Box
Content cloud for secure file storage, sharing, e-signature and retention, aimed at regulated industries.
Certifications & Accreditations
| Certification | Certifying Body | Scope | Achieved | Expiry | Status |
|---|---|---|---|---|---|
| ISO/IEC 27001:2022 | Accredited third-party certification body | Box Content Cloud and supporting ISMS | — | — | Current |
| ISO 27017, ISO 27018 and ISO 27701 | Accredited third-party certification body | Cloud security, PII protection and privacy information management for Box | — | — | Current |
| SOC 1, SOC 2 and SOC 3 Type II | Independent third-party auditor | Box services. SOC 3 published publicly; SOC 1 and SOC 2 available under NDA | — | — | Current |
| FedRAMP Moderate | US federal authorising body | Box for Government | — | — | Current |
Compliance Frameworks
ISO/IEC 27001:2022
Full
SOC 2 Type 2
Full
GDPR 2016/679
Full
Processor under its DPA; Box Zones offers EU and UK data residency
HIPAA Security
Partial
HIPAA BAA available on eligible Box plans
PCI DSS v4.0
Partial
PCI DSS support available for in-scope Box configurations
Copyright © 2026 SnapGRC