Vendor Privacy Scorecard · Box
Box AI: is it safe for client information?
AI questions, summaries and extraction over files stored in Box.
Bottom line
Strong for regulated offices. Box AI follows your existing Box permissions, and Box signs BAAs.
Does it train on your data? By plan
Business and Enterprise plans: No training
Box states customer content is not used to train models and AI providers keep no data.
What an auditor will ask
- Trains AI on your data? No
- Not used for training.
- Retention you can control? Yes
- Follows your Box retention and governance policies.
- Signs a HIPAA BAA? Depends on plan
- Box signs a BAA on eligible plans. Confirm it covers Box AI.
- Staff may read your content? No
- Not reviewed for training.
Security certifications
- SOC 2 Type II
- ISO/IEC 27001
- ISO/IEC 42001
- FedRAMP
Set it up the safe way
- Check folder permissions so AI cannot surface files people should not see.
- Confirm the BAA covers Box AI before using it on patient files.
- Record who approved Box AI and the date.
Box trust centerBusiness privacy terms
Summarized from Box's published terms, last checked 10/1/2026. Vendors change terms. Confirm every point against the agreement you actually signed. This is not legal advice.
Using Box AI at work? An unvetted tool can cost you your license.
When an employee pastes client information or confidential files into Box AI without the correct safeguards, licensing boards and regulatory bodies hold you responsible. AI Governance Rule Watch™ documents your approved tool roster, vendor reviews, and staff guidelines in permanent diligence records ready for any audit.
Founding member rate. Cancel anytime. Plus applicable taxes. Renews until canceled. Not legal advice and not a compliance certification.