Does Figma Work in China? Data Residency, ICP & Cross-Border Rules
Figma's design corpus — product IP, unreleased UI and the PII embedded in mockups, plus every collaborator's identity — sits offshore: Figma's Data Residency Solution names no mainland-China region. A PIPL cross-border and residency matter, plus an ICP duty for any China-facing published surface.
Does Figma work in China?
Whether Figma “works” in China is a compliance question before it is a performance one: your entire design corpus — product IP and the personal data embedded in mockups and screenshots — lives on an offshore Figma tenant with no mainland-China region.
Figma's own Data Residency Solution lets Enterprise customers host data in the US, EU, Australia, India, Brazil, Japan or Canada and names no region in mainland China; its sub-processor page puts customer content on AWS in the “United States (or, for Enterprise plans, the hosting location selected).” So the corpus and your collaborators' PII cross the border continuously — a PIPL cross-border transfer under Articles 38–40 with Article 13/23 notice and consent — and any China-facing published prototype or site is a public internet service carrying an ICP filing duty. A reachability check sees none of this.
This is a residency-and-consent risk map, not a verdict — your duties turn on your entity, data volumes and what your files hold. Our China team can map your Figma footprint with you →
What Figma's own documentation says about China
| Fact | Primary source |
|---|---|
| Figma's Data Residency Solution lets Enterprise customers host data locally — in its own words, “You can host your relevant Figma data locally in the following regions: EU, Australia, India and Brazil,” with the full regional table adding the US, Japan and Canada. It names no region in mainland China, and the feature is “only available to customers on the Figma Enterprise plan.” So wherever you pin it, a China team's design corpus is hosted offshore. | Figma Help Center — Enable localized file hosting (Data Residency Solution), retrieved 2026-10-12 |
| Figma's sub-processor list names “Amazon Web Services, Inc.” as its “Cloud infrastructure provider” for “All Services,” handling “Customer Content” in the “United States (or, for Enterprise plans, the hosting location selected).” Every location on that list is offshore — none is in mainland China — so your files, prototypes and comments rest abroad by default. | Figma — Sub-processors, retrieved 2026-10-12 |
| Hosting a China team's design corpus and collaborator PII offshore is a cross-border transfer (数据出境) under PIPL Articles 38–40 — requiring a CAC security assessment, the CAC standard contract or certification — on top of the Article 13/23 notice and separate consent. For a critical information infrastructure operator or high-volume handler, Cybersecurity Law Article 39 (formerly Article 37) requires China-collected personal information to be stored in the mainland. | PIPL Arts 13, 23, 38–40; Cybersecurity Law Art 39 (formerly Art 37) |
| Any public, China-facing surface you publish from Figma — a shared prototype, an embed, or a site published with Figma's web-publishing tools — is an internet information service and carries an ICP filing (备案) duty bound to a mainland hosting resource. Figma gives you no in-country, ICP-filed delivery path of its own; an in-country deployment in front of what you publish can. | PRC ICP filing regime (State Council Order No. 292; MIIT Order No. 33) |
Sources verified by the 21YunBox compliance team on 2026-10-12.
For a company running Figma for a mainland-China team, the question that matters is not whether the editor paints quickly from Shanghai. Figma is where your design corpus lives: the product designs, the unreleased UI, the brand assets, the prototypes, and the comments and screenshots gathered around them — business-sensitive intellectual property and, embedded inside those mockups and screenshots, the personal data of the people they depict. Run on an offshore tenant, that entire corpus — your IP and that embedded PII together — sits abroad and crosses the border every time a mainland designer opens a file. Figma’s own Data Residency Solution lets Enterprise customers pin that data to the US, the EU, Australia, India, Brazil, Japan or Canada — and names no region in mainland China; its sub-processor list places customer content on Amazon Web Services in the “United States (or, for Enterprise plans, the hosting location selected).” We make no claim here about whether the editor is reachable from any given mainland network on any given day — the compliance exposure stands either way, because the corpus and the PII rest offshore with no in-country option, and because any design or prototype you publish for a China audience is a public internet service in its own right.
Figma in China at a glance
| What decides it | In Figma's own terms — and China's law |
|---|---|
| What it holds | Your design corpus: product designs, unreleased UI, brand assets, prototypes, and the comments and version history around them. That is business-sensitive IP — and, embedded in mockups and screenshots, real names, emails, user photos and ID images. Add the identities of every collaborator (names, emails, accounts) and you have IP and personal data in one place. |
| Offshore only — no mainland region | Figma is cloud SaaS. Its Data Residency Solution is Enterprise-only and lets you pin data to the US, EU, Australia, India, Brazil, Japan or Canada; the sub-processor list puts customer content on AWS in the “United States (or, for Enterprise plans, the hosting location selected).” No listed region is in mainland China, and there is no in-country or self-hosted edition. Wherever you pin it, the corpus is offshore. |
| IP + embedded PII — the distinctive second half | The half a reachability check never sees. Your design corpus is at once a store of competitively sensitive IP (unreleased product, brand work) and a store of personal data that collects quietly inside mockups and screenshots. Held on an offshore tenant, both travel together across the border every working day — something a page-load test cannot observe. |
| Residency & cross-border | Hosting a China team's corpus and collaborator PII offshore is a cross-border transfer (数据出境) under PIPL Articles 38–40, on top of the Article 13/23 notice and separate consent. For a critical information infrastructure operator or high-volume handler, Cybersecurity Law Article 39 (formerly Article 37) requires China-collected personal information to be stored in the mainland — which an offshore tenant cannot satisfy. |
| Sensitive PI & the ICP door | Where mockups or screenshots carry real faces, ID images or contact details, that content can be sensitive personal information under PIPL Articles 28–29 — a risk to confirm against what your files hold. And any public, China-facing surface you publish from Figma — a shared prototype, an embed, or a published site — is an internet information service carrying an ICP filing duty bound to mainland hosting. |
| Reachability is not the axis | Whether the editor loads from the mainland is operational, not the compliance question. What decides it is where the design corpus and PII live and how any published surface is served. 21YunBox helps you keep that content in-country or in a China-resident alternative, secure the consents, file the ICP for any China-facing surface, and deliver it compliantly — the 21YunBox Optimizer — in front of what you already publish. |
What it actually holds — your design corpus and the people inside it
Figma is not a brochure site; it is the working home of your design corpus, and that corpus is two sensitive things at once. It is intellectual property: unreleased product direction, UI that has not shipped, brand systems, and the prototypes and version history that show how a product is being built. And it is a store of personal data — not only the collaborators themselves (the names, emails and account identities of your mainland designers, reviewers and invited stakeholders), but the personal data that accumulates, often unnoticed, inside the work: a screenshot with a real customer’s name, a mockup populated with genuine user photos, an onboarding flow drawn with a real ID card. Wherever those records name or depict a person, they are personal information under China’s Personal Information Protection Law, and where they include faces or identity documents they may be sensitive personal information. Whether that combined store of IP and PII lives in the mainland or offshore is decided by where Figma hosts it — and, by Figma’s own documentation, the available regions are all offshore.
The doors: residency, cross-border, sensitive PI and ICP
Put a China team’s work on an offshore Figma tenant and the first door opens. The design files, comments and collaborator identities in that tenant rest abroad, which makes it a cross-border transfer (数据出境). The duty lands on you, the handler, not on Figma: PIPL Articles 13 and 23 require notice and a basis to collect the data, and Articles 38–40 require a transfer mechanism to send it offshore — a CAC security assessment, the CAC standard contract, or certification — with separate consent for the overseas transfer. And for a critical information infrastructure operator or a high-volume handler, the Cybersecurity Law’s Article 39 (formerly Article 37 — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, its substance unchanged) requires personal information generated in China to be stored in the mainland, which an offshore tenant cannot satisfy.
The embedded personal data opens a quieter, sharper door. A design corpus is where real people leak into the work: a screenshot of a live account, a mockup filled with genuine names and photos, a flow drawn around a real identity document. Where that content carries faces, ID images or other identifying detail, it can be sensitive personal information under PIPL Articles 28–29, which demand a specific purpose, heightened necessity and separate consent. This is a risk to map against what your files actually contain rather than a verdict to assert — but it is exactly the exposure a reachability check cannot see, because it is about what the files hold, not whether they open.
A third door follows from publishing. The moment you expose a public, China-facing surface from Figma — a shared prototype link, an embedded design, or a site published with Figma’s web-publishing tools — that surface is an internet information service and carries an ICP filing (备案) duty bound to a mainland hosting resource. A private design file shared inside your team may not trigger ICP on its own; a design, prototype or site published to mainland visitors does, and Figma gives you no in-country, ICP-filed way to serve it.
Why a reachability check misses this
A probe from inside China can watch the Figma canvas load and conclude “it works.” That answer is beside the point. The compliance exposure is not on the screen — it is in the data at rest and how it moves: the design corpus, the comments, the collaborator identities and the personal data embedded in the files, all sitting on an offshore tenant in a region Figma lists as the US, EU, Australia, India, Brazil, Japan or Canada — never mainland China. A page-load test measures none of that. It cannot see which region the data lives in, whether separate consent was taken, whether a transfer mechanism is in place, or that a published prototype served to mainland users needs an ICP filing. That is the competitor-proof second half of the question — and it is why making an offshore Figma tenant merely reachable from the mainland is not the answer. Keeping the regulated corpus and PII in-country, and serving any China-facing surface compliantly, is.
The lawful path — map, localize, deliver
There is a compliant way to run Figma for a mainland-China team, and it sits in front of the work you already do — no rebuild, no migration off Figma.
First, map: our China compliance team inventories what your Figma footprint holds — the design corpus, the comments and version history, the collaborator identities, the personal data embedded in mockups and screenshots, and any China-facing prototype, embed or published site — establishes where it is hosted today (an offshore Figma region), the ICP status of any published surface, and the consent and residency basis each flow relies on. We build the technical picture; the legal conclusions are settled with counsel.
Then localize: keep the regulated content and collaborator PII on a China-resident path — in-country, or in a China-resident design and collaboration alternative where the law requires the data to stay in the mainland — obtain the Article 13/23 notice and separate consent, treat any faces or ID images in mockups as sensitive personal information, and minimize the personal data that goes into shared files in the first place. Localize means keeping the data on an in-country path — never a route that ships it offshore anyway, and never any form of circumvention.
Then deliver: any public, China-facing surface you publish is an internet information service, so it carries an ICP filing duty and needs compliant, in-country delivery. 21YunBox delivers it in-country — the 21YunBox Optimizer — in front of the prototype, embed or site you publish, so it runs legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind — we keep in-country what the law says must stay, deliver the rest compliantly from inside the mainland, and never move personal information across the border by stealth. 21YunBox is a compliance overlay and partner to the design platform you already run, not a competitor to it.
None of this is a verdict that Figma is “blocked” or “illegal” in China. It is a residency-and-consent map, and which duties bite your case turns on your entity, your role under Chinese law, your data volumes, and what your design files and published surfaces actually hold — worth settling the specifics with counsel before your China team’s design corpus depends on it.
Related reading:
- How to get an ICP filing for China
- Cross-border data transfers under PIPL
- China’s Personal Information Protection Law (PIPL)
- China’s Cybersecurity Law (data localization, Article 39)
