{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"box","name":"Box","domain":"box.com","category":"Cloud storage","one_liner":"Box (NYSE:BOX) is the market leader for Cloud Content Management, whose mission is to power how the world works","trust_center_url":null,"security_page_url":null,"url":"https://certreports.com/vendors/box/security","last_verified_at":"2026-09-19T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"fedramp","framework_name":"FedRAMP","state":"verified_registry","state_label":"Verified","sentence":"Listed in the FedRAMP Marketplace as of 19 Sep 2026.","kind":"authorization","status_text":"FedRAMP Authorized","issued_at":"2025-03-25","expires_at":null,"period_start":null,"period_end":null,"auditor":"Schellman Compliance, LLC","impact_level":"High","as_of":"2026-09-19","under_review":false,"source":"fedramp","url":"https://certreports.com/vendors/box/fedramp","evidence":[{"source_type":"registry","source_name":"FedRAMP Marketplace","url":"https://www.fedramp.gov/marketplace/products/F1212191840A","fetched_at":"2026-09-19 08:30:01.700532+00","content_hash":"b2bb3e031fda16f1f3201a5640ae64a639a15e4997f9d1ca43ef13a2942600e6","wayback_url":null,"quote":"Box Inc. - Box Enterprise Cloud Content Collaboration Platform: FedRAMP Authorized","confidence":1},{"source_type":"registry","source_name":"FedRAMP Marketplace","url":"https://www.fedramp.gov/marketplace/products/F1212191840A","fetched_at":"2026-09-18 22:35:17.44827+00","content_hash":"db2d03fa40cba0e5287b9cc7361e71b7c30c7ca9d51efb7b540477105fb30c7b","wayback_url":null,"quote":"Box Inc. - Box Enterprise Cloud Content Collaboration Platform: FedRAMP Authorized","confidence":1},{"source_type":"registry","source_name":"FedRAMP Marketplace","url":"https://www.fedramp.gov/marketplace/products/F1212191840A","fetched_at":"2026-09-17 15:44:39.301965+00","content_hash":"395e7ad35dd25d1c547414140161c47ec22827b7ffae3bdbbd5256c38a3b940f","wayback_url":null,"quote":"Box Inc. - Box Enterprise Cloud Content Collaboration Platform: FedRAMP Authorized","confidence":1}]},{"framework":"csa-star","framework_name":"CSA STAR","state":"verified_registry","state_label":"Verified","sentence":"Listed in the CSA STAR registry as of 17 Sep 2026.","kind":"self_assessment","status_text":"STAR Level 1 self-assessment (CAIQ), Trusted Cloud Provider","issued_at":"2018-01-26","expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"csa_star","url":"https://certreports.com/vendors/box/csa-star","evidence":[{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/box","fetched_at":"2026-09-17 15:44:42.254747+00","content_hash":"e7f124247f5399c92ba048620a83c0b6cca1f9a2f97419f32566e462a3b1bda7","wayback_url":null,"quote":"box: STAR Level 1 self-assessment (CAIQ), Trusted Cloud Provider","confidence":1}]},{"framework":"dpf","framework_name":"EU-US Data Privacy Framework","state":"verified_registry","state_label":"Verified","sentence":"Listed in the Data Privacy Framework list as of 17 Sep 2026.","kind":"listing","status_text":"Active: SW-US Certification, EU-US Certification, UK Extension Certification","issued_at":"2016-10-05","expires_at":"2027-09-03","period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"dpf","url":"https://certreports.com/vendors/box/security","evidence":[{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/5601","fetched_at":"2026-09-17 15:49:04.359528+00","content_hash":"4ef10527cbbc56b9669838e9dbb882f28eb809e359aa3a5641a08d9a8b1272be","wayback_url":null,"quote":"Box, Inc.: Active: SW-US Certification, EU-US Certification, UK Extension Certification","confidence":1}]}],"brief":{"summary":"Box is listed in the FedRAMP registry as FedRAMP Authorized, with authorization issued 25 Mar 2025 and assessed by Schellman Compliance, LLC, as of 19 Sep 2026. Box is listed in the CSA STAR registry with a STAR Level 1 self-assessment (CAIQ) and Trusted Cloud Provider status, dated 26 Jan 2018, as of 17 Sep 2026. Box is listed in the EU-US Data Privacy Framework registry with active EU-US, SW-US, and UK Extension Certifications, as of 17 Sep 2026. Box's EU-US Data Privacy Framework certification was issued 5 Oct 2016 and is listed as expiring 3 Sep 2027, as of 17 Sep 2026. No public evidence found for a SOC 2 report for Box as of 17 Sep 2026.","bullets":["FedRAMP: Authorized, issued 25 Mar 2025, assessed by Schellman Compliance, LLC (as of 19 Sep 2026)","CSA STAR: Level 1 self-assessment (CAIQ), Trusted Cloud Provider, dated 26 Jan 2018 (as of 17 Sep 2026)","EU-US Data Privacy Framework: active listing, issued 5 Oct 2016, expires 3 Sep 2027 (as of 17 Sep 2026)"],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-09-19 10:50:02.693025+00"},"legal_docs":[],"subprocessors":[],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-09-20T06:30:06.399Z"}