VendorsBusiness apps9h ago

BoxCompliance, certifications and attestations

Certifications held, by family9 held

Status: Public
Headquarters: Redwood City, United States
Founded: 2009
Website: box.com

Trust center Company profile

Certifications held

Backed by a registry

Pieces of evidence

Sep 24, 2026

Last captured

Across fru.devEarningsBOX earnings calendar

SOC reports

ISO standards

AI governance

US government

Health

Payments

Privacy

Cloud security

Regional

From public trust centers and registries on the date shown. Confirm scope with the vendor. Logos via logo.dev; trademarks belong to their owners.

History

Added or renewedUpgradedIn process or ReadyLapsed or removed

Evidence

Every source, what it says and when it was read.

FedRAMP1 source

Held · HighFedRAMP Marketplace

Box Enterprise Cloud Content Collaboration Platform

FedRAMP Authorized, High impact; authorized 2025-03-25 (Agency); assessor Schellman Compliance, LLC; 50 agency authorizations

Captured Sep 23, 2026Since Mar 25, 2025Open source

HIPAA (BAA)1 source

HeldVendor compliance page

...Cloud covers all your data compliance and regulatory needs — including GDPR, GxP Validation, HIPAA, ITAR, PCI DSS, ISMAP, FedRAMP, and more. Box Zones allows organizations to address data residency obligations...

Captured Sep 24, 2026Open source

PCI DSS1 source

HeldVendor compliance page

...your data compliance and regulatory needs — including GDPR, GxP Validation, HIPAA, ITAR, PCI DSS, ISMAP, FedRAMP, and more. Box Zones allows organizations to address data residency obligations across multiple...

Captured Sep 24, 2026Open source

Data Privacy Framework1 source

HeldData Privacy Framework List

EU-US, UK extension, Swiss-US; non-HR data. Box, Inc.

EU-US status: Active; certified since 2016-10-05; recertification due 2027-09-03; verification: Outside Compliance Review

Captured Sep 23, 2026Since Oct 5, 2016Renewal due Sep 3, 2027Open source

CSA STAR1 source

Held · Level 1CSA STAR Registry

CAIQ

Listed as Box since 2018-01-26; Level 1 (self-assessment)

Captured Sep 23, 2026Since Jan 26, 2018Open source

ISMAP1 source

HeldVendor compliance page

...data compliance and regulatory needs — including GDPR, GxP Validation, HIPAA, ITAR, PCI DSS, ISMAP, FedRAMP, and more. Box Zones allows organizations to address data residency obligations across multiple geographies....

Captured Sep 24, 2026Open source

Compare with