saved. Self-hosting is not an escape either, because Expensify is a multi-tenant cloud service with no mainland-China deployment to install on local infrastructure. And ICP filing governs any China-facing surface you expose, whatever the back end — an expense portal or receipt-upload page reachable from the mainland needs an ICP filing. Because the specifics — whether you are a CII operator, which volume thresholds you cross, which transfer mechanism fits, and how the renumbered Cybersecurity Law Article 39 (formerly Article 37) bears on you — turn on facts only your team and your counsel hold, treat this page as a map of the exposure, not a ruling: settle the specifics with qualified counsel against what you actually run.
The lawful path — map, localize, deliver
Reaching a China-based workforce with an expense stack the lawful way has a shape, and it keeps Expensify where it already runs. 21YunBox is a compliant overlay, not a migration, and for a platform like Expensify we are a partner to it, not a competitor. We map your exposure first — reading the PIPL cross-border, data-residency, and sensitive-PI obligations against your entity, your data volumes, and whose information actually sits in the expense records, so you know exactly what counsel needs to confirm. We localize the records that must stay on mainland soil — standing up consented, in-country processing and storage for the receipt, reimbursement, bank-account, and payroll-linked data that cannot lawfully come to rest offshore. And we deliver every China-facing surface — the expense-submission portal, the receipt upload, the approval workflow — over ICP-filed, in-country infrastructure (the 21YunBox Optimizer), in front of the Expensify stack you already run, with no rebuild and no second codebase. The result is an expense stack that runs legally and compliantly for your people in China. 21YunBox never uses or suggests circumvention of any kind.
Related reading:
- Cross-border data transfers under PIPL
- China’s Personal Information Protection Law
- China’s Cybersecurity Law — data localization (Article 39, formerly Article 37)
- How to get an ICP filing for China
