Skip to main content
Box logo

Box

Verified

“A US enterprise cloud, EU-reachable only as a customer.”

Operating HQ
🇺🇸 Redwood City, California
where it's run
Legal domicile
🇺🇸 Delaware, USA
where it's incorporated
Revenue (FY2025)
$1.17B
Employees
2,810
Listing
NYSE: BOX
Founded
2005
15/100
Sovereign: Not
Control ↑
14
Data →
16

15 = midpoint of Control 14 & Data 16

ConfidenceHigh (88%)

Sovereignty Quadrant

Control ↑ who owns & governs the company  ·  Data → where your data lives. Every dot is a company — click to open it.

Where your data lives → Who controls the company → 7 companies · fully non-EU (0/0) TikTok — Data 32, Control 24 Google — Data 16, Control 14 Youtube — Data 14, Control 16 Ionos — Data 90, Control 90 Disneyplus — Data 16, Control 12 Telegram — Data 34, Control 14 Carrefour — Data 100, Control 32 Corriere — Data 100, Control 100 Microsoft — Data 26, Control 14 Amazon — Data 14, Control 10 Amazon — Data 66, Control 0 Reddit — Data 14, Control 10 Netflix — Data 24, Control 20 LinkedIn — Data 14, Control 16 Reuters — Data 26, Control 0 Pinterest — Data 12, Control 12 Discord — Data 16, Control 20 AliExpress — Data 18, Control 12 Twitch — Data 18, Control 16 Samsung — Data 62, Control 4 Canva — Data 24, Control 20 Spotify — Data 30, Control 68 Apple — Data 16, Control 16 GitHub — Data 16, Control 10 Uber — Data 16, Control 16 Salesforce — Data 20, Control 14 Deepl — Data 70, Control 78 Airbnb — Data 18, Control 18 Shopify — Data 18, Control 18 Mastercard — Data 36, Control 16 Dropbox — Data 14, Control 10 HubSpot — Data 24, Control 10 Notion — Data 22, Control 16 Stripe — Data 30, Control 30 Zalando — Data 52, Control 88 Figma — Data 18, Control 10 SAP SE — Data 68, Control 78 Atlassian — Data 18, Control 18 Proton — Data 72, Control 54 Miro — Data 100, Control 44 Klarna — Data 44, Control 42 Ecosia — Data 60, Control 92 Zoom — Data 20, Control 14 Adyen — Data 84, Control 84 GitLab — Data 26, Control 14 Slack — Data 14, Control 20 Hetzner — Data 84, Control 96 Deezer — Data 62, Control 66 Typeform — Data 100, Control 52 OVHcloud — Data 82, Control 94 Tutanota — Data 100, Control 100 BlaBlaCar — Data 54, Control 76 Qwant — Data 56, Control 88 Bitwarden — Data 28, Control 20 Contentful — Data 34, Control 48 Personio — Data 34, Control 58 Ikea — Data 34, Control 100 Whatsapp — Data 14, Control 12 Instagram — Data 28, Control 22 X — Data 14, Control 16 Avast — Data 60, Control 0 Paypal — Data 24, Control 32 Kaspersky — Data 56, Control 0 Dailymotion — Data 100, Control 74 Snapchat — Data 12, Control 14 Infomaniak — Data 74, Control 58 Nextcloud — Data 88, Control 94 Tresorit — Data 52, Control 62 16 14 Box
Box — verified peers — automated estimate (0–50 pillars, normalized)

Every number below traces to 13 sourced facts across 4 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 88% — they lower confidence, never the score.

Control ↑

Who legally and economically controls the company

14/100
7 facts · 3 sources · mixed confidence
Legal & Jurisdiction
12

Incorporated in Delaware, principal offices in Redwood City, California; the filing entity is Box, Inc., a US public company. EU law (GDPR) reaches Box only through its EU subsidiaries and data-processing obligations as a service provider, not through any EU-domiciled controlling entity. US courts and US law govern the parent.

Why 12? 3 sourced facts · click to expand
Delaware, USA

State of incorporation

Box FY2025 10-K (SEC EDGAR) · as of 2025-01-31

900 Jefferson Ave, Redwood City, California 94063

Principal executive offices

Box FY2025 10-K (SEC EDGAR) · as of 2025-01-31

EEA localization rules could impact US cloud providers incl. Box

EU/EEA data-localization laws are flagged as a regulatory risk to Box as a US cloud provider

Box FY2025 10-K (SEC EDGAR) · as of 2025-01-31

Control & Ownership
15

Listed on the NYSE as Class A common stock (BOX); the former Class B super-voting shares were retired in 2018, so there is no founder super-voting block. Voting and economics are dominated by US institutions (BlackRock, Vanguard, State Street). US private-equity firm KKR holds Series A Convertible Preferred Stock with rights preferential to common holders (~11% as-converted at the 2021 issuance). No meaningful EU voting or economic majority.

Why 15? 4 sourced facts · click to expand
NYSE: BOX, Class A common ($0.0001 par)

Listing venue and share class

Box FY2025 10-K (SEC EDGAR) · as of 2025-01-31

143,789,202

Class A shares outstanding

Box FY2025 10-K (SEC EDGAR) · as of 2025-04 (cover date)

$500M, ~11% as-converted at issuance (2021)

KKR Series A Convertible Preferred Stock investment

Box 8-K press release (SEC EDGAR) · as of 2021-04-08

BlackRock, Vanguard, State Street

Largest holders are US institutional asset managers

Fintel institutional ownership (BOX) · as of 2026-06

Data →

Where your data lives and who can reach it

16/100
6 facts · 2 sources · mixed confidence
Data & Infrastructure
18

Box completed migrating off its own collocated data centers onto third-party public cloud by Jan 31, 2024; customer data is replicated on third-party storage platforms 'located inside and outside of the United States.' EU data residency exists only via Box Zones, a paid add-on (Business Plus and above) on hyperscaler infrastructure with in-region locations in Germany, Ireland and France. Default deployments and the parent's US jurisdiction leave material CLOUD Act / FISA 702 exposure; no Box-owned EU infrastructure.

Why 18? 3 sourced facts · click to expand
Public cloud migration complete by FY ended Jan 31, 2024

Completed migration to public cloud from collocated data centers

Box FY2025 10-K (SEC EDGAR) · as of 2025-01-31

Third-party storage, inside and outside the US

Customer data replicated on third-party storage inside and outside the US

Box FY2025 10-K (SEC EDGAR) · as of 2025-01-31

In-region storage: Germany, Ireland, France (Paris/Marseille)

EU data residency offered as Box Zones add-on (Business Plus+)

Box Blog (Box Zones France) · as of 2026-06

Operations & People
14

Corporate headquarters is in the San Francisco Bay Area; the company employed 2,810 people as of Jan 31, 2025 with a US-centered leadership team (co-founder/CEO Aaron Levie). It reports in US dollars and treats EU/international operations as foreign subsidiaries subject to FX translation. EU presence exists for sales and data-residency but operations and decision-making are US-centered.

Why 14? 3 sourced facts · click to expand
San Francisco Bay Area (Redwood City, CA)

Corporate headquarters

Box FY2025 10-K (SEC EDGAR) · as of 2025-01-31

2,810 (as of Jan 31, 2025)

Total employees

Box FY2025 10-K (SEC EDGAR) · as of 2025-01-31

US dollars; EU units are foreign subsidiaries

Reporting currency

Box FY2025 10-K (SEC EDGAR) · as of 2025-01-31

Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →

What we don’t know 3 open questions — they lower confidence, never the score
  • ?

    Which specific public cloud provider(s) now host Box's content after the data-center exit (AWS, Azure, IBM Cloud, Google)?

    Determines the exact foreign-law exposure and whether any EU-sovereign cloud option exists; the 10-K only says 'public cloud'.

  • ?

    What share of EU customers actually enable Box Zones EU data residency versus relying on default (US-replicated) storage?

    If most run defaults, real-world EU data exposure is higher than the add-on availability suggests.

  • ?

    KKR's current as-converted ownership and board influence in 2026 after any conversions or repurchases.

    Affects the precise control picture; the verified ~11% figure is from the 2021 issuance.

EU Cloud Sovereignty Framework lens

SEAL was designed to assess cloud service providers; this is an analogous sovereignty mapping for Box, not a formal SEAL certification.

Strategic

US-domiciled, NYSE-listed, US-PE-backed; strategic direction set in the US, not the EU.

weak

Legal & jurisdictional

Delaware incorporation, US parent; subject to US CLOUD Act and FISA 702. EU law reaches Box only as a processor.

weak

Data & AI

EU data residency available via Box Zones add-on (DE/IE/FR); Box AI is model-neutral (Azure OpenAI, Vertex, Claude, Bedrock). Default storage is US-replicated.

moderate

Operational

HQ and leadership in California; 2,810 staff US-centered; reports in USD with EU units as foreign subsidiaries.

weak

Supply chain

Core hosting depends on third-party US public cloud after exiting own data centers; AI via US model vendors.

weak

Technological

Mature, GDPR-aware enterprise platform with encryption, KeySafe (customer-managed keys) and in-region storage controls.

moderate

Security & compliance

Broad certifications (ISO 27001, SOC, FedRAMP) and customer-managed encryption keys; controls are strong but governed under US jurisdiction.

moderate

Environmental sustainability

No EU-specific sustainability claims verified for this profile.

not assessed
EU alternatives
🇨🇭 Tresorit tresorit.com with caveats

End-to-end encrypted file collaboration with EU data centers; Swiss/Hungarian roots but owned by Swiss Post. Strong privacy, EU/EEA-adjacent jurisdiction.

🇩🇪 Nextcloud nextcloud.com EU-controlled

German-headquartered, open-source content collaboration you can self-host or run on EU sovereign cloud; full data and code control.

🇨🇭 Infomaniak kDrive infomaniak.com with caveats

Swiss-owned drive/collaboration suite hosted in its own Swiss data centers; outside the EU but strong sovereignty posture.

How the method works

Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.

Spotted an error? Every claim is sourced — challenge it and we correct the record.
  • 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).

Report Incorrect Data

Found an error in this company's profile? Help us improve our data by submitting a correction.

Required so we can follow up if needed. We won't share your email.

Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology