Box not fulfilling contractual obligation of purging our data 120 days after contract expired

👋 Hi ​@George.Bullock, welcome to the Box Community!

Based on the ticket you previously raised, I can confirm that the enterprise was successfully deactivated in May 2025. Since it has been deactivated for over 120 days, it was automatically purged and is no longer in our system.

I also see that a Boxer has submitted a new ticket on your behalf requesting a deletion certificate. This request has already been escalated to our Compliance team for review. In the meantime, please keep an eye out for a follow‑up email from our support team with further assistance.

If you have any other questions or concerns, don’t hesitate to reach out.

I get all that but what is the hold up to just getting one of your Tech Teams to purge our data. I am not understanding the hold up.

1 - it is your contractual obligation
2 - makes me very nervous having our data sit there in a non-operational platform but I still need to keep an eye on it to ensure no cyber intrusions.

So are you saying it is purged and all I am awaiting is the certificate - does that mean I can decommission Keysafe without any fears now ?

​@Jey Bueno Box ?

Hi ​@George.Bullock, thank you for your follow‑up, and apologies for the delay. I raised your concern internally and have just heard back from our team.

As per support:

As long as there is no potential to restore the enterprise ID, then no, the KMS configuration supporting the Keysafe module for that enterprise ID is no longer required, and can be removed without issue.

Regarding your concern about deletion: yes, your enterprise has been deleted from our database. This was done automatically after 120 days from the deactivation date, and we did not retain the account or its content.

After further reviewing the ticket submitted on your behalf, we informed your reseller that all account deletions must follow our standard 120‑day deletion process to ensure compliance with data handling and security policies. This process cannot be expedited.

We also advised the reseller to let you (the client) know to reach out to us directly once the 120‑day period has passed and we will be happy to provide the appropriate documentation upon request. Please note that deletion certificates are not sent automatically and are only provided when requested.

For now, please keep an eye out for updates on the new ticket regarding the deletion certificate.

We appreciate your continued patience.

​@Jey Bueno Box So thanks for 1st 2 updates

1 - keysafe can be deleted
2 - Data has been purged/deleted

but for 3/. Certificate of purging/deletion

We have numerous emails with Box contacts in Australia (not just CAPGemini the reseller) asking for a Certificate of the Deletion and they say they have raised numerous tickets internally to Box Support and they seem to so far only get unsatisfactory answers back.

so I would appreciate some sort of escalation on this to get a certificate to us.

thanks

George

Hello George, you’re most welcome, and thank you for your response.

This request is being managed by our Compliance team, and we have limited visibility into their specific processes and procedures regarding certification requests.

Although this falls outside our scope, I’ve escalated the matter internally to ensure the appropriate team follows up with you as soon as possible. I’ve also left a note on the ticket opened by your reseller and also waiting to hear back from our team.

Thank you again, and we look forward to having this resolved promptly.