Does Railway Work in China? ICP, Data Residency & an Offshore PaaS
Railway runs no region inside mainland China — its services and databases deploy to US West, US East, EU West and Southeast Asia — so a China-facing app is served offshore with no ICP-filing path, and the personal data your app stores lands outside the mainland under PIPL. A compliance-first look at the two doors.
Does Railway work in China?
Whether Railway works for a mainland-China audience is a licensing and data-residency question first, and a speed question only after that. Railway is a platform-as-a-service: it builds and deploys your apps, managed databases and volumes into the region you pick — and China's law turns on where that region sits.
By Railway's own regions reference you deploy to four regions — US West (California), US East (Virginia), EU West (Amsterdam) and Southeast Asia (Singapore) — and not one is inside mainland China. So a public app you run on Railway reaches mainland users from offshore, with no ICP-filing path on Railway itself, and any personal data your app or its database keeps for Chinese users is a cross-border transfer PIPL governs. The snapshot below maps Railway's own footprint to the China rules it triggers, and the compliant, ICP-filed in-country path that closes them.
This is a risk map, not a legal verdict — what you owe turns on what you serve and the personal data you hold. Our China team can map the ICP and cross-border path with you →
Compliance snapshot
- ✕ Railway runs no mainland-China region, so a public app on it has no ICP-filing path
- ! Your Railway services, databases and volumes deploy to offshore regions (US West, US East, EU West, Southeast Asia)
- ! Chinese users' personal data in a Railway app, database or volume is a cross-border transfer under PIPL
- ! A Railway app can be reached from China, but reaching it is delivery — it creates no ICP filing or residency
- ✓ A compliant path exists: ICP-filed in-country delivery in front of your Railway origin
What Railway's own documentation says about China
| Fact | Primary source |
|---|---|
| In Railway's own regions reference, an app deploys to one of four regions — "US West Metal" (California), "US East Metal" (Virginia), "EU West Metal" (Amsterdam) and "Southeast Asia Metal" (Singapore) — so you can "deploy your applications closer to your users no matter where they are located." None is inside mainland China; the nearest, Singapore, is still offshore, and a Railway managed database and its volume live in the same region as the service they back. | Railway Docs — Regions, retrieved 2026-10-07 |
| Serving a public website or app to mainland-China visitors from inside the mainland requires an ICP filing (ICP 备案) under the State Council's Order No. 292 and MIIT's Order No. 33, and that filing must attach to a hosting resource physically inside the mainland. Because Railway operates no mainland-China region, a Railway-hosted app has nothing on Railway to file against — it is reaching China from offshore. | PRC Regulations on Telecommunications (State Council Order No. 292); Administrative Measures for the Filing of Non-operational Internet Information Services (MIIT Order No. 33) |
| Keep Chinese users' personal data in a Railway app, managed database or volume and it lives in one of those offshore regions, so PIPL treats it as a cross-border transfer: the handler — you, Railway's customer, not Railway — must give notice, obtain separate consent, and clear one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). | Personal Information Protection Law, Chapter III, Articles 38–43 |
| For a critical information infrastructure operator or large-volume handler, personal information collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Railway publishes no mainland-China region, so none of its four regions can meet that residency duty — holding the data on Chinese soil means running the storage on infrastructure inside the mainland, which is where an ICP filing re-enters. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| How heavy the duty is scales with volume and role, not with the bare fact of using an offshore PaaS: under the CAC's March 2024 cross-border rules, a non-CIIO moving the non-sensitive personal information of fewer than 100,000 people in a calendar year is exempt from the security assessment, standard contract and certification — a threshold worth pinning down before you assume you are in the clear. | CAC — Provisions on Promoting and Regulating Cross-border Data Flows, March 2024 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For an audience in mainland China, what decides Railway is not its paint time — it is which country your services are permitted to run in, and which country the data they hold is permitted to sit in. Railway is a platform-as-a-service, and its own documentation answers both: it runs no region inside mainland China. That makes a China-facing Railway app reachable yet wholly offshore — with no footing for the ICP filing a public mainland site requires, and with any personal data your app or its database keeps for Chinese users becoming a cross-border transfer China’s law governs. Reachability is the delivery detail; the licensing and the data residency are where the risk sits.
Railway in China at a glance
| What decides it | In Railway's own terms |
|---|---|
| Where it runs | Four regions — US West Metal (California), US East Metal (Virginia), EU West Metal (Amsterdam) and Southeast Asia Metal (Singapore). None sits inside mainland China; the nearest, Singapore, is still offshore. |
| What runs there | Railway builds and deploys your apps and services into the region you choose, and its managed databases and persistent volumes sit in that same region. Whatever your app stores lives wherever that region is. |
| Serving the public | An app served to mainland visitors from inside China needs an ICP filing tied to a mainland hosting resource. With no mainland region, Railway has no ICP-filing path of its own. |
| Your data on Railway | Personal data of Chinese users held in a Railway app, managed database or volume sits offshore — a cross-border transfer PIPL governs, plus a data-localization duty for CIIOs and large-volume handlers that offshore regions cannot meet. |
| Is it reachable? | Reachability is a delivery question, not a compliance one. Even when a Railway app loads for mainland users, it is served from offshore and creates neither an ICP filing nor in-country residency. |
No mainland region, so no ICP filing to stand on
Railway deploys your apps to four regions — US West in California, US East in Virginia, EU West in Amsterdam and Southeast Asia in Singapore — and, in its own words, the aim is to “deploy your applications closer to your users no matter where they are located.” None of the four sits in mainland China, and the closest of them, Singapore, is still outside it.
That geography decides the licensing question long before performance does. A public website or app delivered to mainland visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and the filing has to attach to a hosting resource that physically sits in the mainland. Railway has no such resource, so there is nothing on Railway to file against. This is the point at which “we already ship on Railway” stops being enough: reaching China is not the same as being licensed to operate there, and neither a one-command deploy nor the region picker conjures the mainland footing a filing needs.
Your China users’ data lives offshore
Because Railway places your application and its managed databases in the same offshore region, the personal data your app gathers from Chinese users comes to rest wherever you deployed — the United States, the Netherlands or Singapore, never the mainland. Under China’s Personal Information Protection Law that movement is a cross-border transfer, and the obligation falls on the handler — you, Railway’s customer, not Railway — to give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. Should you be a critical information infrastructure operator or a large-volume handler, personal information collected in China has to be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty not one of Railway’s four regions can meet.
Reaching China is not being cleared for China
China does not categorically block a Railway app, but that is the delivery half of the question, and it is the half that misleads. However quickly it answers a mainland visitor, it answers from offshore — and answering from there gives you neither an ICP filing nor in-country data residency. Those two gaps are compliance facts about where the hosting sits and where the data lands, not latency you can optimize away. A faster offshore response is still an offshore response.
This is a risk map, not a verdict: whether you need an ICP filing, in-country storage, or both turns on what you serve, how much personal data you hold, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You carry on building and shipping on Railway. We supply the single piece a platform with no mainland presence cannot: compliant, ICP-filed delivery from inside the mainland, placed in front of your existing Railway origin — no rebuild, no second codebase, no move off Railway. Our China team maps your ICP and data-residency obligations against your entity and data volumes, then stands up the in-country delivery and storage that a lawful China presence needs, while your application keeps running exactly where it already does.
Related reading:
Frequently Asked Questions
Does Railway have a data center in mainland China?
No. By Railway's own regions reference an app deploys to US West (California), US East (Virginia), EU West (Amsterdam) or Southeast Asia (Singapore) — none inside mainland China. The nearest, Singapore, is still offshore, so an app served to mainland visitors from Railway is delivered from outside the country and has no ICP-filing path on Railway itself.
Is it against the law to run a China-facing app on Railway?
Not inherently. Two separate duties create the exposure: serving a public app to mainland visitors from inside China needs an ICP filing, which attaches to mainland hosting Railway does not offer; and holding Chinese users' personal data in an offshore Railway app, database or volume is a cross-border transfer PIPL governs, with an in-country storage duty for CIIOs and large-volume handlers. Treat it as a risk to size with counsel for your data and role, not a blanket ban.
Can 21YunBox help run a Railway app in China?
Yes. Our China team can assess your ICP and data-residency exposure and provide the compliant, ICP-filed in-country delivery and storage an offshore PaaS cannot — placed in front of the Railway origin you already run, with no rebuild. Get in touch to work through your specific setup.
