Does Zapier Work in China? Cross-Border Data, Residency & a Cloud-Only Tool
Zapier is a cloud-only automation layer hosted on AWS servers in the United States, with no mainland-China region and no data-residency option — so the personal data your Zaps move out of China is a cross-border transfer under PIPL, and the duty is yours, not Zapier's. A compliance-first look.
Does Zapier work in China?
Whether you can use Zapier in China is first a cross-border-data and residency question, not a speed one. Zapier is a cloud-only automation layer — you can't self-host it — so where the personal data your Zaps move comes to rest is fixed, and that is what China's law responds to.
By Zapier's own data-privacy documentation, "Zapier hosts data in AWS servers located in the United States, including customers' personal data and the data that is processed on behalf of customers," and asked whether data can be kept within one region it answers plainly that "Zapier does not support this option" — so there is no mainland-China region and no data-residency control at all. Zapier also names you, the customer, the "data controller" and itself the "data processor," which under China's Personal Information Protection Law makes the cross-border transfer yours to justify: the personal data your Zaps pull from people in China lands on US servers, needing notice, separate consent and a transfer mechanism. The table below is Zapier's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on your data volumes and your role. Our China team can map your Zapier exposure with you →
What Zapier's own documentation says about China
| Fact | Primary source |
|---|---|
| In Zapier's own words: "Zapier hosts data in AWS servers located in the United States, including customers' personal data and the data that is processed on behalf of customers." Asked whether data can be kept within a single region, Zapier answers that it "does not support this option" — so there is no mainland-China region, and no data-residency control at all. Zapier is cloud-only, so you also cannot self-host it inside the mainland to localize that data. | Zapier — Data Privacy Overview, retrieved 2026-10-07 |
| Zapier names you the handler, not itself: for Customer Content "you, the customer, are considered the 'data controller'" and "Zapier is the 'data processor.'" So when your Zaps carry personal data out of China to those US servers, PIPL puts the cross-border duty on you — notice, separate consent, and one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). | Zapier — Data Privacy Overview (controller/processor); PIPL Chapter III, Articles 38–43 |
| The weight of that duty scales with volume and role, not with using the tool. Under the CAC's March 2024 Regulations on Promoting and Regulating Cross-border Data Flows, a non-CIIO moving fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, the standard contract and certification. But a CIIO or large-volume handler must keep personal information collected in China inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty Zapier's US-only, cloud-only hosting cannot meet. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024; PIPL Article 40; CSL Article 37 |
| Zapier can expose public endpoints — hosted webhooks, catch hooks and interfaces — and they answer from that same offshore US infrastructure. A public endpoint served to mainland-China visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, which must attach to a hosting resource inside the mainland. Zapier publishes no mainland region, so a Zapier-hosted endpoint has no ICP-filing path of its own — reaching it from offshore is not the same as being cleared to operate from inside China. | PRC Regulations on Telecommunications (State Council Order No. 292); Administrative Measures for the Filing of Non-operational Internet Information Services (MIIT Order No. 33) |
| Zapier's own cross-border posture is built around the West, not China: it states it "has certified our compliance with the EU-US Data Privacy Framework (DPF), the UK Extension, and the Swiss-US DPF as set forth by the US Department of Commerce." There is no equivalent mechanism it provides for personal data leaving mainland China — that gap is the customer's to close under PIPL, not Zapier's. | Zapier — Data Privacy Overview, retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Zapier is not how fast it runs — it is where the personal data your Zaps move is allowed to live. Zapier is a cloud-only automation layer: it runs on Zapier’s own infrastructure, and in its own documentation that infrastructure is “AWS servers located in the United States.” You cannot self-host it inside the mainland the way you could a self-hostable tool, and Zapier offers no regional data-residency option — so every contact, form entry and record your workflows carry out of China is processed and stored offshore. Reaching Zapier’s triggers and webhooks is rarely the problem; where the data they move comes to rest, and under whose legal duty, is.
Zapier in China at a glance
| What decides it | In Zapier's own terms |
|---|---|
| Where it runs | Zapier is cloud-only and, in its own words, “hosts data in AWS servers located in the United States.” It runs on Zapier's own infrastructure; there is no mainland-China region, and no option to run your own instance inside the mainland. |
| Data-residency option | Asked whether data can be kept within a single region, Zapier says it “does not support this option.” If it will not pin data even to the EU, there is certainly no mainland-China residency setting. |
| Who is the handler | Zapier names you “the data controller” of your Customer Content and itself “the data processor.” Under PIPL the cross-border transfer is the customer's duty to justify, not Zapier's. |
| Your China users' data | Personal data your Zaps pull from people in China is processed and stored on US AWS — a cross-border transfer PIPL governs. A CIIO or large-volume handler must keep it in-country, which US-only hosting cannot do. |
| Serving a public endpoint | A Zapier-hosted webhook or interface exposed to mainland visitors answers from offshore US infrastructure, with no mainland resource to carry the ICP filing a public in-country service needs. |
The data in your Zaps lives in the United States — and Zapier won’t move it
In its own data-privacy documentation Zapier states that it “hosts data in AWS servers located in the United States, including customers’ personal data and the data that is processed on behalf of customers.” That is the whole surface area of the tool: Zaps exist to move data between the apps you connect — contacts from a CRM, submissions from a form, tickets from a help desk — and whatever a run touches passes through, and is retained on, that US infrastructure. Zapier offers no way to pin that data to a region: asked whether it can be kept within the EU, it answers it “does not support this option,” so there is certainly no mainland-China residency setting. And because Zapier is a managed, cloud-only service, you cannot stand up your own instance inside the mainland the way you could with a self-hostable tool. Where the data rests is fixed, and it is offshore.
You are the handler, so the cross-border transfer is yours
Zapier is explicit about who carries the legal duty. For Customer Content, it says, “you, the customer, are considered the ‘data controller’” and “Zapier is the ‘data processor.’” China’s Personal Information Protection Law draws the same line: the personal-information handler — you, the Zapier customer, not Zapier — is responsible when personal data leaves the country. So every time a Zap pulls personal information from someone in China into that US-hosted pipeline, you are making a cross-border transfer, and PIPL requires you to give notice, obtain separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification.
How heavy that is depends on volume and role. Under the CAC’s March 2024 Regulations on Promoting and Regulating Cross-border Data Flows, a non-CIIO moving fewer than 100,000 individuals’ non-sensitive personal information in a calendar year is exempt from the assessment, the standard contract and certification. At the other end, a CIIO or large-volume handler must keep personal information collected in China inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty Zapier’s US-only, cloud-only hosting simply cannot satisfy, because there is no in-country Zapier to keep it on.
Reaching Zapier’s triggers and webhooks is the delivery half, not the compliance question
Zapier also runs public endpoints — hosted webhooks, catch hooks and interfaces — and they answer from that same offshore US infrastructure. Two things follow. First, if you expose such an endpoint to mainland visitors as part of a public service, serving it from inside China would turn on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, tied to a mainland hosting resource — and Zapier, with no mainland region, offers no footing for one. Second, whether those offshore endpoints answer quickly and reliably from inside China is a genuine delivery question, but it is downstream of the compliance one, and this page draws only on what Zapier documents about where data lives, not on a China-side performance measurement. Reachability, fast or slow, says nothing about whether the personal data in your Zaps is allowed to sit where Zapier keeps it.
This is a risk map, not a verdict: whether you owe notice and consent, a full transfer mechanism, or in-country storage of the data itself turns on how much personal information your workflows carry and whether your role pulls you into the CIIO or large-volume tier — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep automating in Zapier exactly as you do now. What we add is the piece a US-only, cloud-only tool cannot give itself: a lawful home in the mainland for the China personal data your workflows touch. Our China team first maps your PIPL cross-border and data-residency obligations against your entity and the data your Zaps actually carry. Then, where the law requires that data to stay on Chinese soil, we stand up ICP-filed, in-country delivery and storage — placed in front of the systems that feed Zapier, with no rebuild and no second codebase — so the personal data has a compliant in-country home and only what is lawful to transfer ever crosses the border to Zapier.
Related reading:
