Does Box have a GDPR Data Processing Agreement?

Yes — a Data Processing Agreement is available at https://www.box.com/legal/privacypolicy.

Is Box ISO 27001 certified?

Yes — ISO 27001 is listed among Box's certifications.

EU Compliance Profile

Box

HQ: US

Sovereignty score

out of 100

Last verified: 19 May 2026

Track this vendor

Data Processing Agreement

Data Processing Agreement availableView DPA

Sub-processors

Amazon Web ServicesGoogle Cloud

Certifications

ISO 27001SOC 2 Type IIISO 27018

Looking for EU-hosted alternatives?

Explore vendors with verified EU data residency to reduce Cloud Act exposure and simplify GDPR compliance.

Browse EU-resident vendors →

Missing a vendor from your stack?

Request a compliance page and we'll research and add it.

Sub-processor Changelog

No sub-processor changes recorded yet.

Embed this vendor cardFree

Add Box's EU compliance card to your own site or internal wiki. Updates automatically when data changes.

<iframe
  src="https://eurocomply.app/embed/vendor-card?slug=box"
  width="320" height="160"
  frameborder="0" scrolling="no"
  title="Box EU Compliance Card"
  style="border:none;border-radius:8px">
</iframe>

Track Box

Monitor Box for DPA updates, sub-processor changes, and renewal deadlines. Get notified when something material changes — before it becomes a compliance issue.

Start tracking for free