Box

Is Box safe?

Yes, for the job it is built for: storing and sharing work files. The iPhone app declares no tracking, the privacy notice limits what Box does with your content, and we found no fines or orders against it. What Box does not give you is end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary. It holds the keys to your files unless your company pays to hold its own. We score Box 73/100, just ahead of Google Drive (70) and Dropbox (63), and well behind Proton Drive (88).

Most people meet Box through an employer, a university or a client who sends them a link. That shapes the risks. Your company's administrators set the rules, can see account activity and decide who can open your files.

What the Box app collects

Apple's privacy label is short. Under "Data Linked to You" Box lists your name and email, contacts, the files, photos and audio you upload, support messages, search history and a user ID, all for one purpose: making the app work. Product use, crash and performance data are collected for analytics without being tied to you. There is no "Data Used to Track You" section, and nothing is declared for advertising. Compare that with Dropbox, whose label lists purchases, identifiers and usage data used to track you across other companies' apps.

Google Play's data safety section tells the same story, with one addition: app interactions are shared with other companies for analytics. Location is optional.

The privacy notice draws a clear line between two roles. For the files a company stores, Box acts as a processor on that company's behalf. Box is the controller only for a limited set of account data, such as email addresses, device and session identifiers and usage information. The notice says neither Box nor its outside AI providers will train AI models on your content without your explicit authorisation. Box's websites are a different matter. Its California notice says digital activity collected by third-party cookies may be shared with advertising partners for targeted advertising, which may count as a "sale" or "sharing" under California law, and that Box may share limited contact details with third parties for sales and marketing. That concerns Box's websites and marketing rather than your files or the app, but it is broader than the app's label suggests. You can refuse those cookies in Box's cookie settings.

How secure is Box?

Files are encrypted with AES-256 in transit and at rest, and Box supports single sign-on and multi-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary. Box also says its encryption is FIPS 140-2 certified, a US government standard for cryptographic modules.

The gap is who holds the keys. By default, Box does. Box KeySafe lets a business keep its own encryption keys, so Box cannot read its files without them, but that is a paid add-on aimed at enterprises. Individual users get no end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary at all. If you need that, encrypt sensitive files yourself before upload or use a service built around it.

In August 2026 Box opened a public bug bounty on HackerOne. It pays $150 to $5,000 per valid report, depending on severity, and its scope covers the web app, the API, Box Drive and the iPhone and Android apps. That puts Box level with Dropbox and Proton, which also pay researchers.

Box also lists FedRAMP among its compliance programmes. That authorisation covers a separate government cloud for US agencies and says nothing about the app you download, so we do not count it.

The 2019 shared link exposure

The one public incident we found was not a break-in. In March 2019 the security firm Adversis reported that Box's custom shared links, which follow a pattern like company.app.box.com/v/folder-name, could be guessed by brute force. Where companies had set those links to public, the researchers found hundreds of thousands of documents and terabytes of data, including passport photos, Social Security numbers and financial records. Box said some of its own corporate links had been "wrongly set to open or public permission" and fixed them, and pointed out that sharing is private by default.

The lesson still applies. A Box link set to "People with the link" can be opened by anyone who finds it. For anything sensitive, share with named people or with your company only.

Who should be careful

Young users, for a start. The App Store rates Box 4+, yet the privacy notice says the service is not directed at anyone under 18. Students given Box by a school are using it under the school's account, and the school's settings apply.

People using a work account for personal files should also think twice. Your administrators can see activity logs and control the account, and when you leave the job the files stay with the company.

And anyone who receives Box links should check where they lead. Box has no public feed, but a fake "file shared with you" email can point to a lookalike login page. Open Box directly rather than signing in from a link in an email.

How to use Box safely

1. Turn on multi-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary, or use your company's single sign-on with it.
2. Share sensitive folders with named people, not "People with the link", and set an expiry date if your account offers one.
3. Do not use custom shared link names for anything private; they are easier to guess.
4. Encrypt highly sensitive files on your device before uploading.
5. Keep personal files in a personal account that does not use your work email address.

How we scored it

Regulatory record (88) is Box's strongest factor: we found no fines or orders, though no large regulator has examined the app. Privacy (70) shares the lowest score with transparency and control and scams and harmful content: it reflects a label with no tracking and a clear promise on AI training, held back by cookie-based ad sharing on Box's websites. Security (73) credits AES-256 encryption, multi-factor sign-in and a paid bug bounty, but counts the missing end-to-end option, keys held by Box for most users and the 2019 link exposure.