Does Box offer EU data residency?
Box, Inc. · Content Management · official site ↗
EU residency on higher tiersEU-US DPF + SCCsDPA available
Where does Box store EU data — and who can touch it?
Box offers EU data residency only on higher plan tiers, and relies on the EU-US Data Privacy Framework plus SCCs for transfers.
Box offers EU data residency through Box Zones — an enterprise add-on requiring a Business Plus or higher plan — backed by EU-US DPF certification, approved Binding Corporate Rules and SCCs, with a self-serve DPA.
EU data residency
Can you keep data in the EU?
Box Zones lets admins pin storage to a region including Europe (e.g. France). It is a paid add-on that requires a Business Plus plan or higher, the Zones add-on count must match the core licence count, and it is not available during trials — so EU residency is enterprise/add-on gated.
Transfer mechanism
Box maintains EU-US, UK and Swiss DPF certifications and incorporates the updated EU SCCs (2021) and UK SCCs into its DPA; it also holds approved Processor and Controller Binding Corporate Rules for the EU and UK.
Sub-processors
Who else processes your data? · 8 listed
Box publishes a sub-processor list (~8 primary entities: AWS, Google, Microsoft, IBM, plus AI providers OpenAI and Anthropic that apply only when Box AI is enabled, and support vendors). Box offers an opt-in subscription for change notices; AI-model sub-processors apply only to customers who enable Box AI. current sub-processor list ↗
Data Processing Agreement (DPA)
Does Box sign a DPA?
Box offers a customer-signable DPA (with SCCs included) via its privacy-in-Europe flow; it has long positioned this as a self-serve, electronically signable agreement for current Box customers. Confirm the current signing flow for your agreement. DPA ↗
What the trust-badge pages don't tell you
Box's transfer story is unusually strong (DPF + approved BCRs + SCCs), but EU data-at-rest residency is a separate paid Box Zones add-on gated to Business Plus and above — don't assume the BCRs imply EU hosting.
$249/moto monitor up to 25 vendors' DPA & residency
≈ $3,000/yr, incl. cited bulk export
≈ $3,000/yr, incl. cited bulk export
Monitor your whole vendor list for DPA & residency changes
The free lookup answers one vendor at a time. Teams running EU vendor intake track dozens and need to know the moment a sub-processor, residency region or DPA term changes. Leave your work email and we'll set up monitoring + a cited export for your list.
Get notified when this changes
Compliance isn't one-and-done. Leave your email and we'll alert you when any vendor's BAA or HIPAA status we cover changes.
Frequently asked questions
Does Box offer EU data residency?
Only on higher tiers. Box Zones lets admins pin storage to a region including Europe (e.g. France). It is a paid add-on that requires a Business Plus plan or higher, the Zones add-on count must match the core licence count, and it is not available during trials — so EU residency is enterprise/add-on gated.
Where does Box send my data, and does it rely on SCCs?
Box maintains EU-US, UK and Swiss DPF certifications and incorporates the updated EU SCCs (2021) and UK SCCs into its DPA; it also holds approved Processor and Controller Binding Corporate Rules for the EU and UK.
Who are Box's sub-processors?
Box publishes a sub-processor list (~8 primary entities: AWS, Google, Microsoft, IBM, plus AI providers OpenAI and Anthropic that apply only when Box AI is enabled, and support vendors). Box offers an opt-in subscription for change notices; AI-model sub-processors apply only to customers who enable Box AI. See the current list at https://www.box.com/legal/subprocessors.
Does Box sign a GDPR Data Processing Agreement (DPA)?
Yes — Box offers a customer-signable DPA (with SCCs included) via its privacy-in-Europe flow; it has long positioned this as a self-serve, electronically signable agreement for current Box customers. Confirm the current signing flow for your agreement.
Is Box GDPR compliant?
Box can be used in a GDPR-compliant way, but compliance depends on your configuration, not just the vendor: Box offers EU data residency through Box Zones — an enterprise add-on requiring a Business Plus or higher plan — backed by EU-US DPF certification, approved Binding Corporate Rules and SCCs, with a self-serve DPA. You are the controller — confirm the current DPA, residency and sub-processor terms with Box, Inc. and run a transfer impact assessment before processing EU personal data. This is not legal advice.
Sources
https://www.box.com/zones
https://www.box.com/privacyineurope
https://www.box.com/legal/subprocessors
This page is cited public information, not legal or compliance advice. Whether Box can lawfully process your EU personal data depends on your plan, configured region, contract and a transfer impact assessment you control. Always confirm current terms with Box, Inc. before sending EU personal data.