Loading…
Links last opened 1 November 2026. Record confirmed by a person on 28 October 2026. 5 recorded changes, listed below.
Box contracts through Box.com (UK) Ltd., registered in United Kingdom. Transfers of personal data out of the EEA are covered by EU-US Data Privacy Framework (DPF). Its trust center is published at https://www.box.com/trust. Its sub-processor list is published by Box itself; the link is below. We open those pages every day — last on 1 November 2026 — and a person last went through this record on 28 October 2026.
A US certification scheme covered by an EU adequacy decision. Transfers to a certified US organisation need no further mechanism for the certified scope.
A ready row. Replace the purpose with what your client actually uses Box for.
| Subprocessor | Legal entity | Country | Purpose | Transfer | DPA |
|---|---|---|---|---|---|
| Box | Box.com (UK) Ltd. | GB | Workplace tools | DPF | — |
Changes we noticed on Box's own pages, each with the page we saw it on. The vendor does not publish this, and neither does anyone else.
1 November 2026
Box added eight subprocessors: Amazon Web Services, TaskUs, Zendesk, OpenAI, Anthropic PBC, SpaceXAI LLC, and two others, with processing locations including the Philippines, United Kingdom, and Australia—jurisdictions without EU adequacy decisions. The subprocessor list now includes detailed service categories, locations, and conditional notes for each processor, along with provisions for customer-enabled AI subprocessors that may be added upon customer request.
31 October 2026
Cloudflare was added as a sub-processor for performance and security services. The previous subprocessor list text was removed and replaced with a security verification page.
8 October 2026
Box added seven new subprocessors including Amazon Web Services, TaskUs, Zendesk, OpenAI, and Anthropic, with processing locations in the United States and Philippines. Several of these locations (Philippines, UK, and Australia noted in the data) are not covered by EU adequacy decisions, which may require additional safeguards for personal data transfers under GDPR.
7 October 2026
Box added Cloudflare as a subprocessor for security verification services. This addition should be documented in Box's subprocessor list and reflected in any records of processing activities.
22 September 2026
We recorded a change to the UK transfer mechanism.
Recorded from a source other than their own pages.
Enter your website: each service it loads, what it is for and links to its own DPA, in a minute or two. No sign-up.
Worked out from the registry and what we have written: the country this vendor contracts from, the guides that answer the question this page raises, and the rest of the registry.
Six of them. All workplace tools in the registry · others that transfer the same way.