Does Postman Work in China? Data Residency, ICP & Cross-Border Rules

Postman is a cloud API platform: your API collections, environments and the secrets and variables inside them live on Postman's own AWS servers in the EU and the U.S. — no mainland-China region. For your China users that is offshore personal data under PIPL, and it concentrates your API keys abroad.

By the 21YunBox Compliance Team · Reviewed 2026-10-13 · Verified against Postman's own documentation

Does Postman work in China?

Whether you can use Postman in mainland China is a data-residency and secrets question, not a speed one. Postman is reachable from China, but it is a cloud platform: your API collections, environments and the variables and secrets inside them are stored on Postman's own servers.

By Postman's own security documentation, its product data and backups are hosted on AWS in the EU and the U.S. — there is no mainland-China region — and it keeps your "environment variables, secrets, and access tokens" in Postman Cloud. For the people your APIs touch in China, personal data captured in those collections is held offshore: a cross-border transfer of personal information PIPL governs, needing notice, separate consent and a transfer mechanism, with in-country storage for a CIIO or large-volume handler. Because collections routinely embed credentials and sample records, Postman also concentrates your keys and sample PII abroad.

This is a risk picture, not a verdict — your duties turn on your data volumes and role. Our China team can map your Postman data and secrets exposure →

What Postman's own documentation says about China

Fact	Primary source
Postman hosts your product data offshore, with no mainland-China region. Its security page states Postman "has no in-house data centers and uses AWS to manage its data centers' physical and environmental security," and that "Our company's product data and backups are hosted on AWS servers in the EU and the U.S." The only data-residency option it publishes is an EU instance "hosted in eu-central-1 (Frankfurt)"; the Echo service is "based in the US region." None of these is in mainland China.	Postman — Security page and EU Data Residency documentation, retrieved 2026-10-13
Postman concentrates your secrets in its cloud. Postman keeps your "environment variables, secrets, and access tokens" and encrypts them at the application layer; the only path it names for keeping secrets off its servers is the Local Vault, "Encrypted on-device only with no secrets synced to Postman Cloud." Everything else — the API keys, database credentials and OAuth tokens in your environments — is held in Postman Cloud offshore. "Postman Private Cloud" is a single-tenant deployment "that Postman manages on your behalf," with no stated mainland-China location, so it is not a verified in-country residency path.	Postman — Security page (Secret Security, Private Cloud, FAQ), retrieved 2026-10-13
China users' personal data held offshore is a cross-border transfer under PIPL. Sending the personal information inside your collections and environments abroad requires notice, separate consent and a transfer mechanism (PIPL Articles 13/23 and 38–40); for a critical information infrastructure operator or a high-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)).	PIPL Articles 13, 23, 38–40 and 40; Cybersecurity Law Article 39 (formerly Article 37)
A China-facing app or portal needs its own ICP filing. Any app, developer portal or API console you serve to mainland visitors is an internet information service and requires an ICP filing bound to mainland hosting (State Council Order No. 292; MIIT Order No. 33) — making the offshore platform merely reachable does not satisfy this, and it does not resolve where your API data and secrets live.	State Council Order No. 292; MIIT Order No. 33

Sources verified by the 21YunBox compliance team on 2026-10-13.

Ask whether Postman “works” in mainland China and the honest answer starts with where your API work is stored, not with how fast the app opens from Shanghai. Postman is a cloud API platform: the collections you build, the environments you share, and the variables and secrets inside them are kept on Postman’s own servers. By Postman’s own security documentation, that product data and its backups live on AWS in the EU and the U.S., and the only data-residency choice it offers is an EU (Frankfurt) instance — there is no mainland-China region. So for the people your APIs touch in China, any personal data captured in a collection is held offshore the moment it is saved, and your API keys, database credentials and OAuth tokens are concentrated abroad at the same time. The app being reachable is real, but it is the least of what you are deciding.

Postman EU Data Residency documentation stating data is stored in EU data centers and that an instance of Postman is hosted in eu-central-1 (Frankfurt), with the default platform and Echo service in the US region and no mainland-China region listed — Postman's own EU Data Residency documentation names its only non-US data-residency region: “An instance of Postman hosted in eu-central-1 (Frankfurt) is available for Enterprise customers.” The default platform and the Echo service run in the US region; no region is in mainland China. Source: learning.postman.com — Postman EU Data Residency

Postman in China at a glance

What decides it	In Postman's own terms
Where it runs	Postman's security page: “Our company's product data and backups are hosted on AWS servers in the EU and the U.S.” The only data-residency option its docs offer is an EU instance “hosted in eu-central-1 (Frankfurt)”; the Echo service is “based in the US region.” No region is inside mainland China.
What it holds	Your API collections and environments, plus — in Postman's own words — “environment variables, secrets, and access tokens,” which it encrypts and keeps in Postman Cloud. Collections routinely embed credentials and sample request/response data, so personal information rides along inside them.
Where that data sits	Offshore. Because product data and backups are on AWS in the EU and the U.S., any personal data your collections capture from users in China is transferred abroad — a cross-border transfer PIPL governs, with a localization duty an offshore-only platform cannot meet.
Secrets + reach into your systems	Environments hold the API keys, database credentials and OAuth tokens your developers use to reach your own systems — including systems inside China. Only the Local Vault is “Encrypted on-device only with no secrets synced to Postman Cloud,” so by default those secrets, and cloud-run monitors and saved responses, carry your keys and your systems' data into the offshore cloud.
A self-hosted option?	Postman is cloud-based. “Postman Private Cloud” is a single-tenant deployment “that Postman manages on your behalf,” with no stated mainland-China location — so it is not a verified in-country residency path. Confirm current options with Postman before relying on one.
Is it reachable?	Whether the Postman app opens cleanly for mainland users is a delivery question — separate from, and lesser than, whether you are cleared to hold this API data and these secrets offshore at all.

Where Postman runs — and that settles the first question

Postman is hosted software, and in its own security documentation it names where. Its security page states that “Postman has no in-house data centers and uses AWS to manage its data centers’ physical and environmental security,” and that “Our company’s product data and backups are hosted on AWS servers in the EU and the U.S.” The only data-residency choice it publishes is an EU one: “If you select the EU Data Residency, your data is stored in EU data centers,” delivered as “An instance of Postman hosted in eu-central-1 (Frankfurt),” while “The Postman Echo service … is based in the US region.” There is no mainland-China region. So wherever your team’s workspace sits, the collections, environments and secrets Postman keeps for you are held offshore — in the EU or the U.S. That single fact decides the compliance question before reachability is ever measured: this is not about whether the builder paints in Shanghai, but about API data and credentials leaving the country the moment Postman stores them.

Prong one — your China users’ data in those collections is a cross-border transfer

Postman’s job is to hold your API work. The collections, environments, saved example responses and variables accumulate in your workspace, and Postman keeps all of it as product data “hosted on AWS servers in the EU and the U.S.” When those collections capture or pass through the personal information of people in China — account records, contact details, identifiers in a sample request or response — moving it out of China engages the Personal Information Protection Law: you must give notice, obtain separate consent, and clear one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification), under PIPL Articles 13/23 and 38–40. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40) — a residency requirement an offshore-only Postman cannot satisfy. This is application and user data, not “can the app stream,” and it is the spine of the question.

Prong two — Postman concentrates your secrets offshore and reaches into your systems

Postman does not just store requests; it stores the keys to your systems. In its own words it keeps “environment variables, secrets, and access tokens” — and the only path it names for keeping secrets off its servers is the Local Vault, “Encrypted on-device only with no secrets synced to Postman Cloud.” Everything outside that option is, by design, in Postman Cloud. Those environments hold the API keys, database credentials and OAuth tokens your developers use to reach your own back ends — including systems inside China. When a cloud-run monitor executes, or a saved example captures a live response, the platform pulls data from those systems into its offshore cloud: the tool’s normal operation is itself a cross-border movement, and a concentration of your credentials abroad. Postman even ships cloud secret detection to catch credentials that land in collections — an acknowledgment that, in practice, they routinely do. A probe that only checks whether the editor opens never sees any of this.

Why a reachability check misses all of this

A test that only asks “does Postman load from Shanghai?” measures the wrong thing. It cannot see that your collections, environments and secrets are held on AWS outside the mainland, it cannot see the notice-consent-and-mechanism duties that attach to the China personal data inside those collections, and it cannot see that your API keys and your systems’ data are concentrated offshore. Making the platform merely reachable does not move the regulated data or the secrets in-country, and it does not create the transfer basis PIPL requires. Reaching a Chinese audience and being cleared to hold and carry their data are two different tests — and only one of them shows up on a latency chart.

Where 21YunBox fits — map, localize, deliver

We do not ask you to leave Postman. We add the layer a hosted, offshore API platform cannot. Map: we inventory what your workspace holds — collections, environments, saved responses, variables and the API keys, database credentials and OAuth tokens inside them — which of your own systems Postman reaches, where it is hosted, and the consent and residency basis for the China data in it. Localize and govern: we help you keep the regulated application and user data — and those secrets — in-country, with an in-country backend or vault where one is needed, set the Article 13/23 notice and separate-consent basis, and minimize what crosses the border. Deliver: we ICP-file any China-facing app or portal and stand up compliant, in-country delivery with the 21YunBox Optimizer in front of what you already run — no rebuild, no second codebase. 21YunBox never uses or suggests circumvention of any kind.

This is a risk map, not a verdict: whether you owe notice and consent, a transfer mechanism, in-country storage, an ICP filing, or some combination depends on your entity, your data volumes and what your collections carry — worth settling with counsel before you roll Postman out to China-facing work.

Get a compliance assessment →

Related reading:

Frequently Asked Questions

Does Postman store Chinese users' data in China?

No. By Postman's own security documentation, its product data and backups are hosted on AWS servers in the EU and the U.S., and the only data-residency option it offers is an EU (Frankfurt) instance. There is no mainland-China region, so the collections, environments and secrets Postman holds — and any China personal data inside them — sit offshore.

Is it against the law to use Postman in China?

Not inherently. The issues are the cross-border transfer of personal information carried inside your collections and the concentration of your API keys and credentials offshore. PIPL permits the transfer if you give notice, obtain separate consent and meet one of its transfer mechanisms; whether you also face a data-localization duty depends on your role (for example, whether you are a CIIO) and the volume of personal information you handle. Treat it as a risk to assess with counsel, not a blanket prohibition.

Can 21YunBox help make our Postman stack compliant in China?

Yes. Our China team can map the cross-border, data-residency and secrets exposure for your data volumes and role, keep the regulated application and user data — and those credentials — in-country where needed, and stand up the compliant, ICP-filed in-country delivery in front of what you already run. Get in touch to work through your specific case.