You've probably seen Box in a workplace: it is one of the biggest names in enterprise cloud content management, built around collaboration, workflows and admin control. But "trusted by big companies" is not the same as "private", so the real question is: is Box actually secure, and secure from whom? This guide gives an honest answer and shows how to make your files truly private.
What Box does protect
Box takes baseline security seriously, and against outside threats it is strong.
- Encryption in transit and at rest - files move over TLS and are stored encrypted with AES-256 on Box's servers.
- Two-factor authentication and SSO - Box supports 2FA and enterprise single sign-on (SAML), so account takeover is much harder.
- Granular admin controls - administrators can set folder permissions, expiring shared links, device trust and access policies down to a fine level.
- Heavy compliance - Box carries certifications such as HIPAA, FedRAMP, PCI DSS, ISO 27001 and GDPR alignment, which is a big reason regulated industries use it.
Enterprise extras: KeySafe and Shield
Two paid add-ons push Box further than most consumer clouds. Box KeySafe lets an organisation manage its own encryption keys (backed by a cloud key-management service) and get an audit trail of every key use - useful for compliance and for revoking access. Box Shield adds threat detection, anomaly alerts and classification-based access controls. These are genuinely strong enterprise features.
The privacy caveat: Box is not zero-knowledge
Here is the honest limit. By default, Box holds the encryption keys. That is what powers search, previews, sharing and admin recovery - but it also means Box can technically read your content, and as a US company it can be compelled to produce readable data under laws such as the CLOUD Act. "Encrypted" here means encrypted against outsiders, not against the provider.
Even KeySafe does not make Box zero-knowledge: the keys are still used to process your files on Box's side. That is different from client-side, zero-knowledge encryption, where the provider only ever sees ciphertext and never holds a usable key.
How to make files on Box genuinely private
If you want files that nobody but you can open, keep the key on your device:
- Encrypt before upload with a free, open-source tool like Cryptomator. It creates an encrypted vault inside your Box folder, so only ciphertext is ever uploaded and only you hold the password.
- Use a zero-knowledge provider for your most sensitive data, where client-side encryption is the default rather than an add-on.
Want zero-knowledge instead? pCloud + Crypto
Swiss jurisdiction · Client-side encryption with the Crypto add-on · Lifetime plans
The bottom line
Box is a genuinely secure, compliance-ready platform for business collaboration, and against outside attackers it holds up well. What it is not, by default, is private from Box itself: the provider holds the keys and answers to US jurisdiction. If that matters for a given file, encrypt it client-side before it reaches Box, or store it with a zero-knowledge service - then "secure" and "private" finally mean the same thing.
Frequently asked questions
- Is Box secure?
- Against outside attackers, yes, Box is one of the more secure mainstream clouds: it encrypts files in transit (TLS) and at rest (AES-256), supports two-factor authentication and single sign-on, offers granular admin permissions, and carries heavy compliance certifications (HIPAA, FedRAMP, ISO 27001, GDPR). The caveat is that this is 'secure against outsiders', not 'private from Box'. By default Box holds the encryption keys, so it can technically access your content and can be compelled to hand readable data over under US law. For business collaboration it is strong; for data you want no one but you to read, it is not zero-knowledge.
- Does Box use end-to-end encryption?
- No, not by default. Box encrypts data in transit and at rest, and Box manages those keys, so the model is server-side encryption rather than end-to-end. That protects against interception and stolen-disk scenarios, but because Box holds the keys it (and anyone who legally compels it) can access the content. True end-to-end or zero-knowledge encryption, where only you hold the key, is not Box's default. You can add it yourself by encrypting files locally before upload.
- Is Box zero-knowledge?
- No. Even with its enterprise key-management add-on (KeySafe), the keys are used to process your content on Box's side, so Box is not a zero-knowledge service in the way pCloud Crypto, Tresorit or a Cryptomator vault are. KeySafe gives an organisation more control and an audit trail over key usage, which is valuable for compliance, but it is not the same as client-side encryption where the provider never sees a usable key or your plaintext.
- Is Box HIPAA and GDPR compliant?
- Box is widely used in regulated industries and supports compliance with frameworks including HIPAA, FedRAMP, PCI DSS, ISO 27001 and the GDPR, and it will sign a Business Associate Agreement for healthcare customers. Compliance-ready is not the same as private-by-design, though: these frameworks govern how data is handled and protected, not whether the provider can read it. Box can, unless you encrypt client-side first.
- How do I make files on Box truly private?
- Encrypt them yourself before they reach Box. A free, open-source tool like Cryptomator creates an encrypted vault inside your Box folder, so only ciphertext is uploaded and only you hold the key. Alternatively, for genuinely sensitive data, use a zero-knowledge provider whose default is client-side encryption. Either way, the goal is the same: make sure the key never leaves your control.
Get encrypted cloud storage → pCloud
Swiss-based · client-side Crypto add-on · lifetime plans
