What data/content/components of a file are transiting to any internal or external service to support these AI features?

The Box AI Platform is an internal Box service that handles AI queries. Based on the query, it retrieves relevant parts of content and sends the query together with the relevant text to an AI model (typically one that is hosted in a location like Azur or GCP) and then returns the response.

Do model providers train on user data? Does Box?

No. Box's model providers do not train on any data that they receive from Box. Box also does not train AI models based on customer data. This is a critical pillar to our AI principles and for our customers to know that it is safe to use AI without worrying their data will be leaked into a model and released. Note that in the future, customers may wish to have custom-trained AI models based on some of their content, but if Box releases this type of feature, the customer will explicitly approve that they want this type of trained model.

What specific controls are in place to ensure privacy of data?

Box safeguards customer data with robust security protocols, including encryption and data security best practices, ensuring that all content processed by Box AI remains secure and confidential.

Box AI is governed by Box's built-in permissions, and it's designed to keep customers in control of their data so that users can only see and interact with the files they are allowed to access. Box customers maintain control over their own data and processes. Customers may enable or disable the use of Box AI, and can decide whether or not Box AI should be applied to their content. Box does not store Box AI questions or answers, nor do our AI model providers. Our providers delete Box AI queries and results from their systems immediately once a response is returned. Once a document or application is closed in Box, all question and answer information is deleted from Box AI.