Does Salesforce Work in China? Data Residency, PIPL & the Alibaba Cloud Instance
On a standard global org, Salesforce stores your China contacts, leads and cases in an offshore Hyperforce region — none is in mainland China — so your CRM data crosses the border under PIPL. Salesforce does run in the mainland, but only on a separate, partner-operated Alibaba Cloud instance. A compliance-first look at the two paths.
Does Salesforce work in China?
Whether you can run Salesforce for mainland China is first a data-residency question, not a speed one. Salesforce is your CRM — it holds the contacts, leads and cases your revenue teams run on — and China's law responds to where that personal data lives.
On a standard global org, Salesforce keeps that data offshore: by its own data-residency model, "customer data is stored in the country where their org is located," with Hyperforce "options for the U.S., U.K., Germany, India, Japan, and more" — none in mainland China. So your China customers' records leave the country, a cross-border transfer of personal information PIPL governs. Salesforce does run in the mainland — but only on a separate, partner-operated path: Sales and Service Cloud "hosted on Alibaba Cloud" since December 18, 2023, which Salesforce says helps "comply with the latest data residency regulations." The table below is Salesforce's own wording and the rules each path triggers.
This is a risk picture, not a verdict — your obligations turn on your data volumes and your role. Our China team can map your Salesforce exposure with you →
What Salesforce Cloud's own documentation says about China
| Fact | Primary source |
|---|---|
| In Salesforce's own data-residency terms, "customer data is stored in the country where their org is located," and Hyperforce gives "options for the U.S., U.K., Germany, India, Japan, and more" — none in mainland China. So a standard global Salesforce org keeps your China contacts, leads and cases in whichever offshore region your org sits in, not on the mainland. | Salesforce — Hyperforce (salesforce.com/products/platform/hyperforce), retrieved 2026-10-07 |
| Salesforce does run in the mainland — but on a separate Alibaba Cloud instance. By Salesforce's own announcement, Sales Cloud, Service Cloud and Salesforce Platform went generally available "on Alibaba Cloud starting December 18, 2023," and "Exclusive features for mainland China will be available on Sales Cloud and Service Cloud hosted on Alibaba Cloud," to "help comply with the latest data residency regulations." That is a different, partner-operated path — not the global org you already run. | Salesforce Newsroom — Salesforce Sales and Service Cloud on Alibaba Cloud, December 18, 2023 |
| Because a global org holds that data offshore, moving your China contacts, leads and cases into it is a cross-border transfer of personal information PIPL governs. The personal-information handler — you, Salesforce's customer, not Salesforce — must give notice, obtain separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 |
| The exposure scales with volume and role, not merely with using the tool: under the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024 |
| For a CIIO or large-volume handler, personal information collected in China must be stored in mainland China (PIPL Article 40; CSL Article 39 (formerly Article 37)) — which an offshore global org cannot satisfy. And if your Salesforce powers anything public-facing to mainland visitors — an Experience Cloud community, a help center, a hosted lead-capture form — serving it from inside China attaches to an ICP filing (State Council Order No. 292; MIIT Order No. 33), which an offshore instance has no footing for. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37); State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Salesforce is not how fast it loads — it is where your CRM’s personal data is allowed to live, and whether any Salesforce-powered experience you show to Chinese users may be operated from inside the country at all. Salesforce answers the first half in its own words: on a standard global org your data sits in the Hyperforce region tied to that org, and none of those regions is in mainland China. It also runs inside the mainland — but only through a separate instance hosted on Alibaba Cloud. Those are the two paths, and which one you are on decides your exposure.
Salesforce in China at a glance
| What decides it | In Salesforce's own terms |
|---|---|
| Where a global org runs | “Customer data is stored in the country where their org is located,” and Hyperforce offers “options for the U.S., U.K., Germany, India, Japan, and more.” None of those regions is in mainland China. |
| Your China CRM data on a global org | Contacts, leads and cases captured from Chinese customers are held in that offshore region — a cross-border transfer of personal information PIPL governs. |
| Does Salesforce run in the mainland? | Yes — Sales Cloud, Service Cloud and Salesforce Platform “on Alibaba Cloud starting December 18, 2023,” “hosted on Alibaba Cloud,” expressly to “help comply with the latest data residency regulations.” |
| Is that your existing org? | No. The Alibaba Cloud instance is a separate, partner-operated path — not the global org your credentials already open. |
| Serving the public | A Salesforce-powered experience shown to mainland visitors from inside China — a community, a help center, a hosted form — attaches to an ICP filing; an offshore global org has no mainland footing for one. |
Path one — a global Salesforce org keeps your China data offshore
On a standard global org, Salesforce stores your data in the Hyperforce region tied to that org. In Salesforce’s own data-residency wording, “customer data is stored in the country where their org is located,” and the regions it offers are “options for the U.S., U.K., Germany, India, Japan, and more.” Not one of them is in mainland China. So the contacts, leads and cases your teams capture from Chinese customers are held outside the mainland — and that, not the paint time, is what China’s law responds to.
Under China’s Personal Information Protection Law, moving that personal information into an offshore org is a cross-border transfer: the handler — you, Salesforce’s customer, not Salesforce — has to give notice, obtain separate consent, and clear one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). The size of the duty scales with volume and role. Under the CAC’s March 2024 cross-border rules, a non-CIIO moving fewer than 100,000 individuals’ non-sensitive personal information in a calendar year is exempt from all three; a critical information infrastructure operator or large-volume handler, by contrast, must keep personal information collected in China inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — which an offshore org cannot do.
Path two — Salesforce in the mainland runs on a separate Alibaba Cloud instance
Salesforce does run inside mainland China — but not as a region of the org you already have. By Salesforce’s own announcement, Sales Cloud, Service Cloud and Salesforce Platform became generally available “on Alibaba Cloud starting December 18, 2023,” and “Exclusive features for mainland China will be available on Sales Cloud and Service Cloud hosted on Alibaba Cloud,” expressly to “help comply with the latest data residency regulations.”
That is a separate, partner-operated instance — reached and run differently from your global org, closer to a distinct deployment than a setting you switch on. It is also Salesforce’s own answer to the residency question: in-country hosting on a Chinese partner. So “we already run Salesforce” does not by itself place you on compliant footing for China — being on the global org and being on the Alibaba Cloud instance are two different places, and only one of them keeps your China data on the mainland.
When an ICP filing enters — a public-facing Salesforce experience
Data residency is one door; operating a public-facing service is the other. A purely internal CRM used by your own staff turns mostly on the residency and cross-border rules above. But the moment your Salesforce powers something shown to mainland visitors — an Experience Cloud community, a customer help center, a hosted lead-capture form — serving that experience from inside China attaches to an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must bind to a hosting resource physically in the mainland. A global org served from offshore has no mainland footing to file against.
This is a risk map, not a verdict: whether you face a cross-border-transfer duty, a data-localization duty, an ICP filing, or some combination depends on what your Salesforce does, how much personal data you hold, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Salesforce. We add the piece a global org cannot provide on its own: compliant, ICP-filed delivery from inside the mainland for any public-facing Salesforce experience, placed in front of your existing org — no rebuild, no second codebase, and no forced migration onto a different instance. Our China team maps your PIPL cross-border and data-residency exposure against your entity and data volumes, then stands up the in-country delivery and, where the law requires it, the in-country storage a lawful China presence needs — while your Salesforce org stays exactly where it already runs.
Related reading:
