The hybrid workforce, geopolitical environment, and global regulatory landscape have reshaped the way organizations approach compliance. According to Gartner, more than 60 jurisdictions around the world have enacted or proposed postmodern privacy and data protection laws making the regulatory landscape very complicated. At Box, securing our customers’ content is our top priority and today we are excited to announce that we will be expanding Box Zones by adding an additional Zone location in France.
French Box Zones customers can store content in-country with storage locations in Paris and Marseille. We will continue to process customer file upload, download, and encryption services within the European Union. Box Zones can help organizations address their data residency needs by delivering flexibility for in-region data storage of customer uploaded content. Box is focused on expanding to more regions across the world to help our customers accelerate digital transformation while raising the bar for privacy, trust, and control with Intelligent Content Management.
“Box’s relationship with our customers in France is essential to our growth strategy in Europe, and the French Zone is specifically aimed at better serving those customers,” said Rodolphe Barnault, Area Vice President Southern Europe at Box. “We are focused on investing in France, and in particular powering large sectors of the French economy, including industry leaders in energy, cosmetics, pharmaceuticals, and transportation, amongst others.”
The French Zone is a stepping stone towards the larger vision of Box’s expansion to global markets and is a further commitment to our customer base in highly regulated industries. While France does not yet have a specific privacy law that requires in-country storage, the France Zone lays the foundation for Box to help our customers comply with the future privacy demands in the insurance, healthcare and public sector verticals.
“We utilize Box Zones to ensure we store our content in Europe, which was a very important deciding factor in choosing Box,” said Thomas Cartereau, Chief Information Officer at SMEG. “We are excited about the launch of the France Zone, as it will give us even greater control over the location of our data. It is great to see Box’s continued commitment to data protection and privacy, and we look forward to our continued partnership.”
Box Zones usage has doubled in the last year, with more than 40PB of content protected. Box has consistently been named a Leader in the Gartner® Magic QuadrantTM for Content Services Platforms (CSP).¹ And expanding our Zones offering helps us maintain our leadership position as a CSP. The new France Zone joins the growing global network of Box Zones spread across the world, including Australia, Canada, Germany, Japan, US, and the UK with secondary storage location options in Singapore and Ireland. To learn more, visit our Box Zones website.
Source: Gartner, Magic Quadrant for Content Services Platforms, Lane Severson, Michael Woodbridge, Marko Sillanpaa, Tim Nelms, October 19, 2021.
Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, express or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. Gartner and Magic Quadrant are registered trademarks of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.
Box Zones FAQs
What is data residency, and why does it matter for enterprise cloud storage?
Data residency means your organization's content is stored in a specific geographic region — and stays there. It matters because many countries and industries require that sensitive data never leave a defined jurisdiction, whether to satisfy privacy regulations, government mandates, or internal security policies.
Without data residency controls, your enterprise content could be stored or processed in regions that conflict with your legal obligations, creating compliance risk and potential regulatory penalties. For multinational enterprises and regulated industries, in-region storage has shifted from a nice-to-have to a non-negotiable procurement requirement.
What is Box Zones, and how does it work?
Box Zones gives global organizations control over where their content is stored and processed. With secure, scalable in-region storage across 10 regions worldwide, Box Zones helps enterprises meet data residency and compliance requirements — without sacrificing collaboration, security, or AI capabilities. Admins map users to their designated zone from a single Admin Console, and content automatically follows — no action required from end users. Box Zones is included in Enterprise Plus and Enterprise Advanced plans, with predictable, all-inclusive pricing regardless of how many regions you need.
How does Box Zones help organizations meet GDPR and other data sovereignty requirements?
Box Zones helps you satisfy GDPR data residency requirements by keeping EU-based content stored within the EU, so personal data does not transfer to jurisdictions that lack equivalent protections. More broadly, Box Zones supports data sovereignty by giving your organization direct control over where enterprise content lives and is processed — a requirement that appears across regulations in multiple regions and industries. Admins can also download reports showing user-to-Zone mappings and storage policy assignments, giving compliance, legal, and IT teams the visibility they need for audits, governance reviews, and customer assurance.
What compliance standards does Box support alongside Box Zones?
Regulated organizations face compliance requirements that span both where data is stored and how it's governed — and Box addresses both. Box Zones handles the data residency dimension, while Box's broader platform supports FedRAMP High, HIPAA, FINRA, GxP (for life sciences), ITAR, and SOC 1/2/3, among others. Because Box's security and governance controls — including retention policies, audit trails, and access controls — apply uniformly regardless of which region you select, you maintain a consistent compliance posture across your entire content estate.
Which industries benefit most from cloud data storage compliance controls like Box Zones?
Any industry subject to data localization or sovereignty requirements benefits from Box Zones.
Key industries include:
- Financial services — banks, insurers, and investment firms use Box Zones to support regional data residency, audit readiness, and tighter governance for sensitive financial documents shared across international teams.
- Healthcare and life sciences — healthcare providers, pharma companies, and research organizations use Box Zones when patient, clinical, regulatory, or research content must remain in-region while still being accessible to global teams.
- Public sector and government — government agencies and regulated public bodies use Box Zones when sovereignty, residency, and jurisdictional control over content are essential requirements.
- Manufacturing and global supply chains — manufacturers use Box Zones to manage engineering, supplier, quality, and operational documentation across regions while aligning storage with local compliance requirements.
- Professional services and legal — law firms and consultancies use Box Zones when client confidentiality, jurisdictional requirements, and regional governance obligations shape where content must reside.
How do global enterprises use Box Zones to manage content across multiple regions?
Global enterprises use Box Zones to assign different storage regions to different user populations or business units, so each group's content stays in the appropriate jurisdiction — all within a single Box instance. For example, a multinational organization can store European employees' content in an EU region while storing content for other teams in separate regions, without creating separate collaboration silos. Admins manage everything from one central Admin Console, with consistent security and governance policies applied across all regions. When employees relocate, admins can update their Zone assignment and all that user's content follows automatically.
How does Box Zones work with Box KeySafe to strengthen data control?
Box Zones controls where your content is stored and processed geographically, while Box KeySafe controls who holds the encryption keys that protect that content. Used together, they give your organization both data residency and customer-managed encryption — two of the most demanding requirements in regulated industries. With Box KeySafe, your organization retains ownership of the encryption keys in your own key management infrastructure, meaning Box cannot access your content without your explicit authorization. This combination is particularly valuable for organizations in financial services, government, and life sciences, where both localization and encryption sovereignty are required.
Does Box Zones affect how Box Shield and Box Governance work?
No — Box Shield and Box Governance apply their security and compliance controls regardless of which region your content is stored in through Box Zones. Box Shield provides intelligent threat detection, automated content classification, and data loss prevention across your entire content estate, including content stored in non-default regions. Box Governance enforces retention schedules, legal holds, and disposition policies on all content, wherever it resides. Your data residency configuration and your security and governance posture work together seamlessly, without requiring separate configurations for each region.
Where is my enterprise data stored when I use Box AI?
When you use Box AI, your content stays within the Box platform — it is not sent to external AI systems or stored outside your governed environment. Box AI operates within Box's existing compliance and permissions framework, so AI-generated responses are based only on content that users and agents are authorized to access.
Box Zones is expanding to support in-region AI processing: in 2026, Box is adding three new regions — Israel, Singapore, and Switzerland — and enhancing existing Canada and France regions to include in-region compute for content metadata and Box AI. Keeping your content centralized and governed in Box — with data residency controls in place — is what makes it safe to apply AI at scale across your organization.
How does Box Zones integrate with existing enterprise systems and tools?
Box Zones works within the broader Box Intelligent Content Management platform, which connects to 1,500+ integrations including Microsoft 365, Salesforce, ServiceNow, Okta, Slack, and Google Workspace. Your data residency configuration applies at the storage layer, so integrations and workflows continue to function normally — your teams keep working in the tools they already use, while Box ensures content stays in the right region. For organizations building custom applications, Box's open APIs and SDKs let developers embed Box's content capabilities, including regional storage controls, directly into their own apps and portals.
How is Box Zones different from simply choosing a cloud storage provider in a specific country?
A regional cloud storage provider gives you a location. Box Zones gives you a location and a complete enterprise content management platform. Box Zones delivers data residency and the full Box Intelligent Content Management platform — including AI-powered search and extraction, automated workflows, granular permissions, threat detection via Box Shield, retention and legal hold via Box Governance, e-signatures via Box Sign, and 1,500+ integrations — all in one governed environment.
Security and compliance controls are built in, not bolted on, and they apply consistently across every region you configure. And with all-inclusive pricing across all 10 regions, you get flexibility without unpredictable cost tiers.
How do I get started with Box Zones?
Box Zones is included in Enterprise Plus and Enterprise Advanced plans. To get started, contact your Box account team or visit box.com to get a data residency assessment — a specialist will evaluate your requirements and recommend the right regional configuration for your organization.
Box's professional services and partner ecosystem can also support migration from legacy systems, integration with your existing tech stack, and change management to accelerate time to value. If you're already a Box customer, your Admin Console is where you manage regional storage assignments and generate compliance reports — your Box account team can walk you through the setup.
