Does Prisma Work in China? The ORM, Prisma Postgres & Data Residency
Prisma's ORM is a neutral library that runs with your app — but its hosted products, Prisma Postgres and Accelerate, run only in offshore regions (San Francisco, North Virginia, Paris, Frankfurt, Tokyo, Singapore), none in mainland China. So your China users' data of record lives offshore and crosses the border on every query: a PIPL data-residency and cross-border-transfer question, not a speed one.
Does Prisma work in China?
Whether you can use Prisma in China splits in two — and the deciding half is a data-residency question, not a speed one. The Prisma ORM is just a library: it runs inside your application, wherever that runs, so on its own it raises no China data-residency question. What China's law looks at is Prisma's hosted data platform — Prisma Postgres and Accelerate — and where it keeps your data.
By Prisma's own FAQ, "Prisma Postgres is currently available in the following regions" — San Francisco, North Virginia, Paris, Frankfurt, Tokyo and Singapore — with none in mainland China. So if your system of record is Prisma Postgres, your China users' personal data is stored offshore and crosses the border on every query, and Accelerate's hosted cache holds your query results offshore too. PIPL governs that cross-border transfer, and for a CIIO or large-volume handler no offshore region can meet the in-country storage duty. The table below is Prisma's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on what you store, your data volumes and your role. Our China team can map your Prisma data-residency exposure with you →
Compliance snapshot
- ✓ The Prisma ORM itself is neutral — a library that runs inside your app, wherever that is, so on its own it raises no China data-residency question
- ✕ But Prisma Postgres, the hosted database, runs only in offshore regions — San Francisco, N. Virginia, Paris, Frankfurt, Tokyo, Singapore — none in mainland China
- ! Personal data in your Prisma Postgres, and the query results Accelerate caches, sit offshore — a cross-border transfer PIPL governs
- ✕ No mainland-China region, so no data-residency option for a CIIO or large-volume handler
- ✓ A compliant path exists: ICP-filed in-country storage and delivery in front of your stack — no rebuild, no migration
What Prisma's own documentation says about China
| Fact | Primary source |
|---|---|
| In Prisma's own Prisma Postgres FAQ, "Prisma Postgres is currently available in the following regions" — us-west-1 (San Francisco), us-east-1 (North Virginia), eu-west-3 (Paris), eu-central-1 (Frankfurt), ap-northeast-1 (Tokyo) and ap-southeast-1 (Singapore). None is in mainland China, and the nearest — Tokyo or Singapore — is still offshore. So wherever you deploy the Prisma ORM, if your system of record is Prisma Postgres the database itself lives outside the mainland. | Prisma Docs — Prisma Postgres FAQ, retrieved 2026-10-08 |
| Prisma comes in two parts with different China exposure. The Prisma ORM is a library that runs inside your application, so it sits wherever you deploy your app and moves no data across any border on its own. Prisma Postgres is different — by Prisma's own words it is "a managed PostgreSQL database with built-in connection pooling and edge runtime support," the hosted system of record that holds the personal data your users generate. The compliance question attaches to the hosted data platform, not to the library. | Prisma Docs — Prisma Postgres overview, retrieved 2026-10-08 |
| A hosted database is the system of record: every read pulls personal data out and every write puts it back, so an application or user connecting from inside mainland China to an offshore Prisma Postgres endpoint exchanges personal information across the border continuously, not once. PIPL governs that cross-border transfer — the personal-information handler (you, Prisma's customer, not Prisma) must give notice, obtain separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 |
| The caching layer keeps data offshore too. By Prisma's FAQ, "cacheStrategy works with a Prisma Postgres database only through a hosted Accelerate connection" — so when you cache query results through Accelerate, copies of those results, which can include personal data, are held on Prisma's hosted infrastructure in the same offshore regions, not on Chinese soil. | Prisma Docs — Prisma Postgres FAQ (Caching), retrieved 2026-10-08 |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside mainland China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). Prisma Postgres publishes no mainland-China region, so none of its locations can meet that data-localization duty — keeping your China users' data on Chinese soil means running the database and its storage on ICP-filed infrastructure inside the mainland. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-08.
For a mainland-China audience, the deciding question about Prisma is not how quickly a query comes back — it is where your data is allowed to live. And Prisma is really two things. The Prisma ORM is a library: it runs inside your own application, wherever you deploy it, so on its own it raises no China data-residency question. Prisma’s hosted data platform is a different matter. Prisma Postgres — its managed database — together with Accelerate — its hosted connection pool and query cache — run only in offshore regions, with none inside mainland China. Make Prisma Postgres your system of record and the personal data your China users generate is stored offshore, with every read and write crossing the border. The endpoint is reachable; what China’s law responds to is that the data of record sits on the wrong side of the border.
Prisma in China at a glance
| What decides it | Where Prisma stands for China |
|---|---|
| What Prisma is | Two parts with different exposure. The Prisma ORM is a library that runs inside your application — neutral on data residency. Prisma Postgres (a managed database) and Accelerate (a hosted connection pool and query cache) are hosted services that hold your data; where that data lives is the deciding question. |
| Where it runs | Prisma Postgres is “currently available in the following regions” — San Francisco, North Virginia, Paris, Frankfurt, Tokyo and Singapore. No region is inside mainland China; the nearest, Tokyo or Singapore, is still offshore. (The ORM runs wherever you deploy your app, so you choose that location.) |
| Your data in Prisma | Personal data your app writes to Prisma Postgres — and the query results Accelerate caches — sits offshore, a cross-border transfer PIPL governs, and it moves across the border on every read and write. |
| Data residency | For a CIIO or large-volume handler, personal information collected in China must stay on the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). No Prisma Postgres region can meet that duty. |
| Is it reachable? | The hosted endpoint is offshore, so reaching it from China is a delivery matter. Reachable or not, the data of record is offshore — and that is the compliance fact. |
The ORM is neutral — the hosted platform is where the law looks
Start by splitting Prisma in two, because the halves sit in very different places under China’s law. The Prisma ORM is a client library: it is generated into your codebase and runs inside your application process, issuing queries to whatever database you point it at. It does not host your data, and it does not, by itself, move anything across a border — deploy your app on infrastructure inside mainland China, pointed at a database inside mainland China, and the ORM adds no cross-border exposure of its own.
Prisma’s hosted data platform is the part that carries the question. In Prisma’s own words, Prisma Postgres is “a managed PostgreSQL database with built-in connection pooling and edge runtime support” — a service Prisma runs for you, holding the personal data your users generate. So the test for China is not “do you use Prisma,” but “where does Prisma’s hosted platform keep your data.” That is a location question, and location is exactly what the next section settles.
Your Prisma Postgres database of record sits offshore
Prisma Postgres is where your application actually keeps its data, and Prisma’s own FAQ names the only places it can sit: “Prisma Postgres is currently available in the following regions” — San Francisco, North Virginia, Paris, Frankfurt, Tokyo and Singapore. Not one is inside mainland China, and the closest — Tokyo or Singapore — is still outside it. That single geographic fact settles the China question before any query is timed: the data your China users generate is stored on the far side of the border.
A hosted database is not like a static asset, where a copy of a file crosses the border once. Here the personal data itself is in motion: every query reads it out of an offshore region, every insert and update writes it back, and backups of it live offshore too. Under China’s Personal Information Protection Law, both the offshore storage and that continuous flow are a cross-border transfer, and the duty lands on you — the handler — not on Prisma: notice, separate consent, and one cleared transfer mechanism. And for a critical information infrastructure operator or a large-volume handler, personal information collected in China has to stay on the mainland, which no offshore Prisma Postgres region can satisfy.
Accelerate caches your query results offshore too
The caching layer does not escape this. Accelerate is Prisma’s hosted connection pool and query cache, and by the Prisma Postgres FAQ, “cacheStrategy works with a Prisma Postgres database only through a hosted Accelerate connection.” When you cache query results through Accelerate, copies of those results — which can include your users’ personal data — are held on Prisma’s hosted infrastructure in the same offshore regions, not on Chinese soil. So reaching for the cache to speed a China-facing app does not pull the data back onshore; it places another copy of it abroad. The connection pool that runs alongside Prisma Postgres sits with the database, in those same offshore regions.
Reachable or not, the data is still offshore
The reachability of a Prisma endpoint from China is a delivery matter, and it is independent of the compliance question. Whether a connection from inside the mainland to an offshore region is quick or slow, steady or flaky, the legal picture does not move: an endpoint that answers instantly is still holding your China users’ personal data outside the mainland, which is precisely what PIPL’s residency and cross-border rules respond to. Treat this as a risk map, not a verdict — whether you face a localization duty, a transfer-mechanism obligation, or both turns on what you store, how much personal data you hold, and who your users are. It is worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep building with Prisma. We add the piece a hosted platform with no mainland presence cannot: compliant, ICP-filed storage and delivery from inside the mainland, set in front of the stack you already run — no rebuild, no second codebase, and no move off Prisma. Our China team maps your cross-border and data-residency obligations against your entity and data volumes, then, where the law requires your China users’ data to stay on Chinese soil, stands up the in-country storage and delivery a lawful China presence needs — while your application keeps running exactly where it is.
Related reading:
Frequently Asked Questions
Does Prisma Postgres store Chinese users' data in mainland China?
No. By Prisma's own Prisma Postgres FAQ, the service is available in six regions — San Francisco, North Virginia, Paris, Frankfurt, Tokyo and Singapore — with none inside mainland China. So the data your application writes to Prisma Postgres for China users is held offshore, nearest in Tokyo or Singapore. The Prisma ORM runs wherever you deploy your app, but the hosted database keeps the data of record outside the mainland.
Is it against the law to use Prisma for a China-facing app?
Not inherently, and the ORM by itself is not the issue — it is a library that runs with your app and moves no data abroad on its own. The exposure comes from the hosted products: storing your China users' personal data in offshore Prisma Postgres, and caching it through Accelerate, is a cross-border transfer, which PIPL permits if you give notice, obtain separate consent and meet one transfer mechanism. Under the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from those mechanisms; above that, or as a CIIO or large-volume handler owing in-country storage, the obligations bite. Treat it as a risk to assess with counsel for your data volumes and role, not a blanket ban.
Can 21YunBox help make our Prisma setup compliant in China?
Yes. Our China team can assess your cross-border and data-residency exposure for your data volumes and role, and — where the law requires your China users' data to stay on the mainland — stand up compliant, ICP-filed in-country storage and delivery in front of the stack you already run, with no rebuild and no migration off Prisma. Get in touch to work through your specific case.
