Box
file-storage · box.com · last read 2026-10-07
Identity
No identity observation recorded yet.
Data location
No data-location observation recorded yet.
Subprocessor chain
Assurance
No certification claims transcribed yet.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Box, Inc. | Active | non-HR data | 2027-09-03 | 2026-10-07 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Box, Inc. | Active | non-HR data | 2027-09-03 | 2026-10-07 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Box, Inc. | Active | non-HR data | 2027-09-03 | 2026-10-07 |
| FedRAMP Marketplace (US) | Box Enterprise Cloud Content Collaboration Platform · Box Inc. | FedRAMP Authorized | High | — | 2026-10-07 |
- ACN qualified cloud (Italy): checked 2026-10-07, no entry under Box
- Data Privacy Framework List (US): checked 2026-10-07, 3 entries under Box
- FedRAMP Marketplace (US): checked 2026-10-07, 1 entry under Box
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Refused | partial | 403 | 2026-10-05 |
| residency | Refused | partial | 403 | 2026-10-05 |
| subprocessors | Refused | partial | 403 | 2026-10-05 |
History
Nothing has moved since we started watching this vendor on 2026-10-05. Changes appear here only after a human has reviewed them.