Vendor profile

Box: where is customer data stored and processed?

Box is a US company, and customer content is stored and processed in different countries depending on region. For customers outside the EU/EEA, storage, compute and data processing are documented in the USA, unless the customer chooses other regions. For the Box Zones Germany/Ireland zone, primary storage in Germany is stated but not confirmed, and secondary backup is to be moved to the Netherlands without a clear completion date. Customers can choose region, and Box Zones offers storage in ten regions, but the European regions are not named. Support from the Philippines (TaskUs) and Zendesk in the USA, AI features from OpenAI in the USA, and analytics from AWS, Google, IBM and Microsoft in the USA are stated. The data processing agreement has not been read, as it sits behind a login.

Checked 13 October 2026 · based on the vendor's own public documents

Where data is stored and processed

Only outside the EU/EEA, with no European alternative stated: Support, AI features, Analytics and metadata.

Ownership and agreements

Sub-processors (9)

Sources

• Box Zones secondary location update (Sep 2025)
• Expanding Box Zones offering to support in-country data storage in France
• Box Subprocessors