Does Upstash Work in China? Data Residency, PIPL & an Offshore Datastore
Upstash runs no data region inside mainland China — its Redis, QStash and sibling services live on AWS, GCP and Fly.io regions in the US, Europe and Asia-Pacific — so personal data you collect from Chinese users is stored offshore, a cross-border transfer under PIPL. A compliance-first look at the data-residency door.
Does Upstash work in China?
Upstash will happily serve mainland users, but it runs no data region inside mainland China — so the personal information you collect from Chinese users and write to Upstash is held offshore, which makes it a cross-border transfer under China's PIPL. The ICP filing a public China site needs attaches to the app in front of Upstash, not to the datastore itself.
Upstash's own docs say its Redis "is available on AWS, GCP and Fly.io," and that you "select a primary region" from a fixed menu — AWS regions from North Virginia and Oregon to Ireland, Frankfurt, Mumbai, Tokyo, Singapore and Sydney, plus a GCP region in Iowa — where "each region acts as a replica, holding a copy of your data." Not one sits in mainland China, and even QStash is offered only in an "EU region and US region." So wherever you pin it, your China users' personal data lives outside the mainland: a cross-border transfer under PIPL (notice, separate consent and a transfer mechanism, Articles 38–43), on infrastructure that cannot satisfy a data-localization duty. The table below is Upstash's own wording and the rule each line triggers.
This is a risk map, not a verdict — which obligations bite turns on your entity, your data volumes and who your users are. Our China team can map your exposure with you →
What Upstash's own documentation says about China
| Fact | Primary source |
|---|---|
| Upstash stores your data only in the regions you pick — and none is inside mainland China. Its Global Replication docs have you "select a primary region" and "create read replicas in the following regions," then list AWS regions — North Virginia, Ohio, North California, Oregon, Ireland, London, Frankfurt, Mumbai, Tokyo, Singapore, Sydney and São Paulo — where "each region acts as a replica, holding a copy of your data." There is no mainland-China option, so your data physically sits offshore wherever you put it. | Upstash — Global Replication docs (upstash.com), retrieved 2026-10-07 |
| Upstash runs on other clouds' infrastructure, all outside the mainland. Upstash's FAQ states plainly that "Upstash Redis is available on AWS, GCP and Fly.io," and that it "keep[s] your data in both memory and block storage (disk)" in those regions. Its published regions sit in the US, Europe and the wider Asia-Pacific — AWS sites plus a GCP region in Iowa — not in mainland China, so a China-facing deployment keeps personal data on servers beyond China's borders. | Upstash — Redis FAQ (upstash.com), retrieved 2026-10-07 |
| China users' personal data on Upstash is a cross-border transfer under PIPL. Because Upstash holds your data in an offshore region you select, personal information collected from mainland users leaves the country the moment it is written — a cross-border transfer of personal information China's Personal Information Protection Law governs (notice, separate consent and a transfer mechanism, Articles 38–43). For a critical information infrastructure operator or a large-volume handler, that data must instead be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a duty no offshore Upstash region can meet. | Upstash — Global Replication docs (upstash.com), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
| The whole Upstash platform is offshore — even its queueing runs only in the EU and US. Upstash's QStash docs state "QStash is available in two regions: EU region and US region," with no mainland-China option — the same pattern as its Redis regions. So the exposure isn't one product: across the data services you'd put behind a China-facing app, personal data stays outside the mainland, and the ICP filing (State Council Order No. 292; MIIT Order No. 33) still falls on the public app in front of Upstash, not on the datastore. | Upstash — QStash multi-region docs (upstash.com), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Upstash is not how fast it returns a query — it is where the data behind that query is allowed to live. Upstash is serverless data infrastructure — Redis, Vector, QStash and more — and it holds your application’s state, including the personal information of any Chinese users you serve. In its own documentation Upstash runs that data on AWS, GCP and Fly.io, inside a fixed set of regions you choose from, and not one of them is in mainland China. A China-facing app can reach its Upstash datastore, but the personal data it writes there sits offshore — a cross-border transfer China’s law governs, carrying a data-localization duty an offshore region cannot meet. Reaching the data is the easy half; where that data is allowed to reside is the exposure.
Upstash in China at a glance
| What decides it | In Upstash's own terms |
|---|---|
| Where it runs | Redis “is available on AWS, GCP and Fly.io”; you “select a primary region” from AWS sites spanning North Virginia, Ohio, North California, Oregon, Ireland, London, Frankfurt, Mumbai, Tokyo, Singapore, Sydney and São Paulo, plus a GCP region in Iowa. QStash is offered only in an “EU region and US region.” None is inside mainland China. |
| Where your data sits | “Each region acts as a replica, holding a copy of your data” — in the offshore region(s) you pick. Your Chinese users' personal information is therefore stored outside the mainland by design. |
| Cross-border transfer | Personal data collected in China and written to an offshore Upstash region is a cross-border transfer PIPL governs (Articles 38–43): notice, separate consent and one approved transfer mechanism. |
| Data localization | A CIIO or large-volume handler must keep China personal data in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a duty no offshore Upstash region can satisfy. |
| The ICP question | ICP filing attaches to the public app in front of Upstash, not to the datastore; Upstash runs no mainland region to file against, so it is settled one layer up at your application. |
No mainland region, so your data is offshore by design
Upstash does not run inside mainland China, and it does not hide the fact. Its FAQ states that “Upstash Redis is available on AWS, GCP and Fly.io,” and its Global Replication documentation has you “select a primary region” and then “create read replicas in the following regions” — a published list of AWS regions running from North Virginia, Ohio, North California and Oregon through Ireland, London and Frankfurt to Mumbai, Tokyo, Singapore, Sydney and São Paulo, alongside a GCP region in Iowa. In Upstash’s words “each region acts as a replica, holding a copy of your data.” Not one of those regions is in mainland China — and the pattern holds across the platform, with QStash offered only in an “EU region and US region.”
That geography settles the data question before performance enters it. Whatever region you pin a database to, the personal information your Chinese users generate is written to a server outside the mainland. You can choose where your data lives; you cannot choose mainland China, because Upstash offers no footing there.
China users’ personal data becomes a cross-border transfer
Store a mainland user’s personal information in any Upstash region and it has already left the country. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, not Upstash — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). If you are a critical information infrastructure operator or a large-volume handler, the law goes further: personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). An offshore Upstash region cannot meet that residency duty, because every region it offers is outside China.
Where the ICP line actually falls
It is worth being precise about the ICP filing, because for a datastore it sits one layer away. An ICP filing (ICP 备案, under State Council Order No. 292 and MIIT Order No. 33) is required of the public-facing website or service and the mainland hosting it runs on — not of the backend database behind it. Upstash lives behind your application, so the filing attaches to that application, not to Upstash. Putting a datastore somewhere does not create a filing, and Upstash has no mainland region to file against in any case. So for Upstash the sharp compliance question is data residency, while the ICP obligation lands on the China-facing app in front of it — a real obligation, just not Upstash’s to carry.
This is a risk map, not a verdict: whether a cross-border mechanism, in-country storage, or an app-level ICP filing applies to you turns on what you serve, how much personal data you hold, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building on Upstash. We add the piece a datastore with no mainland footprint cannot provide: compliant, ICP-filed delivery from inside the mainland, placed in front of the application that reads and writes your Upstash data — no rebuild, no second codebase, and no move off Upstash. Our China team maps your PIPL cross-border and data-residency obligations against your entity and the volume of personal data you hold, then stands up the in-country delivery and, where the law requires it, the in-country storage a lawful China presence needs — while your application keeps talking to the Upstash regions it already uses.
Related reading:
