Does Frame.io Work in China? Data Residency, ICP & Cross-Border Rules
On Frame.io your video masters, review comments and every collaborator's identity live on its offshore creative cloud — no mainland-China region, nothing you self-host. For footage of real people and client data from China that is PIPL cross-border plus residency exposure; an in-country review footing is the lever.
Does Frame.io work in China?
Whether you can use Frame.io in mainland China is first a data-residency question — where your video and the people in it live — not whether the review link opens. Frame.io is a hosted video review and collaboration cloud: when you upload, your footage, every version, the review comments and the identities of every reviewer and collaborator you invite execute on and are stored on Frame.io's own cloud.
By Frame.io's own documentation an uploaded asset “is stored in Frame.io's Amazon S3 bucket,” and the only region its documentation specifies for that storage is in the United States (“us-east-1”) — there is no mainland-China region, and Frame.io is not a product you self-host. So for your creative work shot or reviewed in China, the video masters you upload, the client names and comments in the review, and footage of real people are held offshore the moment they sync: a cross-border transfer of personal information that PIPL governs, and for a CIIO or large-volume handler, data the Cybersecurity Law requires be stored in the mainland. Whether the review link loads in Shanghai is the least of what you are deciding.
This is a risk picture, not a verdict — your obligations turn on your data volumes and your role. Our China team can map your Frame.io exposure with you →
What Frame.io's own documentation says about China
| Fact | Primary source |
|---|---|
| In Frame.io's own help documentation: when a user uploads an asset, “the asset flows through the application stack and is stored in Frame.io's Amazon S3 bucket,” and “playback and delivery of an asset is serviced from a Frame.io managed Amazon S3 bucket.” Your video masters, every uploaded version and their previews live on Frame.io's hosted cloud storage — not on any machine you control, and not on Chinese soil. | Frame.io — Storage Connect for Frame.io: Registering assets (help center), retrieved 2026-10-13 |
| Frame.io describes itself as “a cloud workspace purpose-built for visual assets,” where teams “get actionable feedback on videos, images, and docs” from clients, creatives and execs. The review comments, version history and the identities of every reviewer and collaborator you invite are stored and shared from that same offshore cloud. Even its Enterprise “bring your own storage” option places the bucket in a US region (“an EMPTY S3 bucket within the us-east-1 region”) — there is no mainland-China region, and nothing you run in-country. | Frame.io — product homepage (frame.io) and Storage Connect help documentation, retrieved 2026-10-13 |
| Personal information collected from people in China and sent abroad is a cross-border transfer under the Personal Information Protection Law. The handler must give notice, obtain separate consent, and satisfy one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–40). Footage of real people, and the client names and comments in a review, fall within this the moment they sync to the offshore creative cloud. | PIPL Articles 38–40 — 21YunBox gov-doc reference, retrieved 2026-10-13 |
| For a critical information infrastructure operator or large-volume handler, personal information and important data collected in China must be stored inside the mainland under the Cybersecurity Law Article 39 (formerly Article 37). A cloud-only review service with no mainland-China region cannot meet that duty; keeping the creative assets and the PII inside them in-country can — and standing that footing up legally is what brings an ICP filing into scope. | Cybersecurity Law Article 39 (formerly Article 37) — 21YunBox gov-doc reference, retrieved 2026-10-13 |
Sources verified by the 21YunBox compliance team on 2026-10-13.
Ask whether Frame.io “works” in mainland China and the honest answer starts with where your video — and the people in it — live, not with whether a review link opens from Shanghai. Frame.io is a hosted video review and collaboration cloud: when you upload, your video masters and every version are stored on Frame.io’s own cloud, the review comments and annotations you and your clients leave are kept there, and so are the identities of every reviewer and collaborator you invite. That content is your proprietary creative work, and it routinely carries personal information — footage of real people, a cut assembled over real customer records, client names threaded through a review. All of it comes to rest on Frame.io’s offshore cloud the moment it syncs. Whether the review link is reachable is real, but it is the least of what you are deciding.
Frame.io in China at a glance
| What decides it | In Frame.io's own terms |
|---|---|
| Where your work lives | Uploaded assets are stored on Frame.io's hosted cloud. In its help documentation, an asset "is stored in Frame.io's Amazon S3 bucket," and the only region its Storage Connect documentation specifies is a US region ("us-east-1"). No region is in mainland China. |
| What syncs there | Your video masters and every version — your proprietary, often unreleased creative work — plus the generated previews and thumbnails. Frame.io calls itself "a cloud workspace purpose-built for visual assets," and that workspace is the cloud, not your machine. |
| The review layer | Every comment, annotation and approval is attributed to a named person. The identities, emails and roles of each reviewer, client and collaborator you invite are stored on the cloud so the workspace can show who said what — personal data about real people. |
| Embedded PII | Creative files routinely carry personal information: footage of identifiable people, a cut assembled over real customer records, client data in deliverables. That PII rides inside the assets you sync — and lands offshore with them. |
| A self-hosted / in-country option? | No. Frame.io is cloud-only; even its Enterprise "bring your own storage" option is an AWS S3 bucket its documentation places in a US region, and Frame.io still keeps generated previews and thumbnails in its managed cloud. There is no server you run in the mainland. Confirm current options with Frame.io before relying on one. |
| Is it reachable? | Whether a review link opens cleanly from mainland China is a delivery question — separate from, and lesser than, whether you are cleared to hold your video masters, the footage of real people and the reviewers' data offshore at all. |
Where Frame.io stores your work — and that settles the first question
Frame.io is hosted software, and its own documentation names where the work lives. When a user uploads, its help documentation states plainly that “the asset flows through the application stack and is stored in Frame.io’s Amazon S3 bucket,” and that “playback and delivery of an asset is serviced from a Frame.io managed Amazon S3 bucket.” The only region Frame.io’s Storage Connect documentation specifies is a US region — “an EMPTY S3 bucket within the us-east-1 region” — and there is no mainland-China region. So wherever your editors and clients sit, the video masters you upload, the versions you stack up and the review threads attached to them are held offshore. That single fact decides the compliance question before reachability is ever measured: this is not about whether a review link opens in Shanghai, but about your proprietary creative work and your subjects’ data leaving the country the moment they sync.
Prong one — your video masters and the people in them leave the country
A Frame.io project exercises your video masters — your proprietary, often unreleased creative work — and the files you upload routinely embed personal information: footage of identifiable people, a mockup or cut composited over real customer records, deliverables carrying client data. Frame.io keeps those uploads on its hosted cloud; in its own words, an uploaded asset “is stored in Frame.io’s Amazon S3 bucket.” When those assets hold the personal information of people in China, syncing them to that cloud is a cross-border transfer the Personal Information Protection Law governs: you must give notice, obtain separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–40). If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland under the Cybersecurity Law Article 39 (formerly Article 37) — a residency duty a cloud-only review service with no mainland-China region cannot satisfy. This is your creative IP and your subjects’ data, not “can the review stream,” and it is the spine of the question.
Prong two — the review layer is offshore too, and that is the half a reachability check never reaches
Frame.io’s whole point is the review layer, and that layer is personal data about named people. Every comment, annotation and approval is attributed to a person; the identities, email addresses and roles of every reviewer, client and collaborator you invite are stored on Frame.io’s cloud so the workspace can show who said what. Frame.io describes itself as “a cloud workspace purpose-built for visual assets,” where teams “get actionable feedback on videos, images, and docs” from clients, creatives and execs — and all of that feedback, and the directory of who gave it, lives on the same offshore cloud as the video. A probe that only confirms the review link opens never sees any of this: it cannot see the video master sitting in a US-region data center, it cannot see the footage of real people stored beside it, and it cannot see the list of named Chinese collaborators and their comments held abroad. That is the second half of the question, and a connectivity check structurally cannot answer it. Keeping the assets and the people-data inside them in-country is the only thing that does.
Why a reachability check misses this
A test that only asks “can my client open the review link from Shanghai?” measures the wrong thing. It never sees that your video masters were uploaded to a US-region cloud bucket; it never sees that footage of real people and client records composited into your cut are stored in that same offshore region; it never sees the roster of named reviewers and their comments held abroad; and it never sees the notice-consent-and-mechanism duties PIPL attaches to that data once it leaves China. Making the offshore cloud merely reachable does not move the regulated assets or the people-data in-country, and it does not create the transfer basis the law requires. Reaching the service and being cleared to hold your creative IP and your subjects’ data offshore are two different tests — and only one of them shows up on a latency chart.
The lever: map, localize, deliver
- Map — inventory which creative assets are proprietary IP, which embed personal information (real customer records in a mockup, identifiable people in footage, client names and comments in a review), and where each one syncs or is stored; separate the cloud-synced, offshore copies from anything you still keep local or in-country.
- Localize — keep the regulated creative assets and the personal information inside them in-country, on in-country storage and an in-country review and handoff footing, and let only the assets that are lawful to export ever reach the offshore creative cloud.
- Deliver — 21YunBox stands up the compliant in-country storage, review and handoff footing in front of (or alongside) the offshore creative cloud, with no rebuild of how your team works. Making the cloud reachable is never the answer; keeping the assets and the PII in them resident is.
Standing that in-country footing up legally — storing and reviewing the regulated work on infrastructure inside the mainland — is also what brings an ICP filing into scope, and it is exactly the footing a cloud-only creative service cannot give you.
Keep Frame.io — keep your assets and the PII in them in-country
You do not have to abandon Frame.io or change how your editors and clients review to be compliant. The fix is to change where the regulated work lives: 21YunBox stands up a compliant in-country storage, review and handoff footing — inside the mainland, in front of (or alongside) the offshore creative cloud — so your video masters, the footage of real people and the client names and comments in a review stay resident, and only what is lawful to export ever leaves. We map which assets are proprietary IP and which embed personal data, localize them in-country, and deliver the footing in front of your existing workflow — no rebuild. Tell us your setup and we’ll scope the in-country path and a quote with you.
