Box, Inc.

United States · owned by Independent (United States) · www.box.com · 11 vendors

Box, Inc. is a cloud-based intelligent content management platform that enables enterprises to securely store, share, collaborate on, and automate workflows around their content. The company offers AI-powered tools for document management, e-signatures, data extraction, and workflow automation, integrating with over 1,500 third-party applications. Box serves approximately 97,000 companies globally, including 68% of the Fortune 500, and is headquartered in Redwood City, California.

Resilience scores

Disruption prediction

Box, Inc. has a 99% probability of disruption in the next 6 months.

All systems operational (last checked 2026-09-18 14:55 UTC)

8 of Box, Inc.'s 11 vendors monitored for disruptions.

Technology vendors

Services catalogue

36 services in catalogue across 10 categories; runs on 11 sub-vendors.

Insights

Last updated 2026-09-13 · revision 9

11 direct vendors, 224 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Box, Inc. exhibits high migration readiness, primarily driven by its highly modern and flexible technology stack. The internal tech stack is cloud-native, leveraging Amazon Web Services (AWS), containerization (Kubernetes, Docker), microservices-enabling technologies (Apache Kafka, Redis, Elasticsearch), and an API-first approach (Box Content Platform APIs & SDKs). This architecture significantly reduces the complexity and effort required for potential migrations, offering portability across cloud environments. Financially, Box's strong and consistent revenue growth provides ample resources to fund any necessary migration initiatives. The company's robust regulatory compliance framework, including adherence to GDPR, HIPAA, SOC2, and ISO 27001, means that established processes and documentation are in place to manage compliance during a migration, although the complexity of maintaining these across multiple jurisdictions (e.g., GDPR, HIPAA) adds a layer of planning. Data residency requirements are well-addressed through Box Zones, which allows content storage in specific geographic regions. While this provides compliance flexibility, it also means any migration must carefully account for these regional data storage commitments. The vendor relationship data is contradictory, stating "Total Vendors: 0" but implying reliance on major cloud and AI providers (AWS, OpenAI, Anthropic, Google). If these are considered key dependencies, then while switching from a major cloud provider like AWS could be a large undertaking, the use of containerization (Kubernetes, Docker) mitigates cloud provider lock-in. The diversification across multiple leading AI model providers (OpenAI, Anthropic, Google) also reduces AI-specific vendor lock-in. The "Vendor Lock-in Risk: Unknown" is a specific area where more clarity would be beneficial, but the overall architectural choices point to a high degree of flexibility and readiness for migration.

Compliance

17 in-scope frameworks identified; showing 3.

FedRAMP — Compliant

Box has achieved FedRAMP High Authorization — the highest level of FedRAMP authorization, applicable to systems handling the most sensitive unclassified federal data. This is a rigorous, government-mandated security assessment and authorization process. Risk is Low because FedRAMP High is the most demanding cloud security authorization in the US federal government context, and Box has achieved and maintains it. This also demonstrates compliance with NIST 800-53 (the underlying control framework), FIPS 140-2, and other federal security requirements.

Evidence: https://marketplace.fedramp.gov/products/F1212191840A, https://www.box.com/trust, https://www.box.com/fedramp, https://www.box.com/industries/government-federal, https://govramp.org/product-list/

ISAE 3000 (source) — Compliant

ISAE 3000 (Assurance Engagements Other than Audits or Reviews of Historical Financial Information) is the international standard underpinning SOC 2 and similar assurance reports outside the US. Box's SOC 2 Type II report, while primarily governed by AICPA AT-C Section 205 in the US, is equivalent to and often dual-issued under ISAE 3000 for international customers. Box's engagement of independent third-party auditors for SOC 2 Type II, SOC 1 (SSAE 18), and other assurance reports demonstrates compliance with the principles of ISAE 3000. Risk is Low because Box has a mature, independently audited assurance reporting program. The SOC 2 Type II report is the primary evidence of ISAE 3000-equivalent assurance.

Evidence: https://www.box.com/trust, https://www.box.com/security-compliance, https://cloudsecurityalliance.org/star/registry/box/services/box/

ITAR — Compliant

Box explicitly lists ITAR and EAR compliance on its Trust Center. ITAR and EAR are US export control regulations governing the transfer of defense-related and dual-use technologies. Box's compliance enables defense contractors and government agencies to use Box for ITAR/EAR-controlled data. Risk is Low because Box has obtained ITAR/EAR compliance documentation (available under NDA) and serves federal government and defense customers.

Evidence: https://www.box.com/trust, https://www.box.com/industries/government-federal, https://www.box.com/fedramp

Financials

Three-year financials

Financial Resilience Score: 7/10

Box has transitioned from a high-growth, loss-making SaaS company to a mature, cash-generative enterprise software vendor. The company demonstrates strong financial resilience through its recurring revenue model, with over 95% of revenue derived from subscriptions, providing high visibility. Remaining Performance Obligations stood at approximately $1.3B at FY2025 year-end, offering solid forward revenue visibility. Free cash flow reached ~$296M on $1.09B revenue in FY2025, representing an impressive ~27% FCF margin characteristic of a mature SaaS business. GAAP profitability inflected sharply, with FY2025 posting the strongest GAAP operating income ($121.6M) in Box's history as a public company. The balance sheet holds ~$500M+ in cash and short-term investments with a manageable debt profile. The enterprise customer base is sticky, serving approximately 68% of the Fortune 500 with concentration in regulated industries like financial services, life sciences, and government. However, resilience is tempered by slowing growth (mid-single digits, well below best-in-class SaaS peers), competitive pressure from Microsoft, Google, and Dropbox, and a capital structure weighed down by ~$500M of Series A convertible preferred stock issued to KKR in 2021. Common equity has been negative for several years due to aggressive share repurchases and cumulative deficit. Net retention (~101-103%) is modest, and stock-based compensation remains high at 15-17% of revenue.

Key strengths: Recurring subscription revenue >95% of total, Strong free cash flow margin of ~27%, RPO of ~$1.3B providing forward visibility, Serves ~68% of Fortune 500, GAAP profitability inflection in FY2024-FY2025, $500M+ cash and short-term investments, Expanding operating margins showing cost discipline

Risk factors: Slowing revenue growth to mid-single digits, Competitive pressure from Microsoft, Google, Dropbox, Negative common equity from KKR preferred stock and buybacks, FX exposure to weak Japanese yen, Modest net retention rate (~101-103%), High stock-based compensation (15-17% of revenue), Convertible preferred stock dilution risk

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report