Box compliance, certifications and attestations

Authorization to sell a cloud service to US federal agencies.

HighFedRAMP MarketplaceBox Enterprise Cloud Content Collaboration Platform

A security verification for US state and local government cloud buyers.

HighGovRAMP product listBox Enterprise Cloud Content Collaboration Platform (Authorized, High)

Cryptographic modules validated under FIPS 140-2 or 140-3.

FIPS 140-2Vendor page

Support for export-controlled defense data under ITAR.

HeldVendor page

Validated compliance with the card industry data security standard.

HeldVendor page

The vendor supports HIPAA-regulated health data and signs a Business Associate Agreement.

HeldVendor page

Support for regulated life-sciences workloads under GMP, GCP and GLP.

HeldVendor page

Self-certification under the EU-US Data Privacy Framework, with UK and Swiss extensions where noted.

HeldData Privacy Framework ListEU-US, UK extension, Swiss-US; non-HR data. Box, Inc.

A listing in the Cloud Security Alliance STAR Registry.

Level 1CSA STAR RegistryCAIQ

Registration on Japan's government cloud security list.

HeldVendor page