Skip to content

v0.0.3 — Compliance by deployment: Box Trust Center mapped to tiers

Latest
Latest

Choose a tag to compare

View all tags
@mrdulasolutions mrdulasolutions released this 25 May 00:08
v0.0.3
4a612ed

Adds a deployment-tier compliance posture reference doc. Auditors and procurement teams can now self-serve which deployment model maps to which regulatory regime, with authoritative Box-official URLs for every claim.

What ships

references/compliance-by-deployment.md — three deployment models × every regulation Box publicly claims coverage for:

Deployment models

Model Components Best for
A — On-prem air-gapped box-memory-onprem only + Box Drive IL4 / ITAR / strictest air-gap
B — Hybrid Both plugins; user picks per workflow Mixed regulated + non-regulated workflows
C — Cloud-only box-memory only (full Box AI) Compliance via Box's platform certs, no air-gap claim

Regulations covered

HIPAA / HITECH, FedRAMP Moderate, FedRAMP High, DoD IL4, ITAR, EAR, IRS 1075, CJIS, StateRAMP, GxP / 21 CFR Part 11, FINRA / SEC 17a-4, GDPR / UK DP, CCPA, PCI DSS Level 1, GLBA.

For each: recommended deployment model + required Box plan + required add-ons (Box Governance, KeySafe, Zones, Shield) + authoritative URL.

Explicit caveats Box doesn't always emphasize

  • BAA tier gate — Business / Business Plus cannot sign a HIPAA BAA
  • GovCloud-vs-commercial — commercial tenants don't inherit FedRAMP / IL4 / ITAR even though Box (the company) holds those certs
  • NOT publicly claimed by Box — IL5, ISO 27701, C5, ENS, IRAP, FedRAMP+ MDA. Don't represent these to regulated customers.
  • Box Drive's per-product scope is not publicly enumerated; request explicit attestation from CSM if needed
  • Shared-responsibility model — Box's certs cover Box's controls, not your configuration

Workspace config fields added

Optional declaration in _box-memory.json.settings:

compliance_target: hipaa | fedramp-moderate | fedramp-high | il4 | itar | gxp | gdpr | null
box_plan: business | enterprise | enterprise-plus | enterprise-advanced | box-federal
box_addons: [governance, keysafe, zones, shield]
box_zone: us | gov | eu-ireland | eu-germany | uk | au | jp | sg
baa_signed: <date or null>

/box-airgap-status reads these and flags mismatches (e.g., declared HIPAA but plan = Business → fail).

Why this lives in the on-prem repo

Regulated workloads are the primary reason users choose the air-gapped variant. They need to defend that choice to auditors. This doc gives them the citations.

The cloud variant (mrdulasolutions/BOX) references the same doc — the compliance landscape applies to both deployment models, with different trade-offs per model.

Verification

Artifact SHA256
box-memory-onprem-plugin.zip efefe60dad6c47d5f71d04145c8ec655f6ef234f593296128fddf54b8bacf7b2
box-memory-onprem-skills.zip 503e4a2260308ae12ec52eac353fe1e64494dc7cb1ac8564ffd1de225e0a66fa

All five CI gates pass. No skill code changes; no .schema-pin bump.

How to use the doc

  1. Pick your deployment model based on regulatory regime.
  2. Confirm Box plan + add-ons match the model's requirements.
  3. Cite the Box-official URLs from the table for each cert.
  4. Document compliance_target in your workspace config; run /box-airgap-status to capture as an audit artifact.

Install

Same as v0.0.2 — docs-only release. If you already have v0.0.2 installed and just want the new doc, git pull is enough (or re-download the new plugin zip).

Assets 13
Loading