Box

box.com · facts updated 1 hour ago

Privacy facts at a glance

Jurisdictions: US · PH · JP · GB · FR · DE · CA · AU · SE · NL · PL
Subprocessors: 8
Transfer mechanism: Processor Binding Corporate Rules (BCRs) and written agreements with subprocessors enforcing international data transfer requirements
DPA available: Yes
GDPR addressed: Yes

Named subprocessors

Amazon Web Services, Inc. Google, LLC. International Business Machines (IBM) Corporation Microsoft Corporation TaskUs, LLC. Zendesk, Inc. OpenAI Group PBC Anthropic PBC

Tracked documents

https://www.box.com/legal/privacypolicy checked 4 hours ago

https://www.box.com/legal/termsofservice checked 3 hours ago

Data processing agreement

https://www.box.com/node/20576 checked 3 hours ago

Subprocessor list

https://www.box.com/legal/subprocessors checked 3 hours ago

Security / trust page

https://www.box.com/trust checked 3 hours ago

Recent changes

minor Security / trust page 3 hours ago

Box's security/trust page content was replaced with a Cloudflare challenge page ('Just a moment...'), removing all visible trust center content including security, compliance, AI, and reliability information.

Public summary; per-account review history visible to subscribers tracking this vendor.

Track Box in your workspace.

Get notified when Box adds a subprocessor, changes retention, updates their DPA, or quietly amends their privacy posture.

Start tracking — 14-day trial

No card required.