Box, Inc. is a publicly traded (NYSE: BOX) enterprise cloud content management company headquartered in Redwood City, California, serving over 100,000 paying organizations through subscription agreements rather than advertising. Its Privacy Notice describes collecting account and profile details (name, email, employer, job title), usage data including the names and sizes of files uploaded or shared, log and device data, and consent-gated mobile location. Customer content is encrypted in transit (TLS 1.3) and at rest (AES-256), and Box maintains third-party-audited compliance programs including FedRAMP High, DoD SRG Impact Level 4, SOC 2 Type II, HIPAA, and ISO 27001/27018/27701. Box publishes a subprocessor list naming AWS, Google, IBM, Microsoft, TaskUs, Zendesk, and OpenAI (effective June 2025), with contractual limits on their use of customer data. Its marketing sites use first- and third-party cookies, web beacons, and tracking pixels, with a CCPA opt-out for the sale or sharing of digital activity. In 2019, researchers found 90+ organizations, including Box itself, had exposed sensitive files through customer-configured public share links; Box responded by tightening defaults and admin controls.
TRACK RECORD
1 ENFORCEMENT ACTION
[2026-03-09]
Box's FY2026 10-K describes a cybersecurity risk management program based on the NIST Cybersecurity Framework and states the company does not believe cybersecurity threats have materially affected its business to date - a self-reported statement made under SEC disclosure obligations.
Box's Privacy Notice states that Box monitors user activity and collects the names and sizes of files and folders uploaded, downloaded, or shared, along with log data (IP address, browser, ISP), device identifiers, and profile details such as name, employer, and job title; mobile location collection requires consent and can be disabled in app settings.
Box's FY2026 annual report describes a subscription business serving over 100,000 paying organizations; revenue comes from subscription agreements rather than an advertising model, so data collection is not monetized through ads.
Box encrypts customer content in transit using TLS 1.3 (falling back to TLS 1.2 for older browsers) and encrypts data at rest with AES-256, per the Box Trust Center's security FAQ.
Box's government-request Transparency Report is not published openly; the company states it is available by emailing a request, a weaker disclosure practice than peers that publish standing transparency reports.
In April 2021, Box entered an Investment Agreement with funds managed or advised by KKR Credit Advisors for a $500 million Series A convertible preferred stock investment, disclosed in an 8-K filing; KKR-affiliated funds thereby hold a significant preferred stake in the company.
Box publicly names its corporate affiliates and subsidiaries ('Box Group Companies') - including entities in Japan, the UK, France, Germany, Canada, Australia, Sweden, the Netherlands, and Poland - on its subprocessor page, making its corporate structure inspectable.
Box, Inc. is a Delaware corporation headquartered in Redwood City, California, whose Class A common stock has traded on the New York Stock Exchange under the symbol BOX since January 23, 2015, subjecting it to audited SEC annual reporting.
Box states that it directs law enforcement requests concerning enterprise accounts to the customer where possible, reviews each request for legal compliance, notifies customers unless barred by a court-issued non-disclosure order, and requires non-US government requests to proceed via MLAT or letter rogatory - framing government access as a legal obligation handled with process safeguards.
Box's Privacy Notice permits sharing personal information with vendors and service providers working on its behalf, with third-party integrations the user chooses to connect, and in business transfers or when required by law; for individual accounts whose email domain is owned or managed by an employer, the employer may be provided access to account information.
Box publishes a subprocessor list naming Amazon Web Services, Google, IBM, Microsoft, TaskUs, Zendesk, and OpenAI (effective June 6, 2025) as entities that may process customer data, and states subprocessors are contractually barred from using customer data for any purpose other than supporting the Box service.
In March 2019, security firm Adversis found more than 90 companies - including Box's own staff folders - exposing sensitive data through Box public share links that users had configured as open; the exposures stemmed from customer-side link settings rather than a breach of Box's systems, and Box said it would make sharing settings clearer and add admin controls.
Box's FY2026 10-K describes a cybersecurity risk management program based on the NIST Cybersecurity Framework and states the company does not believe cybersecurity threats have materially affected its business to date - a self-reported statement made under SEC disclosure obligations.
Box maintains an extensive third-party-audited compliance portfolio, including FedRAMP High authorization, DoD Cloud Computing SRG Impact Level 4, SOC 1 and SOC 2 Type II reports, HIPAA/HITECH compliance, and ISO 27001/27017/27018/27701 certifications, per its Trust Center.
Box's Cookie Notice discloses use of first-party and third-party cookies plus web beacons, tracking pixels, and scripts across its websites and applications, with third-party cookies used for marketing campaigns; it offers California residents an opt-out from the 'sale or sharing' of digital activity and notes that opting out only prevents targeted ads.
Box's Privacy Notice acknowledges personalized and interest-based advertising involving third-party partners, directing users to DAA and NAI industry opt-out tools, and lists 'sales, marketing or advertising purposes' among the uses of monitored usage data.