# Box privacy rating

Cloud content management and file sharing service for businesses and individuals, with desktop, mobile and web apps. Files are encrypted at rest with keys Box holds, not end-to-end.

## Summary

Box scores 34 out of 100 (grade F) on the encrypted cloud storage criteria. It meets 2 of 8 criteria: no ads or data sales and TLS configuration. It partly meets independent audit and security headers. It does not meet open source, no trackers or telemetry, transparency report and tells users about requests. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.

- Website: https://www.box.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web, Windows, macOS, Android, iOS
- Home page trackers: TrustArc (not scored)
- Category: [Encrypted cloud storage](https://privacyratings.com/cloud-storage/)
- Grade: F (34/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The Android app includes Amplitude, Google Firebase Analytics, Crashlytics and Pendo. | https://reports.exodus-privacy.eu.org/en/reports/com.box.android/latest/ |
| No ads or data sales | Yes | Funded by paid plans, with no ads in the service. Box states it does not share personal information or content with third parties without permission. | https://www.box.com/legal/privacypolicy |
| Independent audit | Partial | Box has SOC 1, SOC 2 and SOC 3 audits and ISO certifications. The ISO certificates are public, but the SOC reports are only shared under NDA. | https://www.box.com/trust |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=app.box.com&hideResults=on |
| Security headers | Partial | Grade B (70/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=app.box.com |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/cloud-storage/box/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/cloud-storage/box.md