1. About this page
Boxes engages a small number of third-party service providers ("subprocessors") to provide infrastructure, support, and ancillary services that are essential to operating the Boxes Services. We require every subprocessor to be bound by written data-protection contracts that are no less protective than the obligations in our Data Processing Agreement. This page is the authoritative list, updated whenever the list changes — with at least 14 days' prior notice per our DPA §7.
2. Infrastructure
| Provider | Purpose | Location | Data |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud compute, storage, database hosting | US-East, US-West, EU-Central, EU-West, AP-Tokyo | All Customer Data |
| Cloudflare, Inc. | CDN, DNS, DDoS protection, WAF | Global edge | IP addresses, request metadata, TLS termination |
3. Observability & operations
| Provider | Purpose | Location | Data |
|---|---|---|---|
| Datadog, Inc. | Metrics, logs, application performance monitoring | US | Operational telemetry, sanitised logs (no Customer Content) |
| Sentry (Functional Software, Inc.) | Error tracking and crash reporting | US | Stack traces, sanitised event payloads |
| PagerDuty, Inc. | On-call alerting and incident routing | US | Operational alerts and on-call metadata |
4. Communications
| Provider | Purpose | Location | Data |
|---|---|---|---|
| Postmark (Wildbit, LLC) | Transactional email delivery (sign-up, billing, system alerts) | US | Email addresses, message content |
| Twilio, Inc. | SMS-based two-factor authentication (opt-in) | US | Phone numbers and OTP messages |
5. Billing & support
| Provider | Purpose | Location | Data |
|---|---|---|---|
| Stripe, Inc. | Payment processing and tax compliance | US, EU | Billing contact, payment-method tokens, transaction records |
| Plain (Plain HQ Ltd.) | Customer support ticketing | EU | Support contact, conversation content |
| Linear (Linear Orbit, Inc.) | Internal issue and bug tracking (escalations from support) | US | Issue metadata; sanitised before inclusion |
6. AI inference providers (opt-in only)
The following providers may receive Customer Content only when Customer (or its administrator) explicitly enables third-party inference for a workspace. All providers below are bound by zero-retention, no-training contractual terms.
| Provider | Purpose | Location | Data |
|---|---|---|---|
| OpenAI, OpCo, LLC | LLM inference (drafts, summaries, agent reasoning) | US | Prompts and surrounding context; not used for training |
| Anthropic, PBC | LLM inference (Claude family) | US | Prompts and surrounding context; not used for training |
| Google Cloud / Vertex AI | LLM inference (Gemini family) | US, EU | Prompts and surrounding context; not used for training |
Customers may disable third-party inference per workspace in admin settings. Enterprise customers may bring their own LLM endpoint, in which case no third-party inference subprocessor receives Customer Content.
7. Self-hosted customers
If Boxes is deployed self-hosted in Customer's cloud, none of the subprocessors above receive Customer Data — all data flows are contained within Customer's own infrastructure. Customer is responsible for any subprocessors it engages independently (e.g., its own cloud provider, observability stack, or AI inference endpoint).
8. Subprocessor change notifications
To subscribe to change notifications, email privacy@boxes.sh. New subprocessors are announced at least 14 days before they go live. Notice is delivered by email to the registered privacy contact on file and posted to this page.