Does Hasura Work in China? Data Residency, PIPL & an Offshore GraphQL API
Hasura gives you an instant GraphQL API over your data, and its managed hosting — Hasura Cloud and Hasura DDN — runs that API layer only on offshore clouds (AWS, GCP, Azure), none in mainland China. So every query your China users make crosses the border: a PIPL data-residency and cross-border-transfer question, not a speed one.
Does Hasura work in China?
Whether Hasura is usable in mainland China turns first on data residency, not on how quickly the API responds. Hasura gives you an instant GraphQL API over your data, and its managed hosting — Hasura Cloud, and its successor Hasura DDN — runs that API layer offshore, with no region inside mainland China.
By Hasura's own Cloud regions documentation, "Hasura Cloud is available in multiple regions on both Amazon Web Services (AWS), Google Cloud Platform (GCP) and Microsoft Azure Cloud" — a region list that runs from the US and Europe to Tokyo, Singapore, Sydney and Mumbai, none of it on the mainland. Because the API sits offshore, every query and mutation your China users make to their own personal data is answered across the border, and anything Hasura Cloud caches rests in that offshore region too — a cross-border transfer of personal information PIPL governs, with a localization duty for a CIIO or large-volume handler. The table below is Hasura's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on what flows through the API, your data volumes and your role. Our China team can map your Hasura exposure with you →
Compliance snapshot
- ! Reachable, but the GraphQL API is served from offshore cells (AWS, GCP, Azure) — no mainland-China region
- ! Every query and mutation to your China users' data is answered across the border
- ! Personal data in transit — and anything Hasura Cloud caches — is handled offshore under PIPL
- ✕ No in-China region or data-residency option on Hasura Cloud or Hasura DDN
- ✓ A compliant, ICP-filed in-country path exists for the app in front — no rebuild, no migration
What Hasura's own documentation says about China
| Fact | Primary source |
|---|---|
| In Hasura's own words: "Hasura Cloud is available in multiple regions on both Amazon Web Services (AWS), Google Cloud Platform (GCP) and Microsoft Azure Cloud." The regions it lists run across the US and Europe to Canada (Central), and in Asia-Pacific to Tokyo, Sydney, Singapore and Mumbai — none is inside mainland China, and the nearest, Tokyo or Singapore, is still offshore. | Hasura — Hasura Cloud Regions, retrieved 2026-10-08 |
| Hasura is the GraphQL API layer in front of your data, not the database itself — but that is precisely why it matters: every read and write your China users make is routed through an endpoint Hasura Cloud hosts offshore, so their personal information leaves the country on each request. PIPL governs that cross-border transfer: the personal-information handler — you, Hasura's customer, not Hasura — must give notice, obtain separate consent, and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). | PIPL Chapter III, Articles 38–43 |
| The exposure scales with volume and role, not merely with using the tool: under the CAC's March 2024 cross-border data rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification — above that, one of those mechanisms applies. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024 |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a duty no offshore Hasura region can meet. The separate ICP filing a mainland audience needs is not Hasura's door: an API serves no public site of its own, so that obligation sits on the application in front of Hasura, if it faces Chinese users. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-08.
For a mainland-China audience, the deciding question about Hasura is not how quickly the API answers — it is where the data behind that API is allowed to live, and where the API that serves it runs. Hasura gives you an instant GraphQL API over your existing data; it is the layer in front of your database, not the database itself. Its managed hosting — Hasura Cloud, and its successor Hasura DDN — runs that API layer on offshore clouds, with no region inside mainland China. The endpoint is reachable across the border; what China’s law responds to is that every query to your users’ personal data is answered offshore, and nothing in that managed service sits on the mainland.
Hasura in China at a glance
| What decides it | Where Hasura stands for China |
|---|---|
| What Hasura is | An instant GraphQL (and REST) API over your existing data sources — the layer your application queries, not the database of record. Where that API runs, and where the data it serves travels, is the deciding question. |
| Where it runs | Hasura Cloud is “available in multiple regions on both Amazon Web Services (AWS), Google Cloud Platform (GCP) and Microsoft Azure Cloud” — across the US, Canada and Europe, and in Asia-Pacific to Tokyo, Sydney, Singapore and Mumbai. No region is inside mainland China; its successor, Hasura DDN, runs its data plane on those same offshore clouds. |
| Your China users' data | Every query and mutation is answered from the offshore endpoint, so personal data leaves the country on each request; responses Hasura Cloud caches rest offshore too. A cross-border transfer PIPL governs. |
| Data residency | For a CIIO or large-volume handler, personal information collected in China must stay on the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). No offshore Hasura region can meet that duty. |
| ICP filing | Not Hasura's door. An API serves no public site, so the ICP filing a mainland audience needs sits on the application in front of Hasura, not on the API layer itself. |
Your API layer runs offshore — and so does the data it serves
Hasura’s job is to expose a GraphQL API over the data you already hold, and its managed hosting runs that API offshore. In Hasura’s own Cloud regions documentation, “Hasura Cloud is available in multiple regions on both Amazon Web Services (AWS), Google Cloud Platform (GCP) and Microsoft Azure Cloud,” and the regions it offers reach from the US and Canada through Europe to Tokyo, Sydney, Singapore and Mumbai — not one on the mainland, with the nearest still offshore. Hasura’s newer Data Delivery Network (DDN) is built the same way, running its data plane on those same offshore clouds. That geography settles the China question before any query is timed: the endpoint that answers your China users sits outside the country, and every read and write they make is routed through it.
A gateway is not a copy — the personal data itself crosses the border
It is tempting to treat an API layer as harmless plumbing, but with Hasura what crosses the border is the personal data itself. Each GraphQL query reads your users’ records out through the offshore endpoint; each mutation writes them back through it; and where you turn on Hasura Cloud’s response caching, the data a query returned can come to rest in that offshore region rather than merely passing through. So an application — or a user — in mainland China talking to a Hasura Cloud endpoint is exchanging personal information across the border continuously, not once. Under China’s Personal Information Protection Law, both that ongoing flow and any offshore caching are a cross-border transfer, and the obligation lands on you — the handler — not on Hasura: notice, separate consent, and one cleared transfer mechanism. Tuning the round trip does not change where the data is handled; that is the part a performance fix cannot reach. For a critical information infrastructure operator or a large-volume handler, personal information collected in China has to stay on the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)), and no offshore Hasura region can satisfy that.
ICP is the app’s door, not the API’s — and saying so matters
It would be easy to staple an ICP warning onto every China page, but it does not belong on the Hasura layer. An ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33 attaches to a public-facing website and the mainland hosting that serves it — and an API serves no public site of its own. So that obligation sits on the application in front of your Hasura endpoint, where it faces a Chinese audience, not on the API layer. Hasura’s compliance weight is heavier in one narrower place: data residency and the cross-border flow. Keeping the two doors distinct tells you exactly which risk lives where, rather than blurring a data question into a licensing one.
This is a risk map, not a verdict: whether a localization duty applies, and which cross-border mechanism fits, turns on your entity, how much personal data you handle, and whose it is — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building on Hasura. We add the piece an offshore API layer cannot provide on its own: compliant, ICP-filed delivery from inside the mainland for the application that calls your API, together with any in-China storage your data-residency obligations require — placed around the stack you already run, with no rebuild, no second codebase, and no move off Hasura. Our China team maps your PIPL cross-border and data-localization exposure against your entity and data volumes, then stands up the in-country delivery and storage a lawful China presence needs, while your GraphQL API keeps running exactly where it already does.
Related reading:
Frequently Asked Questions
Does Hasura store Chinese users' data inside China?
No. Hasura's managed hosting — Hasura Cloud, and its successor Hasura DDN — runs the API layer only on offshore clouds (AWS, GCP and Azure), and its own regions documentation lists no mainland-China region. So the queries and mutations your China users make are answered offshore, and any responses Hasura Cloud caches rest there too; their personal data is handled outside the mainland.
Is it against the law to use Hasura in China?
Not inherently. The issue is the cross-border transfer of personal information through an offshore API, which PIPL permits if you give notice, obtain separate consent and meet one transfer mechanism. Whether you also carry a data-localization duty depends on your role (for example, whether you are a CIIO) and the volume of personal information you handle. Treat this as a risk to assess with counsel, not a blanket ban.
Can 21YunBox help make our Hasura setup compliant in China?
Yes. Our China team can assess the cross-border and data-residency exposure for your data volumes and role, and stand up the compliant, ICP-filed in-country delivery for the application in front of your API — and, where the law requires your China users' data to stay on the mainland, in-country storage — without a rebuild or a move off Hasura. Get in touch to work through your specific case.
