# Box Box declares [9 subprocessors](https://thirdpartyindex.com/vendors/box#subprocessors) in [its subprocessor list](https://www.box.com/legal/subprocessors), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/8579)). They include [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services), [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud) and [OpenAI](https://thirdpartyindex.com/vendors/openai). No published changes since we first read it on 2026-09-22. [63 tracked vendors](https://thirdpartyindex.com/vendors/box#used-by) name Box as a subprocessor, including [MongoDB](https://thirdpartyindex.com/vendors/mongodb), [LinkedIn](https://thirdpartyindex.com/vendors/linkedin) and [Gainsight Software](https://thirdpartyindex.com/vendors/gainsight-software). Box (box.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index. - Page: https://thirdpartyindex.com/vendors/box - Documents last verified: 2026-11-11 - Transparency rating: 64/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 0/7 (partial); Data processing addendum 0/12 (not found); Trust center 8/8; Privacy policy 0/6 (not found); security.txt 0/6 (not found); Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8 - Supply chain: relies on 9 tracked vendors directly, 88 within two hops, 300 within three; 63 tracked vendors rely on it directly, 626 within two hops, 2250 within three - Cite as: Box, Third Party Index, https://thirdpartyindex.com/vendors/box (data CC BY 4.0) ## Documents | Document | URL | Last verified | Last changed | |---|---|---|---| | Trust center | https://www.box.com/trust | 2026-11-11 | 2026-10-14 | | Subprocessor list | https://www.box.com/legal/subprocessors | 2026-11-11 | 2026-09-24 | | Terms | https://www.box.com/legal/termsofservice | 2026-11-11 | 2026-09-28 | | Security page | https://www.box.com/about-us/security | 2026-11-11 | 2026-11-07 | | Status page | https://status.box.com/ | 2026-11-11 | 2026-11-11 | ## Subprocessors (9) As its own list states them. | Subprocessor | Purpose | Location | Listed since | |---|---|---|---| | [Amazon Web Services, Inc.](https://thirdpartyindex.com/vendors/amazon-web-services.md) | — | United States of America\* | 2026-09-22 | | [Anthropic PBC](https://thirdpartyindex.com/vendors/anthropic.md) (AI model provider: Anthropic) | — | United States of America | 2026-09-22 | | [Google, LLC.](https://thirdpartyindex.com/vendors/google-cloud.md) | — | United States of America\* | 2026-09-22 | | [International Business Machines ("IBM") Corporation](https://thirdpartyindex.com/vendors/ibm.md) | — | United States of America\* | 2026-09-22 | | [Microsoft Corporation](https://thirdpartyindex.com/vendors/microsoft.md) | — | United States of America\* | 2026-09-22 | | [OpenAI Group PBC](https://thirdpartyindex.com/vendors/openai.md) (AI model provider: OpenAI) | — | United States of America | 2026-09-22 | | [SpaceXAI LLC](https://thirdpartyindex.com/vendors/spacexai.md) (AI model provider: xAI) | — | United States of America | 2026-09-22 | | [TaskUs, LLC.](https://thirdpartyindex.com/vendors/taskus.md) | — | Philippines | 2026-09-22 | | [Zendesk, Inc.](https://thirdpartyindex.com/vendors/zendesk.md) | — | United States of America | 2026-09-22 | Read from ([evidence](https://thirdpartyindex.com/evidence/2677)). CSV: https://thirdpartyindex.com/vendors/box/subprocessors.csv AI model providers (or a cloud provider's AI model service) among these entries: 3. All vendors that list one: https://thirdpartyindex.com/ai ## Compliance As its trust center lists them. - FedRAMP Marketplace: High · 51 agency authorizations · since Mar 25, 2025 ## Security program What BOX INC's Form 10-K for fiscal 2026, filed Mar 9, 2026 (Item 1C) says, in its words (https://www.sec.gov/Archives/edgar/data/1372612/000119312526098466/0001193125-26-098466-index.htm). - Led by: Chief Information Security Officer - Leader's experience: 15+ years - Board oversight: Audit Committee - Frameworks named: NIST CSF, FedRAMP - Practices named: Threat intelligence, Security training - Engages outside assessors or consultants - Reviews its suppliers' security - Says no cybersecurity incident has materially affected it ## Web Technologies Box's homepage made 237 requests to 30 domains, 14 services controlled by another company, and 3 domains not identified. Loaded on 2026-11-04 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data. 14 third parties by category: Advertising 4 (Google Cloud, StackAdapt, OpenAI; usually detected as Advertising: Xandr); Analytics 3 (ZoomInfo, Cloudflare; usually detected as Analytics: Meta); Marketing automation 2 (Adobe, 6Sense Insights, Inc.); Live chat 1 (Qualified.com, Inc.); Cookie compliance 1 (TrustArc); Customer data platform 1 (Segment); Issue trackers 1 (usually detected as Issue trackers: Sentry); RUM 1 (reviewed: New Relic). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these. ### Third parties (14) - Adobe: 27 requests to adobedtm.com, demdex.net, marketo.net, everesttech.net, mktoresp.com, omtrdc.net; Marketo - 6Sense Insights, Inc.: 20 requests to 6sc.co, 6sense.com; 6sense - Qualified.com, Inc.: 17 requests to qualified.com; Qualified - Google Cloud: 6 requests to google.com, doubleclick.net, googletagmanager.com; DoubleClick Floodlight, Google Analytics, Google Tag Manager (its subprocessor list names it too) - New Relic: 6 requests to nr-data.net, newrelic.com - Segment: 6 requests to segment.com, segment.io; Segment - StackAdapt: 5 requests to stackadapt.com; StackAdapt - OpenAI: 3 requests to openai.com; ChatGPT Ads Measurement Pixel (its subprocessor list names it too) - TrustArc: 3 requests to trustarc.com; TrustArc - ZoomInfo: 3 requests to zi-scripts.com, zoominfo.com; Zoominfo - Cloudflare: 1 request to cloudflareinsights.com; Cloudflare Browser Insights - Meta: 1 request to facebook.com - Sentry: 1 request to sentry.io - Xandr: 1 request to adnxs.com ### Unknown (3) Domains not identified yet: knotch-cdn.com, knotch.it, knotch.com ### First party (1) - Box: 127 requests to box.com, segment-box.com; Acquia Cloud Platform, Adobe Analytics, Adobe Audience Manager, Adobe Experience Platform Identity Service, Adobe Experience Platform Launch, Adobe Target 2.11.9, Amazon Web Services, Cloudflare, Drupal, Facebook Pixel, GSAP, Glide.js, HSTS, HTTP/3, LazySizes, Mouse Flow, New Relic, Open Graph, PHP, PWA, Priority Hints, ScrollMagic 2.0.8, Sentry, Varnish, jQuery 10 tracked companies loaded by the homepage are not in Box's subprocessor list. A website can use a service without it processing customer data. ## Subprocessor of (63) Tracked vendors whose own subprocessor lists name it, and what they say they use it for. - [Addepar](https://thirdpartyindex.com/vendors/addepar.md): Operation of a cloud based data warehousing service onbehalf of Addepar.; Provision of file management capabilities within the Addepar Platform. - [Adobe](https://thirdpartyindex.com/vendors/adobe.md): Box assists with the secure exchange of uploading and downloading files from user accounts for Adobe Learning Manager by providing a file transfer protocol serv… - [Alayacare](https://thirdpartyindex.com/vendors/alayacare.md): Data storage and processing; Used to exchange PII/PHI data files between Customer and AlayaCare usually during implementation. - [Alcide](https://thirdpartyindex.com/vendors/alcide.md) - [Arctic Wolf](https://thirdpartyindex.com/vendors/arctic-wolf.md): Cloud file hosting - [Aztec Software](https://thirdpartyindex.com/vendors/aztec-software.md): Secure File transfer for Aztec Operations - [Betterworks](https://thirdpartyindex.com/vendors/betterworks.md): Cloud-based file sharing and content management system used for transmitting and storing customer-specific documents. - [Capsule8](https://thirdpartyindex.com/vendors/capsule8.md): Secure storage of forensic data and incident-related files - [Carta](https://thirdpartyindex.com/vendors/carta.md): File transfer - [Certara](https://thirdpartyindex.com/vendors/certara.md): File sharing and storage (Box) - [Claroty](https://thirdpartyindex.com/vendors/claroty.md) - [Clickagy](https://thirdpartyindex.com/vendors/clickagy.md): Document hosting and delivery services - [Coalfire](https://thirdpartyindex.com/vendors/coalfire.md): Data storage and collaboration - [Cognella](https://thirdpartyindex.com/vendors/cognella.md): Secure cloud file storage and collaboration. - [Confirm](https://thirdpartyindex.com/vendors/confirm.md) - [Conga](https://thirdpartyindex.com/vendors/conga.md): Cloud Services - [Conviva](https://thirdpartyindex.com/vendors/conviva.md): SaaS document management service - [CS DISCO](https://thirdpartyindex.com/vendors/cs-disco.md): File transfer tool - [DataRobot](https://thirdpartyindex.com/vendors/datarobot.md): Document sharing services - [Demandbase](https://thirdpartyindex.com/vendors/demandbase.md): Storage - [Dialpad](https://thirdpartyindex.com/vendors/dialpad.md): Document & File Management - [Dispel](https://thirdpartyindex.com/vendors/dispel.md): File storage - [Dynatrace](https://thirdpartyindex.com/vendors/dynatrace.md) - [EAB](https://thirdpartyindex.com/vendors/eab.md): Enterprise file storage and sharing platform; File sharing and collaboration platform; File storage and collaboration platform; Secure file hosting - [Elavon](https://thirdpartyindex.com/vendors/elavon.md): Service Specific; Software solution services - [Envoy Global](https://thirdpartyindex.com/vendors/envoy-global.md): Document management - [Flywire](https://thirdpartyindex.com/vendors/flywire.md): File sharing and storage tool - [Gainsight Software](https://thirdpartyindex.com/vendors/gainsight-software.md): Content Management and File Sharing - [Gigamon](https://thirdpartyindex.com/vendors/gigamon.md) - [Hibob](https://thirdpartyindex.com/vendors/hibob.md) - [Imperva](https://thirdpartyindex.com/vendors/imperva.md): Cloud hosting services. - [InRule](https://thirdpartyindex.com/vendors/inrule.md): - Applicable Services: InRule Decision Platform - Data Processing:Document storage and file sharing platform used for exchanging customer data between InRule pe… - [Juniper Square](https://thirdpartyindex.com/vendors/juniper-square.md) - [Keap](https://thirdpartyindex.com/vendors/keap.md) - [Khoros](https://thirdpartyindex.com/vendors/khoros.md): File storage for Customers using the “File Preview Feature” - [Kitman Labs](https://thirdpartyindex.com/vendors/kitman-labs.md): Cloud storage service provider - [Klaxoon by Wrike](https://thirdpartyindex.com/vendors/klaxoon-by-wrike.md) - [Korn Ferry](https://thirdpartyindex.com/vendors/korn-ferry.md) - [Lightico](https://thirdpartyindex.com/vendors/lightico.md): Storage Integration - [LinkedIn](https://thirdpartyindex.com/vendors/linkedin.md): Cloud Storage - [MangoApps](https://thirdpartyindex.com/vendors/mangoapps.md): Documents (optional) - [Mattermost](https://thirdpartyindex.com/vendors/mattermost.md): Storage tool - [Mindtickle](https://thirdpartyindex.com/vendors/mindtickle.md): Media processing & transformation - [MongoDB](https://thirdpartyindex.com/vendors/mongodb.md): File Sharing for Remote Consulting Services - [Moqups](https://thirdpartyindex.com/vendors/moqups.md): Cloud Drive - [Network to Code](https://thirdpartyindex.com/vendors/network-to-code.md): Document hosting; Secure document hosting and management of sensitive data. - [NeverBounce](https://thirdpartyindex.com/vendors/neverbounce.md): Document hosting and delivery services - [Oyster HR](https://thirdpartyindex.com/vendors/oyster-hr.md): Bulk Uploading of Payroll Team Member Data for Onboarding - [Pax8](https://thirdpartyindex.com/vendors/pax8.md): Business development, technical support and Partner Services. - [Ping Identity](https://thirdpartyindex.com/vendors/ping-identity.md): Generally applicable when a customer files a support case and attaches customer data to the ticket (e.g., attachments, log files); Storage and transfer of log f… - [Rapid7](https://thirdpartyindex.com/vendors/rapid7.md) - [Ready](https://thirdpartyindex.com/vendors/ready.md): Document management; Secure file storage and sharing - [Rubrik](https://thirdpartyindex.com/vendors/rubrik.md) - [Snappy Gifts](https://thirdpartyindex.com/vendors/snappy-gifts.md): Feature specific - document management - [SOPHOS](https://thirdpartyindex.com/vendors/sophos.md): Secure storage of forensic data and incident-related files - [SparkGrid Software](https://thirdpartyindex.com/vendors/sparkgrid-software.md): File storage platform; your files stay here - [Strider Technologies](https://thirdpartyindex.com/vendors/strider-technologies.md): Content Management - [Udemy](https://thirdpartyindex.com/vendors/udemy.md): Cloud-based file storage - [Wellspring](https://thirdpartyindex.com/vendors/wellspring.md): Data transfer - [wiz.io](https://thirdpartyindex.com/vendors/wiz-io.md) - [WorkRamp](https://thirdpartyindex.com/vendors/workramp.md) - [Wrike](https://thirdpartyindex.com/vendors/wrike.md) - [ZoomInfo](https://thirdpartyindex.com/vendors/zoominfo.md): Document hosting and delivery services ## Service status Incidents it reported on its own status page. - Last 90 days: 17 reported incidents (13 major or critical, 4 minor, 0 with no impact stated) - Typical time to resolve: 1 h 14 min - Status page last read: 2026-11-12 - 2026-11-04: \[Minor\] Issue with Box AI (minor) - 2026-10-20: \[Medium\] Issue with multiple Box Services (major) - 2026-10-15: \[Major\] Issue with Box Drive (major) - 2026-10-08: \[Critical\] Issues with Multiple Box Services (critical) - 2026-10-08: \[Medium\] Issue with Enterprise Event Reports (major) - 2026-10-01: \[Medium\] Issue with File Requests (major) - 2026-09-30: \[Medium\] Issue with multiple reports (major) - 2026-09-29: \[Critical\] Issues with All Files Page, Box Notes, API calls, logins and downloads (critical) ## Incidents reported by Box's subprocessors Incidents reported in the last 30 days on their own status pages by 2 vendors Box lists as subprocessors. A subprocessor list names a company, not the service an incident touched. - 2026-11-11: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Unable to start new Workspace Agent runs (critical) - 2026-11-11: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Elevated errors affecting logins, sign-ups, and ChatGPT features (minor) - 2026-11-10: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Box lists as a subprocessor, reported Elevated errors on Fable 52 and Mythos 52 (no impact stated) - 2026-11-10: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Incorrect cost data in Costs API exports (no impact stated) - 2026-11-09: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Elevated Errors On API (minor) - 2026-11-09: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Elevated ChatGPT Conversation Errors (minor) - 2026-11-08: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Elevated errors with image generation (minor) - 2026-11-08: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Box lists as a subprocessor, reported Degraded performance for Claude Fable 5.1 (minor) - 2026-11-06: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Elevated error rates with some U.S. business Mastercards (no impact stated) - 2026-11-05: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported ChatGPT Work and Dots Errors (minor) - 2026-11-04: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Elevated error rates across paid ChatGPT plans (minor) - 2026-11-03: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported File upload errors in ChatGPT (minor) - 2026-10-30: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Elevated errors with search in Dots, ChatGPT Work, and certain ChatGPT thinking experiences (minor) - 2026-10-30: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Elevated errors for GPT Image 2 API image edits (minor) - 2026-10-28: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Box lists as a subprocessor, reported Elevated errors affecting the Google Calendar connector (minor) - 2026-10-28: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Box lists as a subprocessor, reported Elevated errors affecting the Gmail connector (minor) - 2026-10-27: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Box lists as a subprocessor, reported Elevated errors for Claude Sonnet 5.5 (major) - 2026-10-27: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported 6.1 Sol Degraded Model Performance (minor) - 2026-10-27: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Box lists as a subprocessor, reported Elevated errors for Claude Sonnet 5.5 (major) - 2026-10-27: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Elevated error rates for most hosted Code Reviews and Security Reviews on private GitHub repositories (no impact stated) - 2026-10-26: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Elevated error rates for Ads POST requests (minor) - 2026-10-25: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Box lists as a subprocessor, reported Elevated errors for Claude Fable 5.1 (major) - 2026-10-25: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Box lists as a subprocessor, reported Elevated errors for Claude Sonnet 5.5 and other models (major) - 2026-10-24: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Box lists as a subprocessor, reported Elevated errors for Claude Fable 5 and Claude Fable 5.1 (major) - 2026-10-24: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Box lists as a subprocessor, reported Elevated errors for Claude Opus 5.5 (major) - 2026-10-23: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Box lists as a subprocessor, reported Elevated errors for Claude Fable 5.1, Sonnet 5.5, and Haiku 5.5 (critical) - 2026-10-23: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Degraded experience with ChatGPT app connections using CIMD (minor) - 2026-10-23: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Help Center Chat Support Degraded (no impact stated) - 2026-10-23: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Delays in customer support responses (no impact stated) - 2026-10-22: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported New Ad Accounts failing to provision admins (minor) - 2026-10-22: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Degraded Performance of Dots on Enterprise (minor) - 2026-10-22: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Box lists as a subprocessor, reported Elevated errors affecting Connectors (minor) - 2026-10-22: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Elevated ChatGPT conversation and Responses API errors (minor) - 2026-10-21: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Authentication errors for some users (major) - 2026-10-21: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Box lists as a subprocessor, reported Degraded performance for Claude Fable 5 (minor) - 2026-10-21: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Elevated error rates for gpt-5.6-luna API requests (minor) - 2026-10-21: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Elevated FedRAMP API error rates for Astra and Sol (minor) - 2026-10-21: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Degraded performance in ChatGPT, Codex, and APIs (minor) - 2026-10-19: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported File Download errors (minor) - 2026-10-15: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Widespread feature degradation (major) - 2026-10-14: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Delayed Costs data in the Compliance API (minor) - 2026-10-14: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Limited availability on gpt-image-2.5-flare and gpt-image-2.5-sunburst (minor) - 2026-10-14: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Box lists as a subprocessor, reported Degraded performance in Codex and ChatGPT Work (minor) ## Recent changes Changes to its documents and subprocessor list since monitoring began. - 2026-10-07: Changed registry listing: fedramp:F1212191840A ([evidence](https://thirdpartyindex.com/evidence/61906)) Feed: https://thirdpartyindex.com/vendors/box/changes.atom The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/box --- Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api