Dropbox
Certifications and attestations: SOC 2 Type IISOC 3ISO/IEC 27001ISO/IEC 27018PCI DSS
Says it complies with: HIPAA, GDPR, CCPA/CPRA, Data Privacy Framework
As listed on Dropbox's trust center (evidence) ; reports themselves are usually shared on request.
Transparency
Breakdown
| Subprocessor list | 30 / 30 | |
| Processing locations | 8 / 8 | |
| Purposes | 7 / 7 | |
| Data processing addendum | not found | 0 / 12 |
| Trust center | 8 / 8 | |
| Privacy policy | 6 / 6 | |
| security.txt | not found | 0 / 6 |
| Security page | 5 / 5 | |
| Status page | 5 / 5 | |
| Vulnerability disclosure | not found | 0 / 5 |
| Pages still reachable | 8 / 8 | |
| Total | 77 / 100 |
Only documents we can retrieve count: a page behind a login or a broken link scores nothing.
Badge
For Dropbox's own site; it updates with the rating.
<a href="https://thirdpartyindex.com/vendors/dropbox"><img src="https://thirdpartyindex.com/badge/dropbox.svg" alt="Dropbox transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/dropbox)Documents
| Document | Verified | Changed | Evidence |
|---|---|---|---|
| Trust center safebase | snapshot | ||
| Subprocessor list | snapshot | ||
| Privacy policy | snapshot | ||
| Terms | snapshot | ||
| Security page | snapshot | ||
| Status page statuspage | snapshot |
Subprocessors
11 third parties, 1 affiliate. CSV · Atom
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Amazon Web Services, Inc. | Infrastructure, Customer Support, Search, Large Language Model Processing (e.g. summarization, enhanced search) | United States | |
| Google LLC | Customer Support, Large Language Model Processing (e.g. summarization, enhanced search) | United States | |
| Groq, Inc. | Large Language Model Processing (e.g. summarization, enhanced search) | United States | |
| Microsoft Corporation | Large Language Model Processing (e.g. summarization, enhanced search) | United States | |
| OpenAI | Large Language Model Processing (e.g. video captioning, summarization, enhanced search) | United States | |
| Oracle America, Inc. | Billing and Customer Support | United States | |
| Parallel Web Systems Inc. | Large Language Model Processing (e.g. summarization, enhanced search) | United States | |
| Salesforce.com, Inc. | Customer Support | United States | |
| Teleperformance A.E. | Customer Support | Greece | |
| Zendesk, Inc. | Customer Support | United States | |
| Zoom Video Communications, Inc. | Customer Support | United States |
Listed as a subprocessor by (11)
Purposes as each company states them.
Ahrefs ahrefs.com Cloud storage
Fastmail fastmail.com Support services and Business operations
Freshworks freshworks.com Share the quote for signature, the quote is sent for signature through DropboxSign. Only Opt out facility for the customers is not to send for signatory.
HubSpot hubspot.com E-Signature Functionality
Klaviyo klaviyo.com File Hosting for Professional Services and Enablement
Massed Compute massedcompute.com File storage and collaboration
Maxio maxio.com
Meltwater meltwater.com Facilitating e-signatures
Telnyx telnyx.com Cloud storage for file sharing and collaboration; personal data processed could include names, email addresses, and any data contained in files stored on Dropbox.
Together AI together.ai Contract administration and signature tool and file sharing
Verda verda.com Document management; Privacy policy: https://www.dropbox.com/privacy
Security record
What public security catalogs list for Dropbox, in their words.
Data breaches
- Dropbox 68,648,009 accounts Email addresses; Passwords
In mid-2012, Dropbox suffered a data breach which exposed the stored credentials of tens of millions of their customers. In August 2016, they forced password resets for customers they believed may be at risk. A large volume of data totalling over 68 million records was subsequently traded online and included email addresses and salted hashes of passwords (half of them SHA1, half of them bcrypt).
Have I Been Pwned · evidence
Breach data from Have I Been Pwned (CC BY 4.0), which calls every entry a breach, including data scraped from public pages.
Service status
5 incidents in the last 90 days (1 major or critical, 4 minor, 0 with no stated impact) · typically resolved in 1 h 54 min · longest major: 59 min
| Began | Incident | Impact | Lasted |
|---|---|---|---|
| Some customers are unable to access certain website routes and features. | major | 59 min evidence | |
| Customer support via telephone may be unavailable for some users | minor | 6 h 49 min evidence | |
| Some Dropbox Protect features are not working correctly | minor | 11 h 46 min evidence | |
| Dropbox is not working as expected for some users | minor | 1 h 54 min evidence | |
| Dropbox is not working as expected for some users | minor | 24 min evidence | |
| Shared content downloads are degraded | minor | 3 days evidence | |
| Opening a video or audio file might not be working for users | minor | 2 h 26 min evidence |
As Dropbox's status page reports its own incidents (scheduled maintenance left out), read every few hours since .
Changes
None since tracking began.