Does Webflow Work in China? ICP Hosting, Data Residency & PIPL
Webflow doesn't only build your site — it hosts and serves it, from its own US infrastructure ("AWS infrastructure with Cloudflare's global CDN"), with no mainland-China region. For a China-facing site that raises two compliance gates ahead of speed: an ICP filing it has no in-country resource to satisfy, and a PIPL cross-border transfer of the form submissions and visitor data it stores in the United States. A compliance-first look at the ICP, data-residency and cross-border questions — and the lawful in-country path.
Does Webflow work in China?
Webflow doesn’t only build your site — it hosts and serves it, from its own US infrastructure, with no mainland-China region. So the China question isn’t speed; it’s whether a site served from offshore can carry an ICP filing, and whether the data it collects from China may lawfully sit abroad.
Webflow describes its hosting as “AWS infrastructure with Cloudflare’s global CDN,” and its subprocessor list places both in the “USA.” Its Privacy FAQs add that it “stores its Customers’ and Customers’ End Users’ data in the United States.” A public site served to mainland users needs an ICP filing bound to a mainland host Webflow doesn’t provide; the form submissions and visitor data it stores offshore are a PIPL cross-border transfer (Articles 38–40: notice, a separate consent, a transfer mechanism); and for a CIIO, the Cybersecurity Law’s Article 39 (formerly Article 37) adds an in-country storage duty offshore hosting can’t meet.
21YunBox maps the ICP, cross-border and residency exposure, localizes the China form and visitor data onto a China-resident, consented footing, and delivers your China-facing site in-country on ICP-filed infrastructure in front of what you built in Webflow — no rebuild, and never any form of circumvention. Treat the specifics as a risk to confirm with counsel.
What Webflow's own documentation says about China
| Fact | Primary source |
|---|---|
| Webflow stores customer and end-user data in the United States. Webflow’s Privacy FAQs answer “Where does Webflow store personal data?” directly: “Webflow stores its Customers’ and Customers’ End Users’ data in the United States, where Webflow is based.” On a site Webflow also hosts and serves, that “End Users’ data” includes the form submissions and visitor details collected from your China users — personal information resting offshore, which makes its collection a cross-border transfer under PIPL (Articles 38–40). | Webflow — Privacy FAQs (webflow.com), retrieved 2026-10-09; PIPL Articles 38–40 |
| Webflow serves sites from AWS and Cloudflare, with no mainland-China region. Webflow’s subprocessor list names Amazon Web Services for “Cloud services, hosting, and translation services” and Cloudflare for “Content delivery network,” both located “USA.” No mainland-China location appears anywhere on the list, so there is no in-country hosting resource to bind an ICP filing to. | Webflow — Subprocessors list (webflow.com), retrieved 2026-10-09 |
| Webflow describes its own delivery stack as AWS plus Cloudflare. Webflow’s hosting page states it “combines the power of AWS infrastructure with Cloudflare’s global CDN,” and that hosting is “powered by AWS and Cloudflare.” The site your China visitors load is therefore served from Webflow’s own offshore infrastructure — reachable, but impossible to place in the mainland or ICP-file. | Webflow — Hosting feature page (webflow.com), retrieved 2026-10-09 |
| China-collected form and visitor data sent to an offshore Webflow is a PIPL cross-border transfer. Moving personal information collected from users in mainland China to hosting in the United States triggers PIPL Articles 38–40 — notice, a separate consent, and one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). For a critical information infrastructure operator, the Cybersecurity Law’s Article 39 (formerly Article 37) adds an in-country storage duty an offshore host cannot meet. | Personal Information Protection Law of the PRC, Articles 38–40; Cybersecurity Law Article 39 (formerly Article 37) (cac.gov.cn), retrieved 2026-10-09 |
Sources verified by the 21YunBox compliance team on 2026-10-09.
Whether Webflow “works” in mainland China is a compliance question before it is a speed one — and with Webflow the compliance question is unusually direct, because Webflow does not only help you design the site. It hosts it and serves it too, from its own infrastructure. By Webflow’s own account that infrastructure is “AWS infrastructure with Cloudflare’s global CDN,” and its subprocessor list places both in the “USA,” with no mainland-China region anywhere on it. So the live site your China visitors load, and the form submissions and account data it collects from them, both sit on hosting you cannot move into the mainland. That raises two gates that have nothing to do with load time: whether a public site served to mainland users can carry the ICP filing China requires, and whether the personal information Webflow stores offshore may lawfully leave the country at all. Webflow answers the “where” of both in its own documentation.
Webflow in China at a glance
| What decides it | In Webflow's own terms — and China's law |
|---|---|
| What it is | Webflow is a visual website builder with a built-in CMS — and it also hosts and serves the published site. The site your China visitors load runs on Webflow's infrastructure, not yours, and it holds your pages, CMS collections, form submissions and account data. |
| Where the site is served from | Webflow's hosting page calls the platform “AWS infrastructure with Cloudflare's global CDN,” and its subprocessor list names Amazon Web Services for “Cloud services, hosting, and translation services” and Cloudflare for “Content delivery network,” both located “USA.” No mainland-China region appears on the list. |
| Serving the public | A public site served to mainland users is an internet information service in China, which turns on an ICP filing bound to a mainland hosting resource. Webflow's hosting is offshore, so there is no Webflow resource in the mainland to file against. |
| How it arrives | Served through an offshore Cloudflare edge, delivery into the mainland can be inconsistent. That is an operational matter, not the legal one — and never a reason to reach for any network workaround. |
| Where your China users' data lives | Webflow states it “stores its Customers' and Customers' End Users' data in the United States.” The form submissions and visitor data a Webflow site collects from China are personal information resting offshore — a cross-border transfer PIPL governs (Articles 38–40). |
| Data-residency duty | For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a duty offshore hosting cannot meet. |
Door one — the delivered site has no mainland home to file an ICP against
A Webflow site is served to the public from Webflow’s own hosting. In Webflow’s description that hosting is “AWS infrastructure with Cloudflare’s global CDN,” and its subprocessor list places Amazon Web Services and Cloudflare in the “USA” — there is no mainland-China region on it. That matters before performance does, because a public-facing site actually served to visitors inside China is an internet information service, and such a service turns on an ICP filing (ICP 备案) bound to a hosting resource physically in the mainland (State Council Order No. 292; MIIT Order No. 33). Webflow provides no such resource, so there is nothing of Webflow’s inside China to attach a filing to. “We already host on Webflow” does not carry across the border — the hosting that makes Webflow effortless everywhere else is the very thing that has no ICP footing here.
There is a delivery footnote to the same fact. Served through an offshore Cloudflare edge, a Webflow site’s reachability from inside the mainland can vary from one network and moment to the next. That is an operational matter, not the legal one that decides whether you may run the site — and it is never a reason to reach for a network workaround, which would trade a delivery nuisance for a compliance problem.
Door two — the form and visitor data Webflow stores sits in the United States
Webflow’s Privacy FAQs answer the residency question in a single line: “Webflow stores its Customers’ and Customers’ End Users’ data in the United States, where Webflow is based.” On a site Webflow also serves, that “End Users’ data” is exactly the information your China visitors hand over — the contact and enquiry forms Webflow captures, the account and profile data, the records held in CMS collections. All of it is personal information, and the moment it is collected from people in the mainland and stored in the United States, you have made a cross-border transfer under China’s Personal Information Protection Law.
PIPL puts that duty on the handler — you, the site operator, not Webflow the processor. Articles 38–40 require that you give notice, obtain a separate consent for the overseas transfer distinct from any general agreement to use the site, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. A form that quietly posts a Chinese visitor’s details to a US-hosted Webflow backend does none of that on its own.
Residency can go a step further. If you are a critical information infrastructure operator, or you handle personal information at volume, personal information collected in China must be stored in the mainland — PIPL Article 40, together with the Cybersecurity Law’s Article 39 (formerly Article 37; the data-localization provision was renumbered by the 2025 amendment that took effect on January 1, 2026, with its substance unchanged). And there is no region setting to fall back on: Webflow names only its US home, so no configuration choice lands this data inside the mainland.
”Can’t I just export it?” — why that doesn’t settle China
The natural follow-up is to export the static build, or move the files to another host, and call the problem solved. It isn’t, by itself. The design, the CMS and the form handling still run inside Webflow, and whichever host ends up holding the exported files, the two questions that actually decide China are unchanged: is the site served to mainland users from an ICP-filed home inside the country, and does the personal information it collects from those users rest on a lawful, in-country footing? Those are answered by where the site is delivered and where the data lives — not by which offshore provider keeps a copy of the files.
None of this makes Webflow “blocked” or “illegal” in China. It is a map of risk, not a verdict: which obligations actually bite — an ICP filing, a separate consent, a transfer mechanism, in-country storage, or some mix of them — turns on your entity, the data your forms and CMS collect, your role under Chinese law, and who your users are. It is worth settling with counsel before a China launch depends on it.
The lawful path — map, localize, deliver
There is a compliant way to run a Webflow-built site for mainland China, and it keeps Webflow in the picture. It starts with map: our China compliance team works through the two exposures together — the ICP question that attaches to a public site served in the mainland, and the PIPL cross-border and residency obligations that attach to the form submissions, CMS records and visitor data Webflow stores in the United States — against your entity, your data volumes and who your users are. The legal conclusions are settled with your counsel; we build the technical picture that feeds them.
Then localize: the personal information your China visitors hand over — form fills, enquiries, account details — is put on a China-resident, consented footing, so that what the law says must stay in the country stops leaving it by default. You keep designing and building in Webflow, and you keep Webflow serving your other markets.
Then deliver: because the delivered site is the part that cannot move to the mainland on its own, 21YunBox stands up ICP-filed, in-country delivery — the 21YunBox Optimizer — in front of the site you built in Webflow, with no rebuild and no second codebase. The result is a China-facing site that runs legally and compliantly for your users in China. What we never do — and what no one lawfully can — is route around China’s rules or any network restriction: we map what applies, localize what must stay in-country, and deliver in the mainland on filed infrastructure. We neither use nor suggest circumvention of any kind.
Related reading:
- How to get an ICP filing for China
- Cross-border data transfers under PIPL
- China’s Cybersecurity Law (data localization, Article 39)
