Box: Appropriate Use Guidelines (Future State)
Box is a cloud-based storage solution that allows you to share frequently accessed working files with people inside and outside of Washington University.
WashU and Box.net have partnered to provide service that meets common higher education security and regulatory requirements.
Below is the appropriate use guidelines with suitable types of data that can be stored in Box.
Box Appropriate Use Guidelines
The grid below is a quick reference guide for understanding what data should and should not be stored in WashU Box.
| Appropriate | Appropriate With Assistance* | Not Appropriate |
| Attorney/Client Privileged Information | Protected Health Information (HIPAA) | Credit Card or Payment Card Industry (PCI) Information |
| IT Security Information | Social Security Numbers | Export Controlled Research (ITAR or EAR) |
| Other University Sensitive Data Not Specifically Addressed Elsewhere | Personally Identifiable Information (PII) | Long term “cold storage”** |
| Sensitive Identifiable Human Subject Research | Federal Information Security Management Act (FISMA) Data | Backups from other file servers*** |
| Student Education Records (FERPA) | Backups from laboratory equipment*** | |
| Student Loan Application Information (GLBA) |
Please view: Cloud Service Guidelines, and Considerations for Use.
* Appropriate with assistance means that those unfamiliar with WUSTL Box should seek guidance from IT staff in order to ensure proper use of the system to avoid accidentally putting sensitive data at risk. Guidance provided by IT staff generally focuses on two important items:
- If you choose to use the Box Drive app, a copy of your data is downloaded to your local machine. If you are dealing with sensitive data, it is imperative that you have local disk encryption enabled prior to installing and using Box Drive.
- If you use the sharing and collaboration features of WUSTL Box to share sensitive data, you must fully understand how the features work in order to ensure that you do not accidentally grant access to people who should not have access to the sensitive data.
** Cold storage refers to a storage solution for infrequently accessed data that is important for long-term retention, compliance, or archival purposes.
*** Saving output directly from test equipment, and saving to Box from backup appliances (e.g., Synology, QNAP, UGREEN, RClone) is not allowed, i.e., users can’t use Box as a data backup platform.
Storage Limit
WashU Box users receive 1TB data limit by default.
As of 11/19/2025, users whose storage exceeds 1TB will be allowed their current storage usage plus 10% but are strongly encouraged to reduce their data footprint. See Best Practices for tips on optimizing data storage.
View alternative storage options under the Overview of File Storage Options section on the File Shares & Storage webpage or Research Infrastructure Services’ Data Storage Platform page.
Users may request additional storage using this ServiceNow request form, which will be processed on a case-by-case basis. Note: Be aware there may be associated charges.