This analysis describes what Box's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The updated terms establish that Box may bill customers automatically for consumption of enterprise-wide service resources (API Calls, AI Units) that exceed entitlements associated with the customer's service level. Previously, the terms only mentioned that 'additional fees will be due' if Platform Use Limits were exceeded, but the new language creates explicit billing procedures, pricing references, and usage control mechanisms. The agreement now authorizes Box to provide usage reports identifying overage, charge customers for excess resource consumption, and implement technical controls including throttling, rate limiting, or temporary service suspension until overage charges are paid. Users can contact Box through its web form or email to dispute usage reports, but the terms reserve all other contractual and statutory remedies to Box.
View change record →How other platforms handle this
We collect and keep personal data only as needed or allowed for the purposes set out in this Statement, based on the reason we collected the personal data in the first instance and what is permitted under the laws that apply to the processing.
We may retain your Personal Data for a period of time consistent with the original purpose of collection...or as long as required to fulfill our legal and/or regulatory obligations.
Affirm will retain your information in accordance with our Privacy Policy and any applicable state or federal law, rule or regulation.
"it is your responsibility to configure and properly utilize the applicable Service and Box Zones to address your obligations related to data types and data residency obligations.Excerpt from Box's Terms of Service
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The clause states: “it is your responsibility to configure and properly utilize the applicable Service and Box Zones to address your obligations related to data types and data residency obligations.”
ConductAtlas has identified this type of provision across 274 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Box.