Does Recurly Work in China? Data Residency, ICP & Cross-Border Rules
Recurly is cloud-only subscription billing: your China customers' identities, subscriptions, invoices and payment-method data live in its offshore US or EU regions, none in mainland China — so it is held abroad under PIPL, and the money movement needs a licensed domestic payment path.
Does Recurly work in China?
Whether you can run Recurly for a China operation is a compliance-risk question — data residency and payment licensing — not a speed one.
Recurly is a cloud-only subscription-billing platform, and by its own documentation it hosts customer data only in the US (Virginia, Oregon) or the EU (Germany, Belgium), with no mainland-China region — so your China customers' identities, subscription and invoice records and payment-method references rest offshore, a cross-border transfer PIPL governs. The half a reachability check never sees: Recurly is a billing layer, not a licensed China payment institution, so the actual movement of money from China customers must run over a licensed domestic payment path (State Council Decree No. 768) — the platform sits on top of that.
This is a risk map, not a verdict — your obligations turn on your volumes, your entity and your role. Our China team can map your Recurly exposure with you →
What Recurly's own documentation says about China
| Fact | Primary source |
|---|---|
| In Recurly's own words: “Recurly empowers you with a choice of data center locations across two major regions: the United States and the European Union,” and “In the US, our data centers are located in Virginia and Oregon, while in the EU, we have centers in Germany and Belgium.” The region is fixed at signup and cannot be migrated later — and none of these regions is in mainland China, so billing data collected from your China customers is stored offshore. | Recurly Docs — Data hosting, retrieved 2026-10-12 |
| Recurly's Customer Data Processing Locations page lists where it may process personal information — Brazil, Colombia, the European Union, India, Mexico, the Philippines, Ukraine, the United Kingdom and the United States. Mainland China is not among them, confirming that China customers' billing and payment data is both stored and handled offshore. | Recurly — Customer Data Processing Locations (Last Updated June 18, 2026), retrieved 2026-10-12 |
| A billing platform orchestrates the charge, but moving money for users in China is a licensed activity. Under China's Regulations on Non-Bank Payment Institutions (State Council Order No. 768), an offshore institution that provides cross-border payment services to users in China must establish a payment institution within China (Article 2), and transaction processing, settlement and data storage must occur inside China (Article 19). A foreign subscription-billing platform is not that licensed institution, so the money movement needs a licensed domestic path underneath it. | China Regulations on the Supervision and Administration of Non-Bank Payment Institutions (State Council Order No. 768), Articles 2 and 19 |
| Customer and payment-method personal information collected in China and held in Recurly's offshore regions is a cross-border transfer under PIPL Articles 38–40, layered on the Article 13/23 notice-and-consent duty. For a critical information infrastructure operator or high-volume handler, Cybersecurity Law Article 39 (formerly Article 37) requires personal information generated in China to be stored in the mainland — which an offshore-only tenant cannot satisfy. | China Personal Information Protection Law, Arts. 13, 23, 38–40; Cybersecurity Law Art. 39 (formerly Art. 37) |
Sources verified by the 21YunBox compliance team on 2026-10-12.
For a company running Recurly to bill a mainland-China operation, the deciding question is not how quickly the checkout page or the account-management portal paints from Shanghai. It is where your data is allowed to live, and who is licensed to move the money — because Recurly is the system of record for your China subscription revenue. It holds the identities of your China customers, their subscription and contract records, invoices and revenue history, and the payment-method references tied to each account. Recurly is a cloud-only SaaS platform, hosted in its offshore US or EU regions with no region inside mainland China — so all of that rests abroad. And because taking recurring payments from people in China is a licensed activity, a foreign billing platform cannot be the thing that lawfully moves the money. That makes this a compliance-risk question first, not a performance one.
Recurly in China at a glance
| What decides it | In Recurly's own terms — and China's law |
|---|---|
| What it holds | Your China subscription revenue's system of record: the identities of your China customers (names, emails, billing addresses, phone), their subscription and contract records, invoices and revenue history, and the payment-method references tied to each account — plus the hosted Checkout, Hosted Payment Pages and Hosted Account Management surfaces your China customers interact with. |
| Where it runs | Recurly is a cloud-only SaaS platform. By its own documentation it hosts data in two regions — the US (Virginia, Oregon) and the EU (Germany, Belgium); the region is fixed at signup and cannot be migrated, and none is inside mainland China. It also states data may be processed from further offshore locations — none of them China. |
| Customer & payment-method PII | Your China customers' identities and payment-method data rest in whichever offshore region your site is assigned — a cross-border transfer under PIPL Articles 38–40, layered on the Article 13/23 notice-and-consent. For a critical information infrastructure operator or a high-volume handler, Cybersecurity Law Article 39 (formerly Article 37) requires China-collected personal information to be stored in the mainland. |
| Moving the money — a payment-licensing door | This is the half a speed test never sees. Recurly orchestrates the recurring charge, but taking payment from users in China is a licensed activity. Under the Non-Bank Payment Institutions regime (State Council Order No. 768), an offshore provider of cross-border payment services to China users must establish a China entity (Article 2), with processing, settlement and data storage inside China (Article 19). A foreign billing platform is not that licensed institution — it needs a licensed domestic payment path underneath it. |
| A China-facing checkout or portal | A Checkout page, Hosted Payment Page or Hosted Account Management page served to mainland users is an internet information service, so it carries an ICP filing (备案) duty bound to a mainland hosting resource. A Recurly-hosted page runs on offshore infrastructure, so it offers no ICP-filing path of its own. |
| Reachability is not the axis | Whether the checkout loads quickly from the mainland is operational, not the compliance question. What decides it is where the customer and payment data live and who is licensed to move the money. 21YunBox helps you keep the regulated data in-country over a licensed payment route, ICP-file any public page, and deliver it compliantly — the 21YunBox Optimizer — in front of the Recurly you already run. |
What it actually holds — the system of record for your China revenue
Recurly is not a static asset like a font or a script; it is the operational core of your China subscription business, and it concentrates two kinds of data China’s law cares about. The first is personal and financial information: the identities of your China customers — names, work or personal emails, billing addresses and phone numbers — together with their subscription and contract records, invoices, revenue history, and the payment-method references (tokenized card or account details, expiry, billing identity) held against each account. The second — the half a reachability check never sees — is the money movement itself: Recurly is the billing and orchestration layer that initiates recurring charges, and taking those payments from people in mainland China is a regulated, licensed activity that a foreign platform cannot perform on its own. Because Recurly is a cloud-only SaaS platform hosted in its offshore US or EU regions, your China customers’ billing and payment data is held and processed abroad by default, while the lawful movement of their money has to run over a path licensed inside China.
The doors: residency, payment licensing, and ICP
The first door is personal-information residency. The customer identities and payment-method data your Recurly site collects from people in China are personal information under China’s Personal Information Protection Law, and holding them in an offshore region is a cross-border transfer (数据出境). The duty lands on you, the handler, not on Recurly: Articles 13 and 23 require notice and a basis to collect the data, and Articles 38–40 require a transfer mechanism to send it abroad — a CAC security assessment, the CAC standard contract, or certification. Where the billing record carries sensitive personal information, PIPL Articles 28–29 raise the bar with a specific-purpose, necessity and separate-consent test. And for a critical information infrastructure operator or a high-volume handler, the Cybersecurity Law’s Article 39 (formerly Article 37 — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, with its substance unchanged) requires personal information generated in China to be stored in the mainland, which an offshore site cannot satisfy.
The second door is the one that makes a billing platform different from an ordinary SaaS: the money. Recurly orchestrates the recurring charge, but moving funds from users in mainland China is a licensed activity governed by the Regulations on the Supervision and Administration of Non-Bank Payment Institutions (非银行支付机构监督管理条例, State Council Order No. 768). Article 2 requires an offshore institution that provides cross-border payment services to users in China to establish a non-bank payment institution within China; Article 19 requires transaction processing, fund settlement and data storage to happen inside China. A foreign subscription-billing platform is not that licensed institution — so the actual movement of money has to run over a licensed domestic payment path, and Recurly sits on top of it. The compliance question is where the customer and payment data live and who is licensed to move the money; a reachability check sees neither.
The third door is the ICP filing. If you publish a China-facing Checkout page, Hosted Payment Page or Hosted Account Management page to mainland users, you are running a public internet information service, and that turns on an ICP filing (ICP 备案) duty bound to a hosting resource physically inside the mainland. A Recurly-hosted page runs offshore, so there is nothing on it to file against — tuning the stack does not create the mainland footing a filing needs.
A reachability check never sees this
Recurly is not the kind of service that simply refuses to load in China — the exposure is quieter and more durable than a slow paint. Even if the checkout and the account portal opened instantly, using them would still place your China customers’ identities and payment-method data outside the country, and still leave the money moving over a path that is not licensed inside China. A reachability test answers “did the page come back?”; it is blind to where the subscription and payment records come to rest, and to who is lawfully allowed to move the funds. Where the data lives and who is licensed to move the money, not how fast the page arrives, is what China’s law responds to.
This is a risk map, not a verdict that Recurly is “blocked” or “illegal” in China. Which duties bite your case turns on your entity, what your billing records actually hold, your role under Chinese law, your data volumes, and how you take payment — worth settling the specifics with counsel before your China revenue depends on it.
The lawful path — map, localize, deliver
There is a compliant way to run subscription billing for a China operation, and it sits in front of the Recurly your team already uses — no rebuild, no second tool, no migration.
First, map: our China team inventories what your Recurly site holds — the customer identities, subscription and invoice records, payment-method references, and any China-facing Checkout or hosted page — establishes which offshore region hosts it, the ICP status of any public page, and the consent, residency and payment-licensing basis each flow relies on. We build the technical picture; the legal conclusions are settled with counsel.
Then localize/govern: we help you keep the regulated data — customer and payment-method personal information and the billing record — on a lawful in-country path, obtain the Article 13/23 notice-and-consent, and route the actual money movement through a licensed domestic payment path rather than leaving it to a foreign platform. Localize means keeping the data in-country and the payment under a licensed route — never a path that ships the data offshore or moves money unlicensed.
Then deliver: any public China-facing Checkout or hosted page is an internet information service, so it carries an ICP filing duty bound to mainland hosting and needs compliant, in-country delivery. 21YunBox stands that up — the 21YunBox Optimizer — in front of what you already run, so it serves your users in China legally and compliantly. 21YunBox never uses or suggests circumvention of any kind — we keep in-country what the law says must stay, deliver the rest compliantly from inside the mainland, and never move personal information or money across the border by stealth. Making an offshore billing platform merely reachable is not the answer; keeping the regulated data in-country, running the money over a licensed domestic path, and ICP-filing the public page is. 21YunBox is a compliance overlay and partner to the billing platform you already run, not a competitor to it.
Related reading:
- How to get an ICP filing for China
- Cross-border data transfers under PIPL
- China’s Personal Information Protection Law (PIPL)
- China’s Cybersecurity Law
- China’s Non-Bank Payment Institutions Regulations (Order No. 768)
