Box
Transparency
Breakdown
| Subprocessor list | 30 / 30 | |
| Processing locations | 8 / 8 | |
| Purposes | partial | 0 / 7 |
| Data processing addendum | not found | 0 / 12 |
| Trust center | 8 / 8 | |
| Privacy policy | not found | 0 / 6 |
| security.txt | not found | 0 / 6 |
| Security page | 5 / 5 | |
| Status page | 5 / 5 | |
| Vulnerability disclosure | not found | 0 / 5 |
| Pages still reachable | 8 / 8 | |
| Total | 64 / 100 |
Only documents we can retrieve count: a page behind a login or a broken link scores nothing.
Badge
For Box's own site; it updates with the rating.
<a href="https://thirdpartyindex.com/vendors/box"><img src="https://thirdpartyindex.com/badge/box.svg" alt="Box transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/box)Compliance
- FedRAMP
- Box Enterprise Cloud Content Collaboration Platform Authorized High · 50 agency authorizations · since Mar 25, 2025
FedRAMP status from the FedRAMP Marketplace (evidence)
Documents
| Document | Verified | Changed | Evidence |
|---|---|---|---|
| Trust center | snapshot | ||
| Subprocessor list | snapshot | ||
| Terms | snapshot | ||
| Security page | snapshot | ||
| Status page statuspage | snapshot |
Subprocessors
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Amazon Web Services, Inc. | United States of America* | ||
| Anthropic PBC | United States of America | ||
| Google, LLC. | United States of America* | ||
| International Business Machines ("IBM") Corporation | United States of America* | ||
| Microsoft Corporation | United States of America* | ||
| OpenAI Group PBC | United States of America | ||
| SpaceXAI LLC | United States of America | ||
| TaskUs, LLC. | Philippines | ||
| Zendesk, Inc. | United States of America |
Listed as a subprocessor by (16)
Purposes as each company states them.
Adobe adobe.com Box assists with the secure exchange of uploading and downloading files from user accounts for Adobe Learning Manager by providing a file transfer protocol service (known as FTP). To do so it processes the following data categories: name, username, email address, transactional information (e.g., information about data storage preferences), employment details, and technical usage information.
Alcide alcide.io
Capsule8 capsule8.com Secure storage of forensic data and incident-related files
Conga conga.com Cloud Services
Conviva conviva.com SaaS document management service
Dynatrace dynatrace.com
Gainsight Software gainsight.com Content Management and File Sharing
Keap keap.com
MongoDB mongodb.com File Sharing for Remote Consulting Services
Rapid7 rapid7.com
Ready ready.net Document management; Secure file storage and sharing
SOPHOS sophos.com Secure storage of forensic data and incident-related files
- Udemy udemy.com Cloud-based file storage
Wrike wrike.com
ZoomInfo zoominfo.com Document hosting and delivery services
wiz.io wiz.io
Service status
- 9 incidents in 52 days
- 5 major or critical
- 1 h 13 min typical time to resolve
- 2 h 39 min longest major
| Began | Incident | Impact | Lasted |
|---|---|---|---|
| [Minor] Issue with Admin Reporting | minor | 53 min | |
| [Medium] Issues with Box Hubs Shared Links | minor | 1 h 40 min | |
| [Critical] Issue with Downloads | critical | 44 min | |
| [Medium] Issue with Uploads | major | 41 min | |
| [Minor] Issue with Logins & Files Page | minor | 2 h | |
| [Medium] Issue with Microsoft Office Integration and Box Edit | major | 1 h 13 min | |
| [Medium] Issues with Multiple Box Services | major | — | |
| [Minor] Issues with All Files Page | minor | 24 min |
As Box's status page reports its own incidents (scheduled maintenance left out), read every few hours since (evidence)
Changes
None since tracking began.