Does WildApricot Work in China? Member Data Residency, PIPL & ICP
WildApricot stores your members' data on North American AWS with no mainland-China region, so a China membership is a cross-border transfer under PIPL and the public member portal has no ICP-filing path. A compliance-first look at the member-data and licensing doors.
Does WildApricot work in China?
It loads — but that is not the question. WildApricot keeps your members' records on North American AWS with no mainland-China region, so for a China membership the real exposure is personal-data residency and the ICP filing a public member portal needs — not speed.
In its own security overview WildApricot states its "hosting provider, Amazon Web Services (AWS), is the world's largest cloud provider," that "All data is stored in highly secure AWS data centers," and that the main solution is "distributed over one AWS Region with at least three Availability Zones," with payments in data centers "located in Dallas, TX and Phoenix, AZ." Every member record you hold for China-based members therefore sits offshore — a cross-border transfer of personal information PIPL governs (notice, separate consent and a transfer mechanism, Articles 38–43), on infrastructure that can hold no ICP filing for the member portal your mainland users see. The table below pairs WildApricot's own words with the rule each one triggers.
This is a risk map, not a verdict — what applies turns on your entity, how many members you hold and where they are. Our China team can map your exposure with you →
What Wildapricot's own documentation says about China
| Fact | Primary source |
|---|---|
| WildApricot keeps your members' data on North American AWS — nowhere in mainland China. In its own security overview WildApricot states its "hosting provider, Amazon Web Services (AWS), is the world's largest cloud provider," that "All data is stored in highly secure AWS data centers," and that "the main WildApricot solution is distributed over one AWS Region with at least three Availability Zones." It names no mainland-China region — AWS's China regions are a separate partition only a Chinese-licensed entity can use (inference) — so for a China audience every member record sits offshore. | WildApricot — Security overview (wildapricot.com/data-protection), retrieved 2026-10-07 |
| Even your members' payment data is hosted in the United States. WildApricot states its payment systems "use a high grade of hosting at Armor" with "two data centers located in Dallas, TX and Phoenix, AZ." For China-based members that is personal and financial information held outside the mainland — a cross-border transfer under PIPL that requires notice, separate consent and one transfer mechanism (Articles 38–43). | WildApricot — Security overview, retrieved 2026-10-07; PIPL Articles 38–43 |
| A China membership stored offshore can also trigger a data-residency duty. Because WildApricot holds member records on AWS data centers outside the mainland, personal information collected from China-based members leaves the country. For a critical information infrastructure operator or a large-volume handler, Chinese law requires that data to be stored inside China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty North American AWS cannot satisfy. | WildApricot — Security overview, retrieved 2026-10-07; PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| A public member portal for mainland visitors needs an ICP filing WildApricot can't provide. A website or member portal served to mainland China from inside the country requires an ICP filing (ICP 备案) bound to a mainland hosting resource, under State Council Order No. 292 and MIIT Order No. 33. WildApricot runs only North American AWS regions, so there is no in-country host to attach a filing to — reaching the site is not the same as being cleared to operate it. | WildApricot — Security overview, retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
| WildApricot is a Personify brand run from the United States. Personify's privacy policy lists "Personify Inc. and its affiliates, a2z Personify, LLC, WildApricot Inc., and MemberClicks LLC," operating from an Austin, Texas headquarters and pointing to the Data Privacy Framework for transfers out of the EU — a North-American corporate and data footprint, with no mainland-China operation or region in the picture. | Personify Inc. — Privacy Policy (personifycorp.com/privacy-policy), retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For an association or nonprofit with members in mainland China, the deciding question about WildApricot is not how quickly the member portal paints — it is where your members’ personal data is allowed to live, and whether the public portal can be licensed to operate there at all. WildApricot answers the first half in its own security documentation: it runs on Amazon Web Services in North America, with no region inside mainland China. So a China-facing WildApricot site is reachable, but every member record it holds sits offshore — which turns your China membership into a cross-border data transfer under Chinese law, and leaves the member portal with no footing for the ICP filing a mainland site requires. The loading is the easy part; the residency and the licensing are the exposure.
WildApricot in China at a glance
| What decides it | In WildApricot's own terms |
|---|---|
| Where it runs | Its “hosting provider, Amazon Web Services (AWS),” carries “the main WildApricot solution … over one AWS Region with at least three Availability Zones,” with payment systems in “two data centers located in Dallas, TX and Phoenix, AZ.” Every location named is in North America; none is in mainland China. |
| Where member data lives | “All data is stored in highly secure AWS data centers,” backed up nightly to Amazon S3 — North American infrastructure, offshore from the members it describes. |
| Serving the public | A member-facing site or portal shown to mainland visitors needs an ICP filing tied to a mainland hosting resource. With no mainland region, WildApricot offers no ICP-filing path of its own. |
| Your members' data under PIPL | Personal information of China-based members stored on North American AWS is a cross-border transfer PIPL governs, plus a data-localization duty for CIIOs and large-volume handlers that offshore storage cannot meet. |
| Is it reachable? | Yes — served from AWS, it loads from the mainland. The offshore hosting and licensing are the exposure, not a block at the network. |
North American AWS, and no mainland region
WildApricot runs on Amazon Web Services. In its own security overview it calls AWS its “hosting provider,” states that “All data is stored in highly secure AWS data centers,” and describes the product as “distributed over one AWS Region with at least three Availability Zones,” with payment systems hosted at Armor across “two data centers located in Dallas, TX and Phoenix, AZ.” Every location WildApricot names sits in North America; not one is inside mainland China. AWS does operate mainland-China regions, but those are a walled-off partition only a company holding a Chinese business license can use — plainly not a Toronto-built, Austin-run membership platform. So “it’s on AWS” does not put your members’ data in China; it keeps it offshore from the people it describes, which settles the data question before performance is ever raised.
Your members’ data crosses the border
Serve a China membership from WildApricot and the personal information you hold on those members — names, contact details, event registrations, payment records — lives on AWS data centers outside the mainland. Under China’s Personal Information Protection Law that is a cross-border transfer, and the obligation falls on you, the handler, not on WildApricot: you must give members notice, obtain their separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). If your organization is a critical information infrastructure operator, or holds personal information above the regulated volume, that data must instead be stored inside China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty no North American AWS region can meet.
A public member portal needs an ICP filing
WildApricot’s whole purpose is a member-facing website: a public homepage, event and registration pages, a login, a members-only area. Shown to visitors inside mainland China, that portal turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and the filing has to attach to a hosting resource physically in the mainland. WildApricot provides only North American AWS, so there is nothing on it to file against. Reaching the portal from China is not the same as being licensed to run it there — and no amount of tuning the WildApricot site creates the in-country footing a filing needs.
This is a risk map, not a verdict: whether you owe an ICP filing, in-country member-data storage, or both depends on who your members are, how many you hold, and what your organization is — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
Your association keeps running WildApricot exactly as it does today. We add what a North-American membership platform structurally cannot: compliant, ICP-filed delivery from inside the mainland, set in front of your existing WildApricot portal — no rebuild, no export of your member database, and no second system to keep in sync. Our China team maps your PIPL cross-border and data-residency obligations against your entity and your membership, then stands up the in-country delivery and storage a lawful China presence needs, while WildApricot stays the home of your members and events.
Related reading:
