Does Sitecore OrderCloud Work in China? ICP, Data Residency & an Offshore Commerce API

Sitecore OrderCloud is a headless commerce API hosted on Microsoft Azure outside mainland China — so a China-facing store reaches an offshore API with no ICP-filing path on OrderCloud, and your shoppers' order and payment data lands outside the mainland under PIPL. A compliance-first look at the two doors.

By the 21YunBox Compliance Team · Reviewed 2026-10-07 · Verified against Sitecore Ordercloud's own documentation

Does Sitecore OrderCloud work in China?

Whether Sitecore OrderCloud works for mainland China is first a data-residency and licensing question, not a latency one. OrderCloud is a headless commerce API — and where that API, and the customer and order data inside it, is hosted is what carries the legal risk.

By OrderCloud's own definition a region "represents a physical location where the Core OrderCloud API is hosted," and its regions run on Microsoft Azure across the Americas, Europe and Asia-Pacific — with none inside mainland China. So a storefront served to mainland visitors reaches an offshore API, with no ICP-filing path on OrderCloud itself; and the customer, order and payment records it stores are a cross-border transfer PIPL governs. The table below sets OrderCloud's own hosting against the China rules it triggers.

This is a risk map, not a legal verdict — your duties turn on what you sell and whose data you hold. Our China team can map the ICP and data path with you →

What Sitecore Ordercloud's own documentation says about China

Fact	Primary source
In OrderCloud's own documentation, a region "represents a physical location where the Core OrderCloud API is hosted and made available through 3 distinct environments," and those regions run on Microsoft Azure — named for their Azure location, for example "Azure Us West." OrderCloud's published regions span the Americas, Europe and Asia-Pacific; none is inside mainland China, so the commerce API behind a China storefront is reached offshore.	Sitecore OrderCloud Knowledge Base — OrderCloud Regions, retrieved 2026-10-07
Serving a public storefront to mainland-China visitors from inside the mainland requires an ICP filing (ICP 备案) under the State Council's Order No. 292 and MIIT's Order No. 33, tied to a mainland hosting resource. Because OrderCloud operates no mainland-China region, there is nothing on OrderCloud to file an ICP against — the filing and the in-country host must be arranged separately.	PRC Regulations on Telecommunications (State Council Order No. 292); Administrative Measures for the Filing of Non-operational Internet Information Services (MIIT Order No. 33)
A commerce platform holds personal information — names, shipping addresses, phone numbers, order history and payment details. With that data in OrderCloud's offshore region, PIPL requires the handler to give notice, obtain separate consent, and meet a transfer mechanism (a CAC security assessment, the CAC standard contract, or certification); payment and identity fields can count as sensitive personal information, raising the bar further. For a CIIO or large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; CSL Article 39 (formerly Article 37)).	PIPL Chapter III, Articles 38–43 and Article 40; Cybersecurity Law Article 39 (formerly Article 37)
OrderCloud is API-first and headless: the storefront you build is separate from the commerce API, so the front end can be delivered from inside China while the API stays where OrderCloud hosts it. The trade-off is that every render and checkout is an API round trip to the offshore region, and each call carries a Chinese shopper's personal and order data across the border — which is where the cross-border-transfer duty attaches, independent of how fast the call returns.	Sitecore OrderCloud — Platform Overview, retrieved 2026-10-07

Sources verified by the 21YunBox compliance team on 2026-10-07.

For a mainland-China audience, the deciding question about Sitecore OrderCloud is not how quickly the API answers — it is where that API, and the customer and order data inside it, is allowed to live. OrderCloud is a headless, API-first commerce platform: it hosts the commerce engine, and you build the storefront on top. OrderCloud answers the “where” in its own documentation — its regions run on Microsoft Azure, and none sits inside mainland China. So a China-facing store on OrderCloud can reach the API, but reaching it gives you neither an ICP filing nor in-country data residency. The reachability is the easy part; the licensing and the data path are the exposure.

Sitecore OrderCloud Knowledge Base Regions page defining a region as a physical location where the Core OrderCloud API is hosted, with regions named for their Microsoft Azure location such as Azure Us West, and no mainland-China region listed — OrderCloud's own Regions documentation: a region “represents a physical location where the Core OrderCloud API is hosted and made available through 3 distinct environments,” and those regions run on Microsoft Azure (for example “Azure Us West”) — with none inside mainland China. Source: ordercloud.io/knowledge-base/ordercloud-regions

Sitecore OrderCloud in China at a glance

What decides it	In OrderCloud's own terms
Where it runs	OrderCloud's API is hosted on Microsoft Azure, with regions named for their Azure location (for example `Azure Us West`) and a published footprint across the Americas, Europe and Asia-Pacific. No region is inside mainland China; the API is reached offshore.
What a “region” is	In OrderCloud's words, a region “represents a physical location where the Core OrderCloud API is hosted and made available through 3 distinct environments.” In every case that physical location is outside the mainland.
Serving the public	A public storefront shown to mainland visitors from inside China needs an ICP filing tied to a mainland host. OrderCloud has no mainland region, so the filing and the in-country host must be arranged off OrderCloud.
Your data on OrderCloud	Customer, order and payment records sit in the offshore region — a cross-border transfer of personal information PIPL governs; payment and identity fields can count as sensitive personal information.
Headless architecture	The storefront is separable from the API, so the front end can be served from inside China — but every render and checkout is an API round trip across the border, carrying shopper data offshore on each call.

No mainland region, so no footing for an ICP filing

OrderCloud’s commerce API runs on Microsoft Azure. In its own Regions documentation a region “represents a physical location where the Core OrderCloud API is hosted and made available through 3 distinct environments,” and those regions carry their Azure location in the name — “Azure Us West” among them — with a published footprint across the Americas, Europe and Asia-Pacific. Not one is inside mainland China.

That geography settles the licensing question before performance ever enters it. A public-facing storefront delivered to mainland visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically located in the mainland. OrderCloud has none, so there is simply nothing on OrderCloud to file against. That is where “we already run on OrderCloud” runs out: reaching the API is not the same as being cleared to operate a storefront in China, and because OrderCloud is headless, the storefront host is yours to arrange in any case.

Your shoppers’ data lives in an offshore region

A commerce platform is a personal-data system: it holds names, shipping addresses, phone numbers, order histories and payment details for every shopper. Run a China-facing store on OrderCloud and that information lives in an offshore Azure region. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, not OrderCloud — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. Payment and identity fields can qualify as sensitive personal information, which raises the bar again, to separate consent and a necessity test. And if you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty no offshore region can meet.

Headless is the opening, not the escape

Because OrderCloud is API-first, the storefront you build is separable from the commerce API — and the very property that makes a compliant setup possible is also where the exposure lives. You can serve the front end from inside China, but every page render and every checkout is an API round trip to the offshore region, and each call carries a Chinese shopper’s personal and order data across the border. The cross-border-transfer duty attaches to that data movement, not to how fast the call returns — so a quick response does not make the path compliant, and a slow one is not what counsel will be asking about.

This is a risk map, not a verdict: whether you need an ICP filing, a cleared cross-border mechanism, in-country storage, or all three depends on what you sell, how much personal data you hold, and who your shoppers are — worth settling with counsel before you build.

Where 21YunBox fits — a compliant overlay, not a migration

You keep building on OrderCloud. We add the one piece a US-hosted, headless commerce API cannot: compliant, ICP-filed delivery from inside the mainland, set in front of your existing OrderCloud storefront — no rebuild, no second codebase, and no move off OrderCloud. Our China team maps your ICP and cross-border-data obligations against your entity, your data volumes and the shopper information you hold, then stands up the in-country delivery and the reviewed data path a lawful China storefront needs, while your commerce engine stays exactly where OrderCloud runs it.

Get a compliance assessment →

Related reading:

Frequently Asked Questions

Does Sitecore OrderCloud have a data center in mainland China?

No. By OrderCloud's own regions documentation, a region is a physical location where the Core OrderCloud API is hosted, and those regions run on Microsoft Azure across the Americas, Europe and Asia-Pacific — none inside mainland China. A storefront served to mainland visitors therefore reaches the commerce API offshore, and there is no OrderCloud host in the mainland to attach an ICP filing to.

Is it against the law to run a China-facing store on OrderCloud?

Not inherently. Two separate duties create the exposure: serving a public storefront to mainland visitors from inside China requires an ICP filing tied to a mainland host OrderCloud does not provide; and holding Chinese shoppers' customer, order and payment data in an offshore region is a cross-border transfer PIPL governs, with a data-localization duty for CIIOs and large-volume handlers. Treat it as a risk to size with counsel for your data and role, not a blanket ban.

Can 21YunBox help run an OrderCloud storefront in China?

Yes. Because OrderCloud is headless, your storefront can be delivered from inside China while your commerce API stays on OrderCloud. Our China team can assess your ICP and cross-border-data exposure and stand up compliant, ICP-filed in-country delivery in front of your existing OrderCloud build — no re-platform. Get in touch to work through your setup.