Does StepZen Work in China? ICP, PIPL & the Backend API Layer
StepZen — now IBM API Connect for GraphQL — is a declarative GraphQL API layer, not a web host, so it carries no ICP filing of its own; that duty stays on your public app. But because it federates personal data across your back ends, running IBM's offshore managed service makes China-user data a PIPL cross-border question. A compliance-first look at the right layer to ask.
Does StepZen work in China?
StepZen — now IBM API Connect for GraphQL — is backend API plumbing, not a web host: it carries no ICP filing of its own, so running it neither clears your site to operate in mainland China nor, by itself, settles your data exposure. What matters is who files the ICP, and whether China users' personal data is federated through an engine running offshore.
IBM describes it as a way to "Build GraphQL APIs declaratively" that "can also combine (or federate) data from multiple sources, such as SQL, NoSQL, REST, SOAP and other GraphQL APIs" — and that federation is the point: a layer personal data flows through on its way between your users and your stores. Run IBM's managed service (in its docs a "Managed service instance on AWS") and that engine sits offshore, so personal information of your China users passing through it is a cross-border transfer PIPL governs, while the ICP filing stays on the public application in front of it — not on StepZen. The table below is IBM's own wording and the rule each layer triggers.
This is a risk map, not a verdict — which gate binds you turns on where the engine runs, what personal data crosses it, and who your users are. Our China team can map your exposure with you →
What Stepzen's own documentation says about China
| Fact | Primary source |
|---|---|
| StepZen is now IBM's — and it is a GraphQL server, not a web host. IBM announced "the acquisition of StepZen Inc, which developed a GraphQL server" that "helps developers build GraphQL APIs quickly and with less code," adding that "StepZen takes a declarative programming approach." It ships today as IBM API Connect for GraphQL. A GraphQL server composes an API over back ends you already run; it is not the host your public site is served from, and not the primary store of your customers' records. | IBM Newsroom — IBM Acquires StepZen (newsroom.ibm.com), retrieved 2026-10-07 |
| It federates data across your back ends — so personal data flows through it. On IBM's product page you "Build GraphQL APIs declaratively by composing GraphQL building blocks," and "can also combine (or federate) data from multiple sources, such as SQL, NoSQL, REST, SOAP and other GraphQL APIs." A layer that relays data between your front end and your stores is exactly where personal information transits — so if China users' data passes through an offshore engine, it becomes a cross-border transfer under PIPL (Articles 38–43). | IBM — API Development with IBM API Connect / StepZen (ibm.com/products/stepzen), retrieved 2026-10-07; PIPL Articles 38–43 |
| IBM runs the engine as an offshore managed cloud service. Requests run in "an in-memory, Golang-based GraphQL engine," delivered as "API Connect for GraphQL as a Service" — in IBM's own docs a "Managed service instance on AWS." IBM publishes no mainland-China region for the service (inference from IBM's availability pages), so personal data the engine handles for China users sits outside the mainland; for a CIIO or large-volume handler, that data must instead be stored in China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). | IBM — ibm.com/products/stepzen and API Connect for GraphQL as a Service docs (ibm.com/docs/en/api-connect-graphql/saas), retrieved 2026-10-07; PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| The ICP filing never attaches to StepZen. A public site served to mainland visitors needs an ICP filing bound to a hosting resource physically inside the mainland (State Council Order No. 292; MIIT Order No. 33). A GraphQL middleware tier is not that hosting resource, so moving your API layer onto StepZen — managed or self-run — does nothing for the filing. That gate stays on the public application the API feeds. | China ICP regime — State Council Order No. 292; MIIT Order No. 33, retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the useful question about StepZen is not how quickly it serves a query — it is which layer of your stack China’s rules actually land on, and whether StepZen is that layer. It is not. StepZen — now IBM API Connect for GraphQL, after IBM’s 2023 acquisition — is a declarative GraphQL layer: it composes a single API over the databases and services you already run. It is not your website’s host, and it is not the primary store of your customers’ records, so it holds no ICP filing and cannot, on its own, clear your site to operate in China. What it does do is move data between your front end and your back ends — and that is where the one real compliance question sits: if personal information about your Chinese users passes through an engine running offshore, China’s cross-border rules apply to that flow, while the licensing duty stays on the public application the API feeds.
StepZen in China at a glance
| What decides it | In StepZen's own terms |
|---|---|
| What it is | A GraphQL server that lets you “Build GraphQL APIs declaratively” and “combine (or federate) data from multiple sources, such as SQL, NoSQL, REST, SOAP and other GraphQL APIs.” Backend middleware — not a web host, not a data store. |
| Whose product | Now IBM's: IBM announced “the acquisition of StepZen Inc, which developed a GraphQL server,” and sells it today as IBM API Connect for GraphQL. |
| Where it runs | IBM delivers it “as a Service” — in its docs a “Managed service instance on AWS,” an offshore cloud. No mainland-China region is published for it. |
| Who files the ICP | You do, against a mainland hosting resource (State Council Order No. 292; MIIT Order No. 33). A GraphQL layer is not that resource, so StepZen carries no ICP of its own. |
| Your users' data | If China users' personal information is federated through an offshore engine, that is a PIPL cross-border transfer; for a CIIO or large-volume handler it must instead be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). |
StepZen answers queries; it doesn’t host your site
In IBM’s description StepZen is a GraphQL server: you “Build GraphQL APIs declaratively by composing GraphQL building blocks,” and it “can also combine (or federate) data from multiple sources, such as SQL, NoSQL, REST, SOAP and other GraphQL APIs.” That is a tier that assembles and serves an API over back ends you already operate — it answers “what data does this query return, and from where?” It does not serve your marketing site or your web app to a browser, and it is not the system of record for your customers’ accounts. China’s operating rules bind the public site and the host it runs on; a query-composition layer sitting behind that site is rarely the thing a regulator is gating. So the first thing to fix about “does StepZen work in China” is the layer the question is aimed at.
The ICP filing lands on your application, not your API tier
A public-facing site shown to mainland visitors depends on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing has to be bound to a hosting resource physically located inside the mainland. A GraphQL middleware tier is not a hosting resource you can file against — it composes responses, it does not give you a mainland server with a record number attached. So putting StepZen (or IBM API Connect for GraphQL) into your architecture, managed or self-run, leaves the licensing question exactly where it was: on the application the API feeds. “We already run StepZen” is not a step toward the filing; the filing belongs to the site in front of it.
The real question — where the engine runs, and what flows through it
This is the half that actually turns on StepZen. IBM delivers it as a managed cloud service — its documentation set is “API Connect for GraphQL as a Service,” and the hosted option is, in IBM’s own words, a “Managed service instance on AWS.” That is offshore infrastructure, and IBM publishes no mainland-China region for the service. Because the engine federates data out of your back ends, personal information about your Chinese users can pass through it on the way to the front end. Routed through an engine that sits outside the mainland, that movement is a cross-border transfer under PIPL: as the handler you owe notice, separate consent, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China has to be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)), which an offshore engine cannot satisfy. The exposure follows the data and the location — not the brand name in your stack.
Don’t over-file StepZen under “cross-border data”
It is just as easy to overstate this. A GraphQL layer is not automatically a data-residency problem: if the engine only ever brokers non-personal data, or you architect it so no Chinese user’s personal information leaves the mainland, the cross-border question narrows or falls away. The duty attaches to flows of personal information through infrastructure that sits offshore — not to the fact that “GraphQL” or “federation” appears in your diagram. An honest risk map keeps that line crisp: name where personal data actually travels, and don’t let a middleware label either manufacture an exposure that isn’t there or hide one that is.
This is a risk map, not a verdict: whether the binding gate is the ICP filing on your site, a cross-border transfer through your API layer, or an in-country storage duty elsewhere in your stack depends on what you serve, where each tier runs, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep StepZen — IBM API Connect for GraphQL — composing your API exactly as it does now. What we add is the piece a query layer was never meant to supply: compliant, ICP-filed delivery from inside the mainland, set in front of your existing origin — no rebuild, no second codebase, and no change to where your API tier or your data sources run. Our China team maps where your exposure truly sits — the ICP duty on your public application, and any PIPL cross-border or data-residency obligation created by personal data moving through your GraphQL layer — then stands up the in-country, ICP-filed delivery a lawful China presence requires, while the rest of your stack stays put.
Related reading:
