Does Supabase Work in China? Data Residency, PIPL & the Offshore Region
Supabase is reachable and loads fine from inside mainland China — the deciding question is data residency, not speed. Every project's database, auth and storage sit in one region you choose, and none is in mainland China, so the personal data you collect from Chinese users is stored offshore: a cross-border transfer PIPL governs. A compliance-first look at the data door.
Does Supabase work in China?
Whether you can use Supabase in China is a data-residency question, not a speed one. Supabase is reachable and loads fine from inside mainland China — the risk is legal, not performance.
By Supabase's own documentation, each project's "Postgres database, Auth service, and Storage objects are hosted in" the single region you pick, and "the region you choose also determines where your primary project data is stored." None of its selectable regions is in mainland China — the nearest is in Northeast Asia. So the accounts, profiles and records your app collects from users in China are stored abroad: a cross-border transfer of personal information that PIPL governs — it needs notice, separate consent, a transfer mechanism, and for a CIIO or large-volume handler, in-country storage. The table below is Supabase's own wording and the rules it triggers — and the compliant, ICP-filed in-country path its own docs point to.
This is a risk picture, not a verdict — your obligations turn on your data volumes and your role. Our China team can map your Supabase data exposure with you →
What Supabase's documentation says, and what we measured from inside China
| Fact | Primary source |
|---|---|
| In Supabase's own words: "Each Supabase project is deployed to a single primary region, and your project's primary Postgres database, Auth service, and Storage objects are hosted in that region," and "the region you choose also determines where your primary project data is stored." Its selectable AWS regions span the US, Canada, Europe, Mumbai, Singapore, Tokyo, Seoul, Sydney and São Paulo — none is in mainland China, the nearest being Northeast Asia (Tokyo / Seoul). | Supabase Docs — Available regions, and GDPR compliance, retrieved 2026-10-07 |
| Because Supabase holds the accounts, profiles and records your application collects — personal information — and stores them in that one offshore region, data gathered from users in China is transferred abroad. PIPL governs that cross-border transfer: the personal-information handler (you, the Supabase customer — not Supabase) must give notice, obtain separate consent, and satisfy one of its transfer mechanisms — a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 |
| The exposure scales with volume and role, not merely with using the tool: under the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024 |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside mainland China (CSL Article 39 (formerly Article 37); PIPL Article 40). Supabase offers no China region, so its own answer for this case is to self-host — its documentation recommends self-hosting for teams that "have compliance requirements that prevent you from using managed services." The only way to keep that data on Chinese soil is to run Supabase yourself on infrastructure inside the mainland, and standing up that in-country deployment legally is what pulls in an ICP filing. | Supabase Docs — Self-Hosting; PIPL Article 40; CSL Article 39 (formerly Article 37) |
| Supabase completed all 3 page loads requested from a probe inside mainland China (Alibaba Cloud cn-zhangjiakou) on 2026-08-27, with a median time to first byte of 393ms and a largest-contentful-paint of 2,200ms. It loads — which is exactly why the real question is legal, not performance. | 21YunBox — China delivery measurement, measured from inside mainland China |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Supabase is not whether it loads — it does — but where the data it holds is allowed to live. Supabase is a hosted Postgres backend: it keeps the accounts, profiles and records your application collects. By its own documentation each project lives in one region you choose when you create it, and not one of those regions is in mainland China. So a China-facing app on Supabase is reachable, yet every record of user data it stores lands offshore — a cross-border transfer China’s data law governs, not a performance problem. Reaching it is not the problem; where it keeps your users’ data is.
Supabase in China at a glance
| What decides it | In Supabase's own terms |
|---|---|
| Where your data lives | Each project runs in one primary region you pick at creation; its “primary Postgres database, Auth service, and Storage objects are hosted in that region.” Selectable AWS regions span the US, Canada, Europe, Mumbai, Singapore, Tokyo, Seoul, Sydney and São Paulo — none in mainland China, the nearest being Northeast Asia (Tokyo / Seoul). |
| The cross-border transfer | Data your app collects from users in China lands in that offshore region. That is a cross-border transfer of personal information PIPL governs — and the handler is you, the Supabase customer, not Supabase. |
| When the rules bite harder | Exposure scales with volume and role. Under the CAC's March 2024 cross-border rules, a non-CIIO moving fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification. |
| Data residency | For a CIIO or large-volume handler, personal information collected in China must be stored inside the mainland (CSL Article 39 (formerly Article 37); PIPL Article 40) — a duty no Supabase region can meet. |
| Is it reachable? | Yes — it completed all 3 page loads requested from an Alibaba Cloud probe in Zhangjiakou on 2026-08-27 (median TTFB 393 ms, LCP 2,200 ms). Speed is not the issue. |
Where your Supabase data actually lives
Supabase is a managed Postgres backend — database, authentication and object storage — and all three sit together in a single region. In its own data-residency and Regions documentation, “each Supabase project is deployed to a single primary region, and your project’s primary Postgres database, Auth service, and Storage objects are hosted in that region,” and “the region you choose also determines where your primary project data is stored.” That region selection is a data-location control, and it is the only one Supabase’s managed platform hands you.
The catch for China is the menu you get to choose from. Supabase’s selectable AWS regions cover the United States, Canada, Europe, Mumbai, Singapore, Tokyo, Seoul, Sydney and São Paulo; the closest to the mainland is in Northeast Asia, and not one is inside mainland China. So the moment your application serves users in China, the accounts, profiles and records it writes are kept abroad — and that, not latency, is what China’s data law responds to. That menu is typical of the category: of the 82 hosting services we checked for China compliance — each read against its own documentation in October 2026 — 63 had no self-serve in-country path for the core service.
Serve China from Supabase and your users’ data crosses the border
Personal information your app gathers from people in China — names, emails, login identities, anything that identifies them — is written to that one offshore region. Under China’s Personal Information Protection Law, storing it outside the mainland is a cross-border transfer, and the obligation lands on the personal-information handler, which is you as the Supabase customer and not Supabase as the platform. PIPL asks that handler to give affected users notice, obtain their separate consent for the transfer, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. “We already run on Supabase” settles none of that; reaching China and being cleared to move Chinese users’ data out of it are different questions.
How much is at stake depends on your volume and your role
The weight of these duties is not uniform. Under the CAC’s March 2024 Regulations on Promoting and Regulating Cross-border Data Flows, a handler that is not a critical information infrastructure operator and moves fewer than 100,000 individuals’ non-sensitive personal information in a calendar year is exempt from the security assessment, the standard contract and certification — a genuinely lighter path for a small app.
At the other end, a CIIO or a large-volume handler carries a data-residency duty: personal information collected in China must be stored inside the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40). No Supabase region can satisfy that, because none sits in China — and here Supabase’s own documentation points to the way out. It recommends self-hosting for teams that “have compliance requirements that prevent you from using managed services.” The only way to keep Chinese users’ data on Chinese soil is to run Supabase yourself on infrastructure inside the mainland, and standing that deployment up lawfully is what brings an ICP filing into the picture.
Reachable, not blocked — which is why this is a data question
Supabase is not walled off from China. In 21YunBox’s own measurement from inside the mainland — an Alibaba Cloud probe in Zhangjiakou on 2026-08-27 — Supabase completed all 3 of the page loads requested, with a median time to first byte of 393 ms and a largest-contentful-paint of 2,200 ms. It loads, and it loads at a usable speed. That is precisely why the real exposure on a China-facing Supabase app is not whether people can reach it, but that reaching it leaves your users’ personal data offshore with no mainland data-residency option. Those are compliance facts, and no amount of network tuning changes where the data is stored.
This is a risk map, not a verdict: whether you owe notice and consent only, a full transfer mechanism, or in-country storage of the data itself turns on how much personal information you hold and whether your role pulls you into the CIIO or large-volume tier — a question to work through with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building on Supabase; nothing moves. What we add is the layer a managed backend with no mainland region cannot give you on its own: compliant, ICP-filed delivery standing in front of your existing origin inside the mainland — no re-architecture and no second codebase. Our China team first maps your cross-border and data-residency obligations against your entity and your data volumes. Then, for the case the law treats most strictly — where Chinese users’ data has to remain on the mainland — we help you run a self-hosted Supabase deployment inside China, so the records sit on Chinese soil while everything else stays exactly where it already lives.
Related reading:
