Does Salesforce Data 360 Work in China? Data Residency, ICP & Cross-Border Rules

With Salesforce Data 360 — the customer data platform Salesforce renamed from Data Cloud — the question for a mainland-China audience is not whether an endpoint responds. It is where the customer data goes. Data 360 is built to ingest events, identities and attributes from every source you connect and resolve them into a single, unified customer profile stitched together by an identity graph — the most identity-bearing pool of personal data most companies hold. By Salesforce’s own documentation that platform runs on Hyperforce, whose regions are the U.S., U.K., Germany, India and Japan, with no region inside mainland China; Data 360 is not among the clouds Salesforce localizes on Alibaba Cloud for China, and by Salesforce’s own partner notice global customers can no longer use its global services from within mainland China. So the moment Data 360 ingests a user in Shanghai, their personal information is written into a growing offshore profile, and automated decisions about what they see are made from it. Three of China’s rules bite at once: a cross-border transfer (PIPL Articles 38–40), automated decision-making and profiling (Article 24), and an in-country storage duty for a high-volume handler — none of which a reachability check can see.

Salesforce’s own “Salesforce on Alibaba Cloud” page states that “Global customers can no longer use global services within mainland China,” and localizes only Sales Cloud, Service Cloud, the Salesforce Platform and the Connected Experiences Gateway in China — Data 360 / Data Cloud is not among them. Salesforce’s own infrastructure page, separately, lists Data 360’s Hyperforce regions as the U.S., U.K., Germany, India, Japan and more, naming no mainland-China region. (Source: Salesforce on Alibaba Cloud · Hyperforce infrastructure)

Salesforce Data 360 in China at a glance

What you actually send — your users’ identities and behavior

Data 360 is built to unify, not to meter. It ingests the behavioral events, identities and attributes you capture across every channel — app and web events, customer and device IDs, emails, and the custom traits you define — and its identity-resolution engine stitches them into a single profile per person, linked by an identity graph. What accumulates is not a handful of metrics but a continuously updated record of who each of your users is and what they do, across all the sources you connect. For a mainland-China user, all of that is personal information — and the precise behavior and contact identifiers can rise to sensitive personal information, which PIPL guards more tightly still. This is close to the maximal case the cross-border rules were written for: a permanent, growing offshore store of your China users’ identities and behavior, assembled into one profile built to be acted on.

It’s a cross-border transfer — and an automated decision — under PIPL

Where that profile lives is what turns a marketing platform into a compliance exposure. Data 360 runs on Salesforce’s Hyperforce cloud — by Salesforce’s own platform documentation its regions are the U.S., U.K., Germany, India and Japan, with no mainland-China region — and Data 360 is not one of the clouds (Sales, Service, Platform and the Connected Experiences Gateway) that Salesforce localizes on Alibaba Cloud for China. By Salesforce’s own partner notice, global Salesforce services can no longer be used from within mainland China. So a user captured in the mainland is written to servers offshore. Under the Personal Information Protection Law that is a cross-border transfer (数据出境), and the handler — you, the company whose app feeds Data 360, not Salesforce — must give notice, obtain separate consent for the transfer, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (Articles 38–40).

But a CDP adds a second, sharper duty most teams miss. Data 360 does not merely store the profile; it resolves identities and segments users to decide what each person sees — which audience they fall into, which experience and message they are shown. Sorting your China users into cohorts from their profile and tailoring their experience is automated decision-making and profiling, which PIPL Article 24 governs directly: the individual is owed transparency and fairness, a way to refuse, and — where a decision rests on profiling — an option not to be targeted by their personal characteristics.

Two more duties run alongside. Capturing behavioral events requires genuine, separate consent for the tracking, not a buried “by using this product…” clause (PIPL Articles 13 and 23). And because the unified profile is permanent and growing, an in-country storage duty can apply: Cybersecurity Law Article 39 (formerly Article 37) requires a critical information infrastructure operator or a high-volume handler to keep China personal information in the mainland — which Hyperforce regions in the U.S., U.K., Germany, India or Japan cannot satisfy. Every downstream destination Data 360 routes the profile onward to is, in turn, its own cross-border transfer to account for.

Reaching the endpoint isn’t the question — keeping the decisioning in-country is

Data 360’s collection point is an SDK, an ingestion API and connectors, so from the mainland they can be slow or unreliable — a real delivery question, but the smaller half. The larger half is that Data 360 is a managed, proprietary service on Hyperforce: there is no open-source or self-hostable edition you could stand up inside China, and no mainland-China region to select. So the lawful lever is not to make the offshore endpoint reachable — it is to keep the profile-building and the user data on an in-country path. In practice that means routing China users through a licensed in-country customer-data or experimentation alternative so the profile is resolved and stored in the mainland; minimizing and pseudonymizing whatever context still has to leave; securing the Article 13/23 consent for the tracking; and honoring the Article 24 right to refuse profiling and to receive a non-profiled experience. What this is not is a path that ships the same personal information offshore anyway — relocating the wire does not relocate the data, and the transfer and the automated decision both remain.

This is a risk map, not a verdict: how much exposure you carry turns on what you send Data 360, what you do with the profile, your role and data volumes, and who your users are — worth settling the specifics with counsel before you unify and personalize at scale.

The lawful path — map, localize, deliver

Data 360 stays your customer data platform; nothing migrates. What 21YunBox adds is the compliance layer the CDP itself does not provide, in three moves.

Map. Our China team inventories what your Data 360 implementation ingests from mainland users — the identities, events, device signals and attributes — where it is resolved and stored, how the unified profile is used to decide what each user sees, and the consent basis behind it, then weighs the PIPL cross-border and Article 24 exposure against your entity, your role and your data volumes.

Localize. We keep the profile-building and the user data on an in-country path — a licensed domestic customer-data or experimentation alternative for China users, the targeting context minimized and pseudonymized, and the Article 24 opt-out honored — rather than resolving your China users’ profiles offshore. 21YunBox never uses or suggests circumvention of any kind.

Deliver. The app or site that runs on these decisions carries an ICP filing duty and needs compliant, in-country delivery — the 21YunBox Optimizer, placed in front of the stack you already run, no rebuild and no second codebase.

The result is Salesforce Data 360 that runs legally and compliantly for your users in China: the unified profile and the decisioning stay on a lawful in-country footing, and the cross-border, consent and residency gaps become ours to map and close with you.

Get a compliance assessment →

Related reading:

• Cross-border data transfers under PIPL
• China’s Cybersecurity Law and data localization
• China’s Personal Information Protection Law
• How to get an ICP filing for China

RELATED TECHNOLOGIES

Heap

Heap

LaunchDarkly

LaunchDarkly

mParticle

mParticle

PostHog

PostHog

Split

Split

Statsig

Statsig