Box, Inc. Due Diligence

Run due diligence on Box, Inc.: check incident history and compliance and get alerts when suppliers or ownership change.

United States · owned by Independent (United States) · www.box.com · 14 vendors

Box, Inc. is a cloud-based intelligent content management platform that enables enterprises to securely store, share, collaborate on, and automate workflows around their content. The company offers AI-powered tools for document management, e-signatures, data extraction, and workflow automation, integrating with over 1,500 third-party applications. Box serves approximately 97,000 companies globally, including 68% of the Fortune 500, and is headquartered in Redwood City, California.

Resilience scores

Disruption prediction

Box, Inc.: 3 critical incidents expected in the next three months, based on its recorded incident history.

Forecast estimates are rounded up to whole numbers.

No active incident reported (its status page, as of 2026-11-09 23:55 UTC)

9 of Box, Inc.'s 14 vendors have incident tracking.

Technology vendors

Services catalogue

39 services in catalogue across 10 categories; runs on 14 sub-vendors.

Insights

Last updated 2026-09-13 · revision 9

14 direct vendors, 218 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

17 in-scope frameworks identified; showing 3.

HDS — Evidence found

Evidence: https://www.box.com/trust, https://cloud.app.box.com/s/6fsfefp3o3bvwuzjhygqo7ze66i5cmm2, https://cloud.app.box.com/file/2221927311811

SOC 2 (source) — Evidence found

Evidence: https://www.box.com/trust, https://www.box.com/security-compliance, https://cloudsecurityalliance.org/star/registry/box/services/box/

IRAP — Evidence found

Evidence: https://www.box.com/trust, https://www.box.com/en-au/home

Financials

Three-year financials

Financial Resilience Score: 7/10

Box has transitioned from a high-growth, loss-making SaaS company to a mature, cash-generative enterprise software vendor. The company demonstrates strong financial resilience through its recurring revenue model, with over 95% of revenue derived from subscriptions, providing high visibility. Remaining Performance Obligations stood at approximately $1.3B at FY2025 year-end, offering solid forward revenue visibility. Free cash flow reached ~$296M on $1.09B revenue in FY2025, representing an impressive ~27% FCF margin characteristic of a mature SaaS business. GAAP profitability inflected sharply, with FY2025 posting the strongest GAAP operating income ($121.6M) in Box's history as a public company. The balance sheet holds ~$500M+ in cash and short-term investments with a manageable debt profile. The enterprise customer base is sticky, serving approximately 68% of the Fortune 500 with concentration in regulated industries like financial services, life sciences, and government. However, resilience is tempered by slowing growth (mid-single digits, well below best-in-class SaaS peers), competitive pressure from Microsoft, Google, and Dropbox, and a capital structure weighed down by ~$500M of Series A convertible preferred stock issued to KKR in 2021. Common equity has been negative for several years due to aggressive share repurchases and cumulative deficit. Net retention (~101-103%) is modest, and stock-based compensation remains high at 15-17% of revenue.

Key strengths: Recurring subscription revenue >95% of total, Strong free cash flow margin of ~27%, RPO of ~$1.3B providing forward visibility, Serves ~68% of Fortune 500, GAAP profitability inflection in FY2024-FY2025, $500M+ cash and short-term investments, Expanding operating margins showing cost discipline

Risk factors: Slowing revenue growth to mid-single digits, Competitive pressure from Microsoft, Google, Dropbox, Negative common equity from KKR preferred stock and buybacks, FX exposure to weak Japanese yen, Modest net retention rate (~101-103%), High stock-based compensation (15-17% of revenue), Convertible preferred stock dilution risk

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report