Does Formstack Work in China? Data Residency, PIPL & Where Your Submissions Land
Formstack stores form submissions on AWS in the United States and publishes no mainland-China region — so every submission from a Chinese user is a cross-border transfer of personal information under PIPL, with your organization as the Controller. A compliance-first look at the real exposure.
Does Formstack work in China?
Formstack is reachable in mainland China, but using it to collect data from Chinese users is a cross-border personal-data question, not a speed one. Formstack stores every form submission on AWS in the United States and publishes no mainland-China region — so a submission from a Chinese user leaves the country the moment it is saved.
In its own security documentation Formstack states it "uses AWS in the United States as our external security hosting provider," replicating stored data only "from US-East Region to US-West Region," and that "your organization owns the submission data" and "is the Controller." Collect from mainland residents and you — the Controller, in Formstack's own words — are making a cross-border transfer of personal information PIPL governs, to servers that sit entirely outside the mainland with no in-country region to fall back on. The table below is Formstack's own wording and the rule each line triggers.
This is a risk map, not a verdict — whether PIPL's transfer rules, a data-residency duty, or a survey approval apply turns on your data, your volumes and who your users are. Our China team can map your exposure with you →
What Formstack's own documentation says about China
| Fact | Primary source |
|---|---|
| Formstack stores your form data on AWS in the United States — there is no mainland-China region. In its own security documentation Formstack states it "uses AWS in the United States as our external security hosting provider," and that "all data stored on our AWS S3 is replicated consistent from US-East Region to US-West Region" — both United States regions. Nowhere does Formstack publish a mainland-China location, so data collected from Chinese users is stored offshore by design. | Formstack — Data Privacy and Security for Forms (formstack.com/data-security), retrieved 2026-10-07 |
| Formstack puts the compliance duty on you, not on the vendor. In its own words, "your organization owns the submission data and file upload data," and "your organization is the Controller." Under Chinese law the party that decides the purpose and means of handling personal information is the handler who carries the obligations — so when a mainland resident submits a Formstack form, the cross-border transfer duties under PIPL (notice, separate consent and a lawful transfer mechanism, Articles 38–43) fall on you as the Controller, not on the form builder. | Formstack — Data Privacy and Security for Forms (formstack.com/data-security), retrieved 2026-10-07; PIPL Articles 38–43 |
| Every submission from a mainland user is a cross-border data transfer. Because the data lands on US-based AWS, the personal information a Chinese user enters in a Formstack form — names and contact details, and on HIPAA- or PCI-scoped forms, health or payment data — leaves the mainland the instant it is saved. That is a cross-border transfer of personal information under PIPL, requiring notice, separate consent and one of a CAC security assessment, the CAC standard contract, or certification (Articles 38–43); and for a critical information infrastructure operator or large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — which an all-US footprint cannot satisfy. | Formstack — Data Privacy and Security for Forms (formstack.com/data-security), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
| A Formstack-hosted form page is served from offshore, so it cannot be ICP-filed. If you collect through a Formstack-hosted form URL rather than an embed on your own site, that public collection page is delivered from outside the mainland — and a public-facing site served to mainland visitors needs an ICP filing bound to in-country hosting (State Council Order No. 292; MIIT Order No. 33), for which an offshore page has no footing. Embedding the form in your own ICP-filed site moves the hosting question onto your site, but the submitted data still lands on US AWS. | Formstack — Data Privacy and Security for Forms (formstack.com/data-security), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the real question about Formstack is not whether the form loads — it usually does — but where the data people type into it is allowed to live. Formstack answers that in its own security documentation: it stores submissions on AWS in the United States, and it runs no region inside mainland China. A Formstack form is therefore reachable from the mainland, yet every submission a Chinese user sends crosses the border the instant it is saved — a transfer of personal information China’s law governs, with the legal duty resting, in Formstack’s own words, on you. Reachability is the easy half; residency and consent are the exposure.
Formstack in China at a glance
| What decides it | In Formstack's own terms |
|---|---|
| Where it runs | Formstack “uses AWS in the United States as our external security hosting provider,” with stored data replicated “from US-East Region to US-West Region.” Both are United States regions; no location is inside mainland China. |
| Who owns the data | “Your organization owns the submission data and file upload data,” and “your organization is the Controller.” The handler's duty under Chinese law is therefore yours, not Formstack's. |
| Your China users' data | Personal information a mainland user submits is stored on US-based AWS — a cross-border transfer PIPL governs, plus a data-localization duty for CIIOs and large-volume handlers that an all-US footprint cannot meet. |
| Serving a hosted form | A public Formstack-hosted form page is delivered from offshore, so it has no footing for the ICP filing a mainland-facing public site requires. Embedding in your own ICP-filed site moves hosting to your site; the data still lands in the US. |
| Surveys of residents | Used for market or social surveys of mainland residents by a foreign organization, a foreign-related survey approval (涉外调查) may also apply — a relationship-based rule worth checking with counsel. |
US-based storage, no mainland region
Formstack’s answer to “where does the data live” is in its own security pages, and it is unambiguous: Formstack “uses AWS in the United States as our external security hosting provider,” and “all data stored on our AWS S3 is replicated consistent from US-East Region to US-West Region.” Both of those are United States regions. There is no mainland-China location anywhere in Formstack’s footprint, and nothing in its documentation offers one.
That geography settles the hard question before performance enters it. Every entry a Chinese user types into a Formstack form is stored offshore the moment it is saved, which under China’s Personal Information Protection Law is a cross-border transfer of personal information. The handler has to give notice, obtain separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an all-US footprint structurally cannot meet.
You are the Controller — the duty is yours
Formstack is careful about who holds the data and who holds the obligations. In its own words, “your organization owns the submission data and file upload data,” and “your organization is the Controller.” That line matters more in a China context than Formstack’s GDPR framing intends: under Chinese law the party that decides why and how personal information is handled is the handler who carries the duties. So when a mainland resident fills in your Formstack form, the PIPL notice, consent and transfer-mechanism obligations land on you — not on the form vendor, and not on AWS. “We just use Formstack” does not move that responsibility anywhere.
Reaching people is a second door — and surveys may be a third
If you collect through a Formstack-hosted form URL rather than an embed on your own site, the public collection page is served from outside the mainland, and a public-facing page shown to mainland visitors turns on an ICP filing (ICP 备案) tied to in-country hosting under State Council Order No. 292 and MIIT Order No. 33 — which an offshore page has no footing for. Embedding the form inside your own ICP-filed site moves that hosting question onto your site, but the submitted data still lands on US AWS, so the residency exposure above does not go away. And one further door opens narrowly: if you use Formstack to run market or social surveys of mainland residents as a foreign organization, China’s foreign-related survey approval (涉外调查) may apply — a relationship-based regime that turns on who commissions and receives the results, not on where the servers sit, so it is worth confirming with counsel rather than assuming it is out of scope.
This is a risk map, not a verdict: whether PIPL’s transfer rules, an in-country data-residency duty, an ICP filing, or a survey approval apply to you turns on what you collect, how much of it, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
Keep building your forms in Formstack. What we add is the piece a US-hosted form vendor cannot provide on its own: compliant, ICP-filed delivery from inside the mainland, set in front of your existing origin — no rebuild, no second form tool, and no move off Formstack. Our China team maps your PIPL cross-border and data-residency obligations against your entity and data volumes, then stands up the in-country, ICP-filed delivery a lawful China presence needs, so your Chinese users are served from inside the mainland instead of reaching entirely offshore — while your form logic stays exactly where it already runs.
Related reading:
