Vendor record · box.com
What Box promises about your data.
Where Box publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
Box lists its sub-processors at box.com/legal/subprocessors. We last read it on October 15, 2026.
- What has changed
We last saw its sub-processor list change on September 7, 2026, and none to its data processing agreement before September 15, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
We couldn't quote a notice window: we watch box.com/legal/dpa for Box's data processing agreement, but the page is behind a sign-in or a bot wall, so we cannot read it from outside.
- Window
- —
- Sub-processors
- 12
- Pages
- 5
- Copies
- 39
no window we can quote yet
sub-processors named
pages we watch
dated copies of all its pages, since August 31, 2026
Box DPA
We watch box.com/legal/dpa for Box's data processing agreement, and the page is behind a sign-in or a bot wall, so we cannot read it from outside. There is no sub-processor notice window we can quote.
Box sub-processors
Box publishes a sub-processor list at box.com/legal/subprocessors; we last read it on October 15, 2026. It names 12 entries. The entries, as the list prints them: Amazon Web Services, Inc.; Anthropic PBC; Box, Inc.; Box Canada, Inc.; Box Deutschland GmbH; Box Intl. Holdings Ltd.; Google, LLC.; Microsoft Corporation; OpenAI Group PBC; SpaceXAI LLC; TaskUs, LLC.; Zendesk, Inc.. The same list is in the full table below. The latest change to the list in the public record was read on September 7, 2026.
12 named · full table
Latest public change · read 2026-09-07
+ **SpaceXAI LLC****Artificial Intelligence, machine learning United States of America
+ **Effective October 5, 2026. Note, the effective date may differ based on the specific terms of your agreement with Box.
Every public change we have recorded · Where vendors publish their lists
How long Box keeps your data
We hold no statement about data retention from Box's watched pages. The pages we watch: model card box.com/models; pricing page box.com/pricing; sub-processor list box.com/legal/subprocessors; terms of service www.box.com/legal/termsofservice; trust and security page box.com/trust. On training with customer data, Box's sub-processor list (box.com/legal/subprocessors, in the copy read October 15, 2026) says: “Subprocessors and Box’s affiliates and subsidiaries (“Box Group Companies”) may process, store or otherwise access certain customer information or personal data found in customer Content in order to support and/or improve the Box Service.”
Training on customer data
“Box shall own all rights, title and interest in and to the documentation, templates, training materials, recordings and other items (collectively the "Box Materials") Box may provide to you as part of this consulting services engagement (including any intellectual property rights therein, but excluding any of your Confidential Information and your logos and trademarks that may be included in the …”
www.box.com/legal/termsofservice · read 2026-10-12
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
Sub-processors named · 12 · 2 name an AI provider we list
Amazon Web Services, Inc.
Analytics, compute, database, artificial intelligence, machine learning, networ…
Anthropic PBCAI · Anthropic
Artificial Intelligence, machine learning United States of America
Box, Inc.
United States of America
Box Canada, Inc.
Canada
Box Deutschland GmbH
Germany
Box Intl. Holdings Ltd.
United Kingdom
Google, LLC.
Analytics, compute, database, artificial intelligence, machine learning, networ…
Microsoft Corporation
Analytics, compute, database, artificial intelligence, machine learning, networ…
OpenAI Group PBCAI · OpenAI
Artificial intelligence, machine learning United States of America
SpaceXAI LLC
Artificial Intelligence, machine learning United States of America
TaskUs, LLC.
Billing, technical, and customer support
Philippines
Zendesk, Inc.
User relationship management, customer and user support United States of America
Certifications the trust page names · FedRAMP · IRAP · ISO 27001 · ISO 27017 · ISO 27018 · ISO 27701 · PCI DSS · SOC 1 · SOC 2 Type II · SOC 3
Laws the trust page names · GDPR · HIPAA
Data location · United States
“(b) the applicable Service is provided from the United States and that for Box Zones, while the Content will be stored and may be partially processed in the Location(s), some processing and metadata storage and processing may continue to be provided from the United States;”
www.box.com/legal/termsofservice · read 2026-10-12
Retirements announced · every vendor's retirements
undated
Retired models
undated
The following models are retired and no longer available in Box AI.
The pages' own stamps: Effective 2026-10-05 · Effective date 2026-08-17 · Last modified 2026-10-15 · Last Updated 2026-09-04 · Version 2017-08-01
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
Where we get nothing
What Box does not publish where we can read it
Of the 5 public pages we watch for Box, these give us nothing right now.
Changelog
the page is behind a sign-in or a bot wall, so we cannot read it from outside
box.com/changelogData processing agreement
the page is behind a sign-in or a bot wall, so we cannot read it from outside
box.com/legal/dpaPrivacy policy
the page is behind a sign-in or a bot wall, so we cannot read it from outside
box.com/privacyPrivacy policy
the page is behind a sign-in or a bot wall, so we cannot read it from outside
www.box.com/privacyineuropeBefore you conclude anything
This only means we couldn’t read it on a public page. Box may share it in its agreement, a trust portal, or with any customer who asks.
So treat it as a question to ask them: “Can you send your sub-processor list, and tell us when it changes?”
What this page doesn’t tell you
No score.
Nothing here rates Box. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at Box? With an email at box.com you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is Box in your product? Hear the morning we read a change.
You get the lines that moved, in Box’s own words, and the date any window closes. No card. Nothing to cancel.