Does Loom Work in China? Recording Data, PIPL & Offshore Video
Loom stores every recording — screen, camera and microphone — on AWS in the United States, with no mainland-China region. For any China participant or viewer that is a cross-border transfer of personal information under PIPL, with a residency duty for larger handlers. A compliance-first look at the recording-data and delivery doors.
Does Loom work in China?
Loom is reachable from China, but the compliance problem is the recording itself. Every Loom captures a screen, a camera and a microphone — faces, voices, names, whatever is on display — and Loom stores all of it on AWS in the United States. For anyone in mainland China who appears in or watches a video, that is a cross-border transfer of personal information, not a hosting detail.
Loom's own documentation is explicit: "AWS is the cloud provider we use at Loom to run our service. AWS processes, hosts, and stores your account and the videos you record with us," and its sub-processor list gives AWS's location as "United States." Store a recording of a mainland participant there and you have a cross-border transfer of personal information under PIPL — notice, separate consent and a transfer mechanism (Articles 38–43) — and, for a CIIO or large-volume handler, a data-residency duty an offshore host cannot meet (Article 40; Cybersecurity Law Article 39 (formerly Article 37)). The table below is Loom's own wording and the rule each line triggers.
This is a risk map, not a verdict — which obligations bite depends on who is on the recording, how much personal data you hold, and your role. Our China team can map your exposure with you →
What Loom's own documentation says about China
| Fact | Primary source |
|---|---|
| Loom hosts every recording on Amazon Web Services, not on its own mainland infrastructure. In Loom's own words, "AWS is the cloud provider we use at Loom to run our service. AWS processes, hosts, and stores your account and the videos you record with us." There is no Loom region inside mainland China — the recording, your account and the playback all live on AWS. | Loom (Atlassian) Privacy Policy, retrieved 2026-10-07 |
| That AWS footprint sits in the United States. Loom's own sub-processor list gives Amazon Web Services' location as "United States" — the provider it says "processes, hosts, and stores your account and the videos you record." A recording of a mainland participant or viewer stored there is a cross-border transfer of personal information under PIPL, which requires notice, separate consent and a transfer mechanism (Articles 38–43). | Loom (Atlassian) Privacy Policy sub-processor list, retrieved 2026-10-07; PIPL Articles 38–43 |
| A Loom recording is itself personal information. The product records the screen, camera and microphone, so one video can carry faces, voices, names and whatever customer or personal data is visible — and Loom confirms AWS "stores… the videos you record with us." Held offshore, those recordings can trigger China's localization duty: for a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). | Loom (Atlassian) Privacy Policy, retrieved 2026-10-07; PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| Encryption protects the recordings in place — it does not bring them onshore. Loom states it "stores data in a multi-tenant environment hosted on AWS servers," with "data in transit… encrypted using TLS 1.2+, and data at rest… encrypted using AES-256." Strong encryption is a security control, not a residency or filing solution: the videos still live on US AWS, and for a mainland viewer every playback is pulled across the border — heavy video that tends to load slowly or stall. | Loom (Atlassian) Security Measures, retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a team with people in mainland China, the deciding question about Loom is not whether a video eventually plays — it is what a Loom recording is and where it is allowed to live. Every Loom captures a screen, a camera and a microphone, so a single clip can carry faces, voices, names and whatever customer or personal data was on display. Loom’s own documentation settles where that recording goes: it is hosted on Amazon Web Services, and Loom lists AWS’s location as the United States. So the moment anyone in China appears in a Loom — or opens one to watch — their personal information is being stored offshore. That, not the loading spinner, is the exposure.
Loom in China at a glance
| What decides it | In Loom's own terms |
|---|---|
| Where it runs | “Loom hosts data on Amazon Web Services (AWS),” and its sub-processor list gives AWS's location as “United States.” There is no Loom region inside mainland China. |
| What it stores | “AWS processes, hosts, and stores your account and the videos you record with us.” A Loom is a screen, camera and microphone recording — personal information by its nature. |
| Your China users' data | A recording of a mainland participant or viewer, held on US AWS, is a cross-border transfer of personal information PIPL governs — notice, separate consent and a transfer mechanism. |
| Data residency | For a CIIO or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a duty an offshore host cannot satisfy. |
| Is it reachable? | Served from offshore AWS, so for a mainland viewer every playback is pulled across the border — heavy video that tends to be slow or to stall. Reachability is the lesser half. |
A Loom recording is personal information — and Loom stores it offshore
Start with what a Loom actually is. The product records a screen, a camera and a microphone, which means a routine “quick walkthrough” can hold a colleague’s face, a customer’s voice, a name on a CRM tab, an email thread, an account dashboard. That is personal information before a single byte is transmitted. Loom’s own documentation then tells you where it goes: “AWS is the cloud provider we use at Loom to run our service. AWS processes, hosts, and stores your account and the videos you record with us,” and Loom “stores data in a multi-tenant environment hosted on AWS servers.” Its sub-processor list records AWS’s location as “United States.”
So the geography is settled before performance is ever discussed: there is no Loom region inside mainland China, and every recording — along with your account — rests on AWS infrastructure in the US. “We already use Loom” does not change that. The recording is personal data, and the data is offshore.
For anyone in China on the recording, that’s a cross-border transfer
Once a recording holds the personal information of someone in mainland China and lives on US AWS, China’s Personal Information Protection Law treats the arrangement as a cross-border transfer. The handler — you, the organization recording and sharing the Loom, not Loom itself — has to give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). This is triggered by the people on the recording, not by where your office is: a China-based employee recorded in a standup, or a mainland customer who watches a shared Loom, is enough to put personal information across the border.
Residency for larger handlers — and the smaller, delivery half
Depending on your role and volume, a stricter duty can sit on top. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — and recordings parked on US AWS cannot meet that. Encryption does not rescue the position: Loom states that “data in transit” is “encrypted using TLS 1.2+, and data at rest” is “encrypted using AES-256,” which is sound security, but encryption protects the data where it sits; it does not move it onshore or create a filing.
Reachability is the second, smaller half of the question. Because playback is served from offshore AWS, every mainland view drags a heavy video across the border, so Loom tends to load slowly or stall rather than cleanly block — but even a video that plays perfectly is still a recording of personal information stored outside China. And in the narrower case where you rely on Loom to deliver video to a public mainland audience, the site doing the embedding is itself subject to the ICP filing regime (State Council Order No. 292; MIIT Order No. 33), and an offshore video host gives you no mainland resource to file against.
This is a risk map, not a verdict: which obligations bite — cross-border consent, in-country storage, or a filing for public delivery — depends on who is on the recording, how much personal data you hold, and who your users are, and it is worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
Your team keeps using the tools it already knows. We add the piece an offshore video host cannot: compliant, ICP-filed delivery from inside the mainland, set in front of your existing origin — no rebuild, no second codebase, and no change to how your people record and share. Our China team maps whose personal information rides in your recordings, weighs your PIPL cross-border and data-residency obligations against your entity and data volumes, and stands up the in-country delivery and storage a lawful China presence needs, while your workflow stays exactly where it is.
Related reading:
