Box
Connect Box to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Box to collect cloud storage provider evidence with automated compliance tests, switched on per workspace.
| Category | Cloud Storage Provider |
| Connect with | API token, MCP server |
| What a connection produces | Automated compliance tests |
| Box's guide | developer.box.com |
Connect with an API token
-
In Box:
- In the Box Developer Console, select New App, select Server as the app type, leave Client Credentials Grant selected under Select Method, and select Create.
- On the Configuration tab, set App Access Level to App + Enterprise Access.
- Under the application scopes, check Manage users (manage_managed_users).
- Copy the Client ID and Client Secret from the Configuration tab (the secret is only shown once multi-factor authentication is enabled on your Box account).
- After a Box admin authorizes the app (see the admin step), request an access token from the /oauth2/token endpoint with the client credentials and box_subject_type=enterprise plus your Enterprise ID, and paste that access token into Safeguard.
- A Box admin opens the Admin Console, selects the Platform tab, then the Platform Apps tab, clicks Add and enters the app's Client ID to authorize it.
Box's public documentation does not cover every step.
Source: developer.box.com, developer.box.com, developer.box.com, developer.box.com, checked 2026-10-07.
The permissions Safeguard needs:
manage_managed_users,App + Enterprise access. Box has no narrower grant for these reads. Safeguard only reads with it. -
On Compliance › Connectors, open Box, click Connect, choose API token and fill in:
Field What to enter Access token Required. Stored encrypted and never shown again. -
Click Connect with token.
Connect with the MCP server
Choose MCP server: the address https://mcp.box.com is filled in. Sign in to Box when asked. It lets Griffin AI search Box; the compliance evidence comes from the API token connection.
Frameworks
Safeguard's automated tests read Box and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 3 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.2 | 3 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 3 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5 | 3 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 3 |
These tests are switched on per workspace by the Safeguard team.
Related
- Cloud Storage Provider connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks