Does Grammarly Work in China? Data Residency, ICP & Cross-Border Rules
Grammarly ingests the text your team types — often confidential business writing, sometimes sensitive personal data — to generate suggestions, and by its own security page it hosts data on Amazon Web Services in the US East region, with no mainland-China region. That writing corpus and its embedded PII sit offshore and cross the border continuously: a PIPL cross-border, consent and data-residency matter, not a speed one.
Does Grammarly work in China?
Whether Grammarly works in China is a data-residency and cross-border question, not a speed one — and its distinctive risk is that the content itself is the input.
Grammarly is a cloud writing assistant that works by ingesting the text your team types to generate its suggestions, and by its own Security page it “hosts data in Amazon Web Services data centers in the US East region,” with no mainland-China region. So everything your people write into it — often confidential business text, sometimes the sensitive personal information of customers or colleagues — is sent offshore to be processed and stored, and because the content is the input it cannot be minimized or de-identified the way a discrete form field can (it mirrors a translation or OCR service). Exporting that writing, and the personal information embedded in it, is a cross-border transfer PIPL governs (notice, a separate consent, a transfer mechanism; in-country storage for a CIIO or high-volume handler), and sensitive personal information in the text brings PIPL Articles 28–29 into play. The half a reachability check never sees: being able to open Grammarly from Shanghai changes neither where your writing corpus rests nor whether exporting it is lawful.
This is a risk picture, not a verdict — your duties turn on your data and role. Our China team can map your Grammarly content and PII exposure with you →
What Grammarly's own documentation says about China
| Fact | Primary source |
|---|---|
| In Grammarly's own words: its Security page states that it “hosts data in Amazon Web Services data centers in the US East region,” and adds that “all components that process your data operate in Grammarly's private network inside our secure cloud platform.” The page names only AWS infrastructure in the United States and no mainland-China region anywhere. | Grammarly — Security ('Secure infrastructure' → Data hosting), retrieved 2026-10-12 |
| Grammarly's Privacy and security FAQ states that “all data is stored on servers hosted by Amazon Web Services in the United States,” and refers to “all other user text processed by Grammarly” — confirming that the text your team types is itself ingested and comes to rest in the US. Its help center likewise states “Grammarly data is stored on servers hosted by Amazon Web Services in the US.” No mainland-China region, and no self-host option. | Grammarly — Privacy and security FAQ; 'Where does Grammarly store my data?' help article, retrieved 2026-10-12 |
| The writing your China team types — and the personal information embedded in it — comes to rest offshore, so exporting it is a cross-border transfer PIPL governs: the handler (you, the employer — not Grammarly) must give notice, obtain a separate consent (not a bundled 一揽子 consent), and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–40; consent in Articles 13 and 23). Where the text contains sensitive personal information, Articles 28–29 add a stricter necessity test and specific consent. | PIPL Articles 13, 23, 28–29, 38–40 — notice, separate consent and cross-border transfer |
| A critical information infrastructure operator or high-volume handler must store personal information collected in China inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37), renumbered by the 2025 amendment in force January 1, 2026) — a residency duty no US region satisfies. Any public, China-facing surface you build around a China-resident alternative also needs an ICP filing (备案) on mainland hosting. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-12.
For an enterprise rolling out Grammarly across a mainland-China team, the question that matters is not whether the writing assistant paints quickly from Shanghai. Grammarly works by ingesting the text your people type — it reads the words in order to suggest the next ones — so the content itself is the input. Everything your team writes into it, often confidential business text and sometimes the sensitive personal information of customers, candidates or colleagues, is sent to Grammarly to be processed and stored. By Grammarly’s own security page that happens on Amazon Web Services in the US East region, with no mainland-China region; your entire stream of corporate writing, and the personal information embedded in it, comes to rest offshore and crosses the border every time someone types. That is the half a reachability check never sees, and it is why this is a data-residency, cross-border and consent question — not a speed one. Three prongs decide it: the content-ingestion exposure, where the input cannot be minimized or de-identified the way a discrete form field can — it mirrors a translation or OCR service; the cross-border and consent basis for exporting that writing and the PII embedded in it; and, where you still need the capability inside the mainland, the choice of a China-resident alternative, never circumvention of any kind.
Grammarly in China at a glance
| What decides it | In Grammarly's own terms — and China's law |
|---|---|
| What it holds | Not metadata about your writing — the writing itself. Grammarly ingests the text your team types to generate suggestions: emails, documents, chat, code comments, HR and legal drafts. That stream is a running record of your confidential business content, and wherever it names, describes or is written by an identifiable person it is personal information; where it concerns health, finances, or other protected categories it is sensitive personal information. |
| Where it rests (offshore, no China region) | Grammarly is cloud SaaS with no self-host and no mainland-China region. Its own Security page states it “hosts data in Amazon Web Services data centers in the US East region,” and its Privacy and security FAQ states “All data is stored on servers hosted by Amazon Web Services in the United States.” So the text comes to rest in the US; there is no setting that keeps it in the mainland. |
| The content is the input — the distinctive second half | The half a reachability check never sees. Unlike a form that collects named fields you could minimize or mask, an assistant that processes the prose itself cannot de-identify its input — the words are the thing being sent. This mirrors a translation or OCR service: to do the job at all, the full confidential text (and any PII inside it) must leave for the offshore processor. Being able to open Grammarly from the mainland does not change that. |
| Cross-border, consent & residency | Sending that writing and its embedded PII offshore is a cross-border transfer (数据出境) under PIPL Articles 38–40, on top of the Article 13/23 notice and separate consent — not a bundled 一揽子 consent. Sensitive personal information in the text brings PIPL Articles 28–29 into play. For a critical information infrastructure operator or high-volume handler, Cybersecurity Law Article 39 (formerly Article 37) requires China-collected personal information to be stored in the mainland. |
| Reachability is not the axis | Whether the assistant loads quickly from the mainland is operational, not the compliance question. What decides it is that the content your team types is the input and rests offshore, and whether exporting it is lawful. 21YunBox helps you keep China-resident and confidential content in-country, secure the consents, advise on a China-resident alternative where you need the capability in the mainland, and deliver any China-facing surface compliantly — in front of what you already run, never by circumvention. |
What it actually holds — the writing itself, not metadata
Most SaaS compliance questions are about the records a tool keeps about your work. Grammarly is different, and that difference is the whole point: it holds the work. A writing assistant functions by reading the text you type and returning suggestions, so the raw content — every email, document, message, HR note, legal draft and code comment your team runs through it — is sent to Grammarly to be processed. Grammarly’s own Privacy and security FAQ refers to “all other user text processed by Grammarly,” and its Security page states that “all components that process your data operate in Grammarly’s private network inside our secure cloud platform.” Wherever that text names, describes or is authored by an identifiable person, it is personal information under China’s Personal Information Protection Law; where it touches health, financial status, or other protected categories, it is sensitive personal information. Taken together, the stream your team feeds the assistant is a continuous, high-fidelity record of your confidential business writing — and it is the input the service is built to consume.
The doors: content ingestion, cross-border, consent, residency
The content-ingestion prong opens the first and most distinctive door. An ordinary form collects discrete, named fields you can minimize, pseudonymize or drop. An assistant that operates on the prose itself cannot: the words are the input, so to get a suggestion at all the full confidential text — and whatever personal information is embedded in it — must be transmitted to the offshore processor. There is no “de-identified” version of a document you need checked. This is the same structural exposure as a cloud translation or OCR service, and a reachability check sees none of it.
The second door is cross-border transfer and consent. The text your China team types, and the personal information inside it, comes to rest on Grammarly’s US infrastructure, which makes exporting it a cross-border transfer (数据出境). The duty lands on you, the handler, not on Grammarly: PIPL Articles 13 and 23 require notice and a basis to collect, and Articles 38–40 require a transfer mechanism to send it offshore — a CAC security assessment, the CAC standard contract, or certification — with a separate, informed consent for the overseas transfer, not a single bundled 一揽子 consent. Where the writing contains sensitive personal information, PIPL Articles 28–29 add a stricter necessity test and specific consent on top.
The third door is residency. For a critical information infrastructure operator or a high-volume handler, the Cybersecurity Law’s Article 39 (formerly Article 37 — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, its substance unchanged) requires personal information generated in China to be stored in the mainland, which an offshore-only service cannot satisfy. And if you stand up any public, China-facing surface around a China-resident alternative, that surface is an internet information service carrying an ICP filing (备案) duty bound to mainland hosting — which an in-country deployment can provide and an offshore one cannot.
Why a reachability check misses this
A probe from inside China can watch the Grammarly interface load and conclude “it works.” That answer is beside the point. The compliance exposure is not on the screen — it is in what the assistant is built to consume and where that lands: the actual text your team types, flowing continuously to an offshore cloud, carrying whatever confidential content and personal information it contains. A page-load test measures none of that. It cannot see which region the data rests in, whether a separate consent was taken, whether a transfer mechanism is in place, or that the input is by its nature un-minimizable because the content itself is the thing being sent. That is the competitor-proof second half of the question — and it is exactly why making an offshore assistant merely reachable from the mainland is not the answer. Keeping China-resident and confidential content in-country, and governing what is sent, is.
The lawful path — map, localize, deliver
There is a compliant way to give a mainland-China team writing assistance, and it starts by separating the capability from the content that must not leave.
First, map: our China compliance team inventories what your team actually sends to Grammarly — the categories of writing, whether it carries customer, candidate or employee PII, whether any of it is sensitive personal information — establishes where it rests today (the offshore US cloud), and records the consent and residency basis each flow relies on. We build the technical picture; the legal conclusions are settled with counsel.
Then localize/govern: keep the regulated content in-country. That means not routing China-resident or confidential writing through an offshore assistant, minimizing and governing what any assistant is allowed to ingest, taking the Article 13/23 notice and separate consent, and treating sensitive personal information in the text under the stricter Article 28–29 rules. Where your team needs the writing-assistant capability inside the mainland, the compliant answer is a China-resident alternative or an in-country-governed deployment — never circumvention, and never a route that ships the content offshore anyway.
Then deliver: any public, China-facing surface you build around that in-country capability is an internet information service, so it carries an ICP filing duty and needs compliant, in-country delivery. 21YunBox delivers it in-country — the 21YunBox Optimizer — in front of what you already run, so it runs legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind — we keep in-country what the law says must stay, deliver the rest compliantly from inside the mainland, and never move personal information across the border by stealth. 21YunBox is a compliance overlay and partner to the productivity tools your team already uses, not a competitor to them.
None of this is a verdict that Grammarly is “blocked” or “illegal” in China. It is a risk-and-residency map of a service whose input is your confidential writing, and which duties bite your case turns on your entity, your role under Chinese law, your data volumes, and what your team actually types into it — worth settling the specifics with counsel before your corporate writing stream depends on it.
Related reading:
- China’s Personal Information Protection Law (PIPL)
- Cross-border data transfers under PIPL
- China’s Cybersecurity Law (data localization, Article 39)
- How to get an ICP filing for China
