Does Salesforce Commerce Cloud Work in China? Data Residency, ICP & Cross-Border Rules

For a brand selling into mainland China, the decision about Salesforce Commerce Cloud is not a performance benchmark — it is a licensing and data question, and it comes in three parts: the store, the money, and the data behind both. Salesforce Commerce Cloud (B2C Commerce, formerly Demandware) is Salesforce-hosted SaaS: the catalog, your shoppers’ accounts, their carts, their orders and their payment references all live on Salesforce’s own regions, and Salesforce publishes where those regions are. None of them is in mainland China. That single fact opens two licensing doors a commerce team has to walk through before launch — one for the storefront, one for the money — and sets a data-residency floor beneath both. Salesforce Commerce Cloud is an excellent platform, and nothing here asks you to leave it; this is about the China-delivery and compliance layer it was never built to provide. 21YunBox never uses or suggests circumvention of any kind.

Salesforce Commerce Cloud in China at a glance

No mainland region — and the Alibaba Cloud route is a different product line

Salesforce Commerce Cloud is not something you host; Salesforce hosts it for you, on shared regions whose locations Salesforce publishes. Its current Infrastructure and Sub-processors document settles the geography: customer data for “Commerce Cloud/B2C Commerce” — covering B2C Commerce (which may include Managed Runtime), B2C Commerce Order Management and Commerce Cloud Einstein — is hosted, in Salesforce’s words, in “one of the following regions”: the United States, Australia, France, Germany, the United Kingdom, Sweden, the Netherlands and Japan, with Amazon Web Services and Salesforce’s own entities named as the providers. Across the whole document, mainland China does not appear once.

There is a mainland route in the Salesforce world, but it is a different one. Salesforce on Alibaba Cloud reached general availability in mainland China for “Sales Cloud, Service Cloud, and Salesforce Platform” — and Commerce Cloud is not among them. The commerce capability on that China-specific gateway is a separate headless product Salesforce calls “Social Commerce,” built to run storefronts on local channels — not the B2C Commerce platform you already operate. So the one in-country home Salesforce runs is a different product line, and it does not put your Commerce Cloud storefront inside the mainland.

Door one: the storefront needs an ICP filing it can’t anchor offshore

Showing a public storefront to people in mainland China turns on a permission that has nothing to do with load time: an ICP filing (备案). Under State Council Order No. 292 and MIIT Order No. 33, that filing must attach to a hosting resource that physically sits inside the mainland, held by a mainland legal entity. Commerce Cloud’s regions are, by Salesforce’s own disclosure, all offshore — so there is nothing on the platform for a filing to attach to. Being reachable from mainland China is a network fact; being cleared to publish a storefront there is a licensing fact, and only the second is an ICP filing. No amount of front-end tuning conjures the in-country host that filing requires.

Door two: commerce moves money, and the money is licensed

A storefront is not just pages — it moves money, and in China moving money is a licensed activity in its own right. Acquiring and settling payments from mainland shoppers as an institution is governed by the Regulations on the Supervision and Administration of Non-Bank Payment Institutions (非银行支付机构监督管理条例, State Council Order No. 768), promulgated December 9, 2023 and in force since May 1, 2024. Every non-bank payment institution must hold a payment business license approved by the People’s Bank of China (Article 6), and a provider based offshore that intends to serve mainland users cross-border is directed to establish a non-bank payment institution inside China (Article 2).

Salesforce Commerce Cloud is a commerce platform, not a licensed China payment institution: it orchestrates the cart, the order and the checkout, but it is not the entity that may acquire and settle the funds inside the mainland. So for a China store the actual money movement has to run over a licensed domestic payment path, with Commerce Cloud orchestrating on top of it. On payments our role is strictly advisory — 21YunBox holds no China payment license and is not a payment institution; we help you map the question and connect to a licensed provider, and the license and the acquiring relationship stay with that provider and your counsel.

The floor under both doors: shopper, order and payment data at the border

Beneath the two doors sits the data. A storefront is a personal-information machine: every mainland shopper who registers or checks out hands over a name, a shipping address, a phone number, an order history and payment identifiers — and because Commerce Cloud stores that data only in offshore regions, it crosses the border the moment it is saved. China’s Personal Information Protection Law treats that as a cross-border transfer, and the handler — you, the merchant, not Salesforce — must give notice, obtain a separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (Articles 38–40, with the consent duty in Articles 13 and 23).

If you are a critical information infrastructure operator, or you process personal information above the regulated volumes, that data has to be stored in the mainland in the first place (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37, renumbered by the 2025 amendment in force January 1, 2026)) — a residency duty no offshore region can satisfy.

Why a reachability check sees none of this

This is why a speed test or an uptime check answers the wrong question. A probe can tell you a Commerce Cloud storefront paints for a user in Shanghai; it cannot tell you the storefront has no ICP filing, that the checkout is moving money over an unlicensed path, or that every order just crossed the border without a lawful basis. The things that decide whether you may operate are invisible to anything that only measures whether the page loaded — they live in filings, licenses and transfer mechanisms, not in milliseconds. That gap is the whole point: making an offshore store merely load faster changes none of the three.

The lawful path — map, localize, deliver

Map. We inventory what your Commerce Cloud instance actually holds — shopper accounts, carts, orders, addresses and payment references, and the storefront itself — where each sits today, the ICP status of the public store, and the consent, residency and payment-licensing basis for each flow.

Localize and govern. We keep the regulated data — your China shoppers’ profiles, orders and payment references — on a China-resident footing; stand up the Article 13/23 notice and separate consent; and put the money movement onto a licensed domestic payment path, with Commerce Cloud orchestrating on top. High-volume and CIIO data stays in-country.

Deliver. We ICP-file the China-facing storefront and serve it in-country with the 21YunBox Optimizer, set in front of the Commerce Cloud origin you already run — no rebuild, no re-platform, no second codebase.

The rule underneath all three: making an offshore platform merely reachable from China is not the answer, because the storefront is still unfiled, the money is still unlicensed, and the data is still offshore. Keeping the regulated data in-country, on a licensed and filed path, is — and, to be explicit, 21YunBox never uses or suggests circumvention of any kind.

Whether you owe an ICP filing, in-country storage, a licensed payment path, or all three depends on what you sell, how much personal data you hold, and who your shoppers are — so settle it with counsel before you build. Tell us your China markets and your stack, and we’ll map the path and deliver it in-country. Reach out for a compliance assessment and a quote.

Get a compliance assessment →

Related reading:

• China’s Regulations on the Supervision and Administration of Non-Bank Payment Institutions (Order No. 768)
• What is the China ICP license, and how do you get one?
• Cross-border data transfers under PIPL
• China’s Cybersecurity Law — data localization (Article 39, formerly Article 37)

RELATED TECHNOLOGIES

Adobe Experience Cloud

Adobe Experience Cloud

Adobe Experience Platform

Adobe Experience Platform

commercetools

commercetools

SAP Commerce Cloud

SAP Commerce Cloud