Does OneSpan Work in China? Data Residency, PIPL & E-Signature Validity
OneSpan Sign stores signed agreements, signer identities and audit trails in offshore regions — the US, Canada, the EU (Ireland, Germany) or Australia — with no mainland-China region, so signing from China is a cross-border transfer of personal data under PIPL, and foreign e-signature validity is a separate question under China's Electronic Signature Law. A compliance-first look at the two doors.
Does OneSpan work in China?
Whether you can use OneSpan in China is decided first by where your signed agreements and your signers' identity data are stored — a data-residency question, not the load time a signer might notice first. However the signing pages behave on a given day, reachability is not the test that settles your legal exposure.
OneSpan's own Data Residency page lists the regions where OneSpan Sign runs — "United States," "Canada," "Ireland," "Germany" and "Australia" (with "Other countries - on request") — "by leveraging the global data center networks of our technology partners Amazon Web Services and Microsoft Azure." None is in mainland China. So when someone in China signs, the executed document, their identity evidence and the audit trail come to rest offshore — a cross-border transfer of personal information that PIPL governs, calling for notice, separate consent and a lawful transfer mechanism. A second, e-signature-specific question rides on top: whether that signature is a "reliable electronic signature," and the document type even eligible, under China's Electronic Signature Law. The table below pairs OneSpan's own wording with the rule each point triggers — and the compliant, ICP-filed in-country path they imply.
This is a risk picture, not a verdict — your obligations turn on your data volumes, the signer's location and your role. Our China team can map your OneSpan exposure with you →
Compliance snapshot
- ! Signed agreements, signer-identity evidence & audit trails stored offshore (US, Canada, EU or Australia) — never mainland China
- ! Every signature from China sends signer personal data across the border — PIPL applies
- ✕ No mainland-China data-residency region offered — "other countries" only on request, none in the mainland
- ! Whether the e-signature is "reliable" and the document eligible under China's Electronic Signature Law is a question for counsel
- ✓ A compliant path exists — ICP-filed in-country delivery & storage, no rebuild
What Onespan's own documentation says about China
| Fact | Primary source |
|---|---|
| In OneSpan's own words: OneSpan's Data Residency page lists the regions where OneSpan Sign runs — "United States," "United States - FedRAMP," "Canada," "Ireland," "Germany" and "Australia," with "Other countries - on request" — "by leveraging the global data center networks of our technology partners Amazon Web Services and Microsoft Azure." None of the listed regions is in mainland China — the nearest, Australia, is still offshore — so the signed agreements, signer-identity evidence and audit trail generated when someone in China signs come to rest in one of these offshore regions, not on Chinese soil. | OneSpan — Data Residency (Data Protection in the Cloud), retrieved 2026-10-07 |
| Because that data is created in China but stored abroad, PIPL treats each signing as a cross-border transfer of personal information. The personal-information handler — OneSpan's customer, not OneSpan — must give notice, obtain separate consent for the overseas transfer, and clear one lawful mechanism: a CAC security assessment, the CAC standard contract, certification, or another permitted basis. | PIPL Chapter III, Articles 38–43 |
| How heavy that duty is turns on volume and data type, not on merely enabling signing. Under the CAC's March 2024 cross-border rules, a non-CIIO moving fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification. But e-signing — especially when paired with OneSpan's identity verification — routinely captures sensitive personal information such as ID-document images alongside the signature and signer contact details, and sensitive data, higher volumes or CIIO status each pull the heavier mechanisms back in. | CAC — Provisions on Promoting and Regulating Cross-border Data Flows, March 2024 |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside mainland China (CSL Article 39 (formerly Article 37); PIPL Article 40). OneSpan lists no mainland-China region, so the only way to keep your China signers' documents and identity records on Chinese soil is to run that storage and delivery from inside the mainland — the act that brings an ICP filing into play. | OneSpan — Data Residency, retrieved 2026-10-07; CSL Article 39 (formerly Article 37); PIPL Article 40 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a team signing documents with mainland-China users, the deciding question about OneSpan is not how quickly the signing page paints — it is where your signed agreements and your signers’ personal data are allowed to live, and whether the resulting signature stands up under Chinese law. OneSpan Sign answers the first part in its own documentation: it runs in a fixed set of offshore regions, and not one of them is inside mainland China. That makes a China-facing signing workflow reachable but hosted entirely offshore, which turns every signature from China into a cross-border transfer of personal data governed by PIPL — and leaves a second, distinct question about whether a foreign e-signature is legally “reliable” at all. The signing may complete; the data residency and the enforceability are the exposure.
OneSpan in China at a glance
| What decides it | In OneSpan's own terms |
|---|---|
| Where it runs | OneSpan lists OneSpan Sign regions as the United States, United States – FedRAMP, Canada, Ireland, Germany and Australia, with “Other countries - on request,” hosted on “the global data center networks of our technology partners Amazon Web Services and Microsoft Azure.” No region is in mainland China; the nearest, Australia, is still offshore. |
| What gets stored | The signed agreement, the signer-identity evidence a signing ceremony captures, and the audit trail — all held in the account's offshore region, outside the mainland. |
| Your China signers' data | Personal information of people signing from China comes to rest abroad — a cross-border transfer PIPL governs, with notice, separate consent and a lawful transfer mechanism required of you, not of OneSpan. |
| Is the signature valid? | A separate question: China's Electronic Signature Law treats a signature as equivalent to handwriting only where it is a “reliable electronic signature,” and reserves certain document types — a point to settle with counsel, not one the data layer answers. |
| Serving & storing in-country | Keeping the signing workflow and its records on Chinese soil means delivering from inside the mainland — which turns on an ICP filing. OneSpan offers no mainland region to file against. |
No mainland region, so your signers’ data lands offshore
OneSpan is explicit about where OneSpan Sign lives. Its Data Residency page lists the service running in the “United States,” “United States - FedRAMP,” “Canada,” “Ireland,” “Germany” and “Australia,” with “Other countries - on request,” “by leveraging the global data center networks of our technology partners Amazon Web Services and Microsoft Azure.” Every one of those is outside mainland China, and the closest — Australia — is no exception. So the executed document, the identity details gathered during signing, and the audit trail that proves who signed and when all come to rest in a region beyond the mainland.
That geography is what makes this a legal question rather than a networking one. Under China’s Personal Information Protection Law, personal information that is collected in China and held abroad is a cross-border transfer, and the obligation falls on the personal-information handler — you, the OneSpan customer, not OneSpan. You have to give notice, obtain separate consent for sending the data overseas, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. Because OneSpan’s platform also verifies identities, a signing ceremony often captures sensitive personal information — government-ID images and the signatures themselves — which raises the bar rather than lowers it.
A “reliable” signature is a separate question from the data
Even once the data question is handled, a foreign e-signature is not automatically enforceable in China. The Electronic Signature Law gives an electronic signature the same legal weight as a handwritten one only when it qualifies as a reliable electronic signature — broadly, one whose creation data is under the signatory’s sole control and where later changes are detectable — and it carves out categories of documents that commonly include personal matters such as marriage, adoption and succession. Whether your specific documents clear that bar, and whether a signature produced on an offshore platform is recognized for them, is a question to put to counsel. It is worth separating from the data-residency analysis, because a workflow can be perfectly reachable and still produce a signature whose legal standing you have not confirmed.
Reachable is not the same as cleared to operate
OneSpan being reachable from China settles nothing on its own. A signer in the mainland may well open the email link and complete the ceremony; reaching a service is not the test, because reaching it gives you neither in-country data residency nor a filing to operate against. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40) — a duty none of OneSpan’s offshore regions can meet. And serving or storing the signing workflow from inside the mainland is itself the act that turns on an ICP filing under State Council Order No. 292 and MIIT Order No. 33. Those are compliance facts, and no amount of network tuning closes them.
This is a risk map, not a verdict: whether you need separate consent and a transfer mechanism, in-country storage, an ICP filing, or all of them depends on what you sign, how much personal data you hold, who your signers are, and whether your documents are even eligible — all worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep signing on OneSpan. We add the piece an offshore e-signature platform cannot: compliant, ICP-filed delivery and storage from inside the mainland, placed in front of your existing OneSpan workflow — no rebuild, no second codebase, and no move off OneSpan. Our China team maps your PIPL cross-border and data-residency obligations against your entity and the data you capture, flags where e-signature enforceability needs counsel, and stands up the in-country delivery and storage a lawful China presence requires, while your signing workflow stays exactly where it already runs.
Related reading:
Frequently Asked Questions
Does OneSpan store Chinese signers' data in China?
No. OneSpan's own Data Residency page lists OneSpan Sign's regions as the United States (including a FedRAMP instance), Canada, Ireland, Germany and Australia, hosted on Amazon Web Services and Microsoft Azure, with other countries only "on request." None of the listed regions is in mainland China, so the signed documents, identity evidence and audit trail of people who sign from China are held offshore — which is what makes each signing a cross-border transfer under PIPL.
Is it against the law to use OneSpan in China?
Not inherently, but two separate questions decide your exposure. First, data: sending signers' personal information — and, where identity verification is used, sensitive data such as ID-document images — to servers outside the mainland is a cross-border transfer that PIPL permits only with notice, separate consent and a lawful transfer mechanism, and data-localization can apply depending on your role (for example, whether you are a CIIO) and the volume of personal information you handle. Second, enforceability: whether a foreign platform's signature is a "reliable electronic signature," and whether the document type is eligible, is governed by China's Electronic Signature Law and is worth confirming with counsel. Treat this as a risk to assess, not a blanket prohibition.
Can 21YunBox help make OneSpan compliant and usable in China?
Yes. Our China team can help you assess the cross-border and data-residency exposure for your signing volumes and the data you capture, and provide the compliant, ICP-filed in-country delivery and storage OneSpan does not offer in the mainland — so you can keep OneSpan rather than replace it. Get in touch to work through your specific case.
