Beyond Data Residency: Understanding In-Region Processing and Global Collaboration

Dear Box Community, as a follow up to our recent community roundtable, I wanted to provide more background on in-region processing and why it is becoming more important. In this post I will cover the following questions, referencing our Box Zones white paper and other sources.

If this is helpful or if you have further questions please comment in the replies!

What counts as in-region processing?

• In-region processing means that content is stored and processed within a customer-selected geographic region, or “Boz Zone.” The Box white paper frames this as covering the content lifecycle - not only primary storage, but also routing, upload, download, and cross-Zone collaboration architecture. Box Zones white paper

• A Zone includes a primary and backup data center. In Box files are stored according to the top-level folder’s storage policy, and that content may move when ownership, user assignment, copying, or default-zone settings change. Box Multizones documentation

• Residency alone does not necessarily mean all processing is in-region. Processing can include account management, service delivery, troubleshooting, support access, analytics, backups, and subprocessors. The UK ICO specifically advises organisations to examine both the cloud provider and its global network of processors. ICO guidance

Which content operations matter?

• From our white paper, the relevant operations include:

  • Content routing and zone assignment

  • Upload and download

  • Storage and backup

  • Cross-Zone collaboration

  • Content migration when users or ownership change

  • Administration through the Admin Console, Multizones SSO, and APIs

  • Processing associated with AI and other content services

• In Box, File location is determined primarily by the root folder’s storage policy, not necessarily by the location of the person performing the action. For example, a user in Canada can create content in a Japan-based folder, in which case the content follows the Japan Zone’s policy. Box Multizones documentation

• Regulators take a broad view of processing. The ICO identifies user-account management, the core cloud service, technical troubleshooting, and remote support access as processing activities. It also notes that making data accessible to an organisation in another country can constitute a transfer—even if the data remains on servers in the original country. ICO guidance

What trade-offs arise between residency and collaboration?

• Regional controls can support regulatory requirements while preserving collaboration across Zones. However, cross-Zone collaboration requires an architecture that manages routing, access, downloads, and potentially content movement between regions. Box Zones white paper

• Collaboration can trigger migration or create content governed by another Zone’s policy. For example, transferring ownership, copying content across Zones, or changing a user’s Zone can cause content to move. This creates a trade-off between strict regional control and fluid global collaboration. Box Multizones documentation

• International access may create legal obligations even where content is not physically moved. The ICO states that remote access by a separate organisation abroad may be a restricted transfer, and that cloud customers must understand onward transfers to global subprocessors. ICO guidance

The main trade-offs are therefore:

• Strict residency vs. seamless global access: tighter regional boundaries may require more deliberate sharing and governance.

• Local processing vs. service consistency: some features, support functions, or AI capabilities may rely on shared or global infrastructure.

• Data control vs. operational simplicity: regional assignment, migration, and reporting add administrative requirements.

• Privacy assurance vs. collaboration speed: preventing cross-border access can reduce risk but may introduce friction for distributed teams.

Here is a list of questions to ask your provider:

You can find details of our latest Box Zones release and our roadmap which we discussed with our community recently here.