eucsoft

Dropbox

file-storage · dropbox.com · last read 2026-10-07

Identity

No identity observation recorded yet.

Data location

RegionEU data locationMinimum planSourceObserved
EUPaid upgradeDropbox Standardhelp.dropbox.com2026-10-05

EU: Storage servers in the European Union are available for eligible Dropbox users. To be eligible to change where team file data is stored, the team must be on Dropbox Standard, Advanced, Business, Business Plus, or Enterprise, have at least 10 licenses, and be on an annual billing cycle. Each request is reviewed individually.

Subprocessor chain

11 third parties · 1 of the vendor's own group companies · 11 with a country outside the EEA · all read 2026-10-05

SubprocessorCountryPurpose
Amazon Web Services, Inc.USInfrastructure, Customer Support, Search, Large Language Model Processing (e.g. summarization, enhanced search)
Google LLCUSCustomer Support, Large Language Model Processing (e.g. summarization, enhanced search)
Groq, Inc.USLarge Language Model Processing (e.g. summarization, enhanced search)
Microsoft CorporationUSLarge Language Model Processing (e.g. summarization, enhanced search)
OpenAIUSLarge Language Model Processing (e.g. video captioning, summarization, enhanced search)
Oracle America, Inc.USBilling and Customer Support
Parallel Web Systems Inc.USLarge Language Model Processing (e.g. summarization, enhanced search)
Salesforce.com, Inc.USCustomer Support
Teleperformance A.E.GRCustomer Support
Zendesk, Inc.USCustomer Support
Zoom Video Communications, Inc.USCustomer Support
Dropbox's own group companies listed as subprocessors (1)
CompanyCountryPurpose
Dropbox, Inc.USAffiliate

The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.

Assurance

SchemeStatusScopeSourceObserved
CSA STAR Level 2 Certification · CSACertificate publishedDropbox Standard, Advanced, Enterprise and Education; assessed by EY CertifyPointdropbox.com2026-10-05
EU-U.S. Data Privacy Framework · DPFCertificate publishedcollection, use, and retention of personal data transferred from the European Union, the United Kingdom, and Switzerland to the United Statesdropbox.com2026-10-05
Swiss-U.S. Data Privacy Framework · DPFCertificate publishedcollection, use, and retention of personal data transferred from the European Union, the United Kingdom, and Switzerland to the United Statesdropbox.com2026-10-05
UK Extension to the EU-U.S. Data Privacy Framework · DPFCertificate publishedcollection, use, and retention of personal data transferred from the European Union, the United Kingdom, and Switzerland to the United Statesdropbox.com2026-10-05
EU Cloud Code of Conduct · EUCloudCoCCertificate publishedDropbox’s Standard, Advanced, Enterprise, and Education plans for teams; Compliance Mark of “Level 2” (Verification ID: 2022LVL02SCOPE3114)dropbox.com2026-10-05
GDPRClaimed—dropbox.com2026-10-05
HIPAA/HITECH · HITECHAvailable on requestSOC 2 examination evaluating controls for the HIPAA/HITECH Security, Privacy, and Breach Notification rules; Dropbox Standard, Advanced, Enterprise and Educationdropbox.com2026-10-05
ISMAPCertificate published—dropbox.com2026-10-05
ISO 22301 · ISO22301Certificate publishedDropbox Standard, Advanced, Enterprise and Educationdropbox.com2026-10-05
ISO 27001 · ISO27001Certificate publishedDropbox Standard, Advanced, Enterprise and Educationdropbox.com2026-10-05
ISO 27017 · ISO27017Certificate publishedDropbox Standard, Advanced, Enterprise and Educationdropbox.com2026-10-05
ISO 27018 · ISO27018Certificate publishedDropbox Standard, Advanced, Enterprise and Educationdropbox.com2026-10-05
ISO 27701 · ISO27701Certificate publishedDropbox Standard, Advanced, Enterprise and Education; certified as a PII Processordropbox.com2026-10-05
FERPAClaimedTeam customers; vendor obligationsdropbox.com2026-10-05
Level 2 AttestationCertificate publishedDropbox Standard, Advanced, Enterprise and Education; assessed by Ernst & Young LLPdropbox.com2026-10-05
NIST SP 800-171 R2 Attestation ReportAvailable on requestDropbox Standard, Advanced, Enterprise and Education; integrated into the SOC 2 report. Dropbox Paper is not included in the scope.dropbox.com2026-10-05
PCI DSS · PCIDSSAvailable on requestmerchant statusdropbox.com2026-10-05
SOC 1 / SSAE 18 / ISAE 3402 · SOC1Available on requestThe SOC 1 report covers Dropbox Standard, Advanced, Enterprise and Education.dropbox.com2026-10-05
SOC 1 / SSAE 18 / ISAE 3402 (formerly SSAE 16 or SAS 70) · SOC1Claimed—dropbox.com2026-10-05
SOC 2 · SOC2Available on requestDropbox Standard, Advanced, Enterprise and Education; all five Trust Service Criteriadropbox.com2026-10-05
SOC 3 · SOC3Certificate publishedDropbox Standard, Advanced, Enterprise and Education; Security, Availability, Processing Integrity, Confidentiality, and Privacydropbox.com2026-10-05

Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.

Official registers

RegisterOffering, as the register names itStatusLevelValid untilObserved
Data Privacy Framework List (US)EU-U.S. Data Privacy Framework · Dropbox, Inc.ActiveHR data, non-HR data2027-05-072026-10-07
Data Privacy Framework List (US)Swiss-U.S. Data Privacy Framework · Dropbox, Inc.ActiveHR data, non-HR data2027-05-072026-10-07
Data Privacy Framework List (US)UK Extension to the EU-U.S. DPF · Dropbox, Inc.ActiveHR data, non-HR data2027-05-072026-10-07

What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.

Support window

Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.

Documents

What we read, how it was disclosed, and when.
DocumentDisclosureTranscriptionHTTPObserved
certificationsPublicfull2002026-10-05
residencyPublicfull2002026-10-05
subprocessorsJavaScript onlyfull2002026-10-05

History

Nothing has moved since we started watching this vendor on 2026-10-05. Changes appear here only after a human has reviewed them.