Does Jotform Work in China? Data Residency, PIPL & Your Form Submissions
Jotform stores every form submission on its US or EU servers — Iowa, Virginia and Frankfurt — with no mainland-China data center, so each submission from a Chinese user is a cross-border transfer of personal information under PIPL. A compliance-first look at the data-residency door.
Does Jotform work in China?
Yes, a Jotform form loads for Chinese visitors — but loading was never the question. Jotform stores every submission on its own servers in the United States or the European Union, with no data center inside mainland China, so each form a Chinese user fills in sends their personal information across the border.
On its own security page Jotform says its "servers are colocated in a cloud-based architecture with Google Cloud and Amazon Web Services (AWS)," with "Google Cloud data centers … hosted in Iowa (U.S.) and Frankfurt (Germany, EU)" and "AWS data centers … located in Virginia (U.S.) and Frankfurt (Germany, EU)." Even Enterprise, where you "can choose the physical location of your local cloud data residency center," documents regions like Australia, Canada and the EU — never the mainland. So names, emails, uploads, even payment details from your China users leave the country the moment they hit submit: a cross-border transfer of personal information PIPL governs, on infrastructure that cannot be ICP-filed or stored in-country. The table below is Jotform's own wording and the rule each line triggers.
This is a risk map, not a verdict — what applies turns on what your forms collect, how much, and who fills them out. Our China team can map your exposure with you →
Compliance snapshot
- ! Form submissions land on Jotform's US or EU servers — never the mainland
- ! Every submission from a China user crosses the border, so PIPL applies
- ✕ Jotform publishes no mainland-China data center for data residency
- ! Embed a form in a public mainland site and the ICP question lands on that site
- ✓ The form itself is reachable — but reachability isn't the legal question
What Jotform's own documentation says about China
| Fact | Primary source |
|---|---|
| Jotform keeps your form data in the US or the EU, not the mainland. In Jotform's own words its "servers are colocated in a cloud-based architecture with Google Cloud and Amazon Web Services (AWS)," and those "Google Cloud data centers are hosted in Iowa (U.S.) and Frankfurt (Germany, EU)" while the "AWS data centers are located in Virginia (U.S.) and Frankfurt (Germany, EU)." Two countries carry every submission — and neither is mainland China. | Jotform Enterprise Security (jotform.com/enterprise/security), retrieved 2026-10-07 |
| The only data-residency switch Jotform documents is US-to-EU. Jotform's EU "Datacenter feature is automatically enabled for accounts created within the European Union," and it tells EU customers "you must store your forms and data in a EU data center." That is the whole menu for a standard account — United States or European Union — so a submission from a Chinese user lands offshore either way: a cross-border transfer under PIPL that calls for notice, separate consent and a transfer mechanism (Articles 38–43). | Jotform Help: How to store your data on EU servers (jotform.com/help/871), retrieved 2026-10-07; PIPL Articles 38–43 |
| Even Enterprise data-residency control stops short of the mainland. Jotform says an Enterprise customer "can choose the physical location of your local cloud data residency center and host your data in any part of the world," for "data privacy rules and location requirements in places such as Australia, Canada, the U.K., and the EU." The locations it documents are all offshore from China, so a critical information infrastructure operator or large-volume handler cannot meet the rule that personal information collected in China be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). | Jotform Enterprise Security (jotform.com/enterprise/security), retrieved 2026-10-07; PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| Embed a Jotform form in a public mainland site and the ICP question lands on that site. A form is loaded from Jotform's own offshore domain, so the form endpoint itself isn't filed — but a public website shown to mainland visitors needs an ICP filing tied to in-country hosting (State Council Order No. 292; MIIT Order No. 33). If the mainland-facing site that carries the form is one you operate, that filing duty is yours, and the form sitting offshore does not remove it. | State Council Order No. 292; MIIT Order No. 33 (ICP filing regime); 21YunBox compliance analysis, 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the first question about Jotform isn’t whether the form loads — it’s where the answers go. Every name, email, file upload and payment detail a visitor types into a Jotform form is personal data, and Jotform stores it on its own servers in the United States or the European Union. It documents no data center inside mainland China. So a China-facing Jotform form is reachable, but each submission leaves the mainland the moment it is sent — a cross-border transfer of personal information China’s law governs, held on infrastructure that cannot be filed in-country. The loading is the easy part; the data residency is the exposure.
Jotform in China at a glance
| What decides it | In Jotform's own terms |
|---|---|
| Where it runs | Jotform's “servers are colocated in a cloud-based architecture with Google Cloud and Amazon Web Services (AWS)” — data centers in Iowa and Virginia (U.S.) and Frankfurt (Germany, EU). No region sits inside mainland China. |
| Data-residency options | Standard accounts store data in the US or the EU — the EU option is “automatically enabled for accounts created within the European Union.” Enterprise can “choose the physical location,” but the regions Jotform documents (Australia, Canada, the U.K., the EU) are all offshore from China. |
| Your China users' data | Names, emails, uploads and payment details collected from mainland visitors are stored offshore — a cross-border transfer of personal information PIPL governs. |
| Data localization | A CIIO or large-volume handler must keep China-collected personal data in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Jotform's US/EU residency offers no in-country option to switch on. |
| Serving the public | Embed a Jotform form in a public, mainland-facing site you operate and an ICP filing is required for that site (State Council Order No. 292; MIIT Order No. 33) — the offshore form does not remove it. |
Your form data lives in the US or the EU — never the mainland
Jotform is a hosted form builder: the form renders from Jotform’s servers and, crucially, the submissions come back to them too. On its security page Jotform states its “servers are colocated in a cloud-based architecture with Google Cloud and Amazon Web Services (AWS),” and names where those sit — “Google Cloud data centers are hosted in Iowa (U.S.) and Frankfurt (Germany, EU). AWS data centers are located in Virginia (U.S.) and Frankfurt (Germany, EU).” Those are its core data centers — four cities across the US and the EU. Jotform Enterprise can add other regions through its data-residency option (it advertises 19 data centers across 15 countries), but Jotform publishes no mainland-China location — so a form serving mainland visitors stores their submissions offshore.
The residency control Jotform offers moves between exactly those two. For a standard account the EU “Datacenter feature is automatically enabled for accounts created within the European Union,” and Jotform tells EU customers “you must store your forms and data in a EU data center.” On Enterprise you “can choose the physical location of your local cloud data residency center and host your data in any part of the world” — but the places Jotform documents are “Australia, Canada, the U.K., and the EU.” However you set it, the data for your Chinese users lands outside the mainland. That settles the compliance question before performance is ever in the room.
Every China submission crosses the border — and PIPL is watching
A Jotform submission is personal information: the respondent’s name, email, whatever files and fields your form asks for, sometimes payment data. Stored in Iowa, Virginia or Frankfurt, that information has left China — which under the Personal Information Protection Law is a cross-border transfer, and the handler on the hook is you, not Jotform. PIPL asks you to give the respondent notice, obtain their separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–43).
If you are a critical information infrastructure operator, or you handle personal information above the regulatory volume thresholds, a second duty bites: personal information collected in mainland China must be stored there (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Jotform’s residency choices stop at the US and the EU, so there is no in-country setting that satisfies it — the form product itself cannot keep that data in the mainland.
Embed the form in a mainland site, and ICP follows the site
There is a narrower, conditional door too. The ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33 attaches to the public website shown to mainland visitors and to the in-country hosting behind it. A Jotform form loaded from Jotform’s own offshore domain is not itself an ICP-filed service — but if you embed that form inside a public, mainland-facing site you operate, the ICP filing obligation falls on that site. Pulling the form in from offshore does not lift the requirement off the page that carries it.
This is a risk map, not a verdict: whether you owe notice and consent, a transfer mechanism, in-country storage, an ICP filing, or some mix of them depends on what your forms collect, how much, and who fills them out — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep collecting on Jotform. We add the piece a US/EU form product cannot: compliant, ICP-filed delivery from inside the mainland, placed in front of the mainland-facing site that carries your Jotform forms — no rebuild, no second codebase, and no move off Jotform. Our China team works through which obligations actually apply to you, assesses your PIPL cross-border and data-residency exposure for the data your forms gather and the users who fill them in, and stands up the in-country delivery and lawful data handling a compliant China presence requires, while your forms stay exactly where they already live.
Related reading:
Frequently Asked Questions
Where does Jotform store our form submissions?
On Jotform's own servers in the United States or the European Union. Jotform states its servers are "colocated in a cloud-based architecture with Google Cloud and Amazon Web Services (AWS)," with data centers in Iowa and Virginia (U.S.) and Frankfurt (Germany, EU); EU residency is an option you enable, and Enterprise lets you choose among documented regions such as Australia, Canada, the U.K. and the EU. None of them is inside mainland China, so for your China users the submission is stored offshore.
Is it a problem under Chinese law to collect form data from mainland users on Jotform?
Treat it as a risk to assess with counsel, not a flat yes or no. Two things follow from storing offshore: your China users' personal information leaves the mainland, which PIPL governs as a cross-border transfer (notice, separate consent and a transfer mechanism), and a critical information infrastructure operator or large-volume handler owes a data-localization duty an offshore store cannot meet. A separate ICP question arises only if you embed the form in a public, mainland-facing website you operate.
Can 21YunBox help us keep using Jotform in China compliantly?
Yes. Our China team can map your exposure — your PIPL cross-border and data-residency obligations for the personal data your forms collect, your volumes and your users — and stand up the ICP-filed, in-country delivery a compliant China presence needs, in front of the mainland-facing site that carries your Jotform forms. You keep building on Jotform. Get in touch to work through your specific case.
