On the radar: Box

Content Management
Box provides a collaborative content management and team workspace-style solution, with particular attention paid to support for mobile workers, delivered via a software-as-a-service (SaaS) model.


Box is based in Los Altos, CA, with European headquarters is in London, and additional European offices in Paris, France and Munich, Germany.

What does it do?

At first glance Box is a simple, SaaS-based online file store and file sharing platform, providing individuals with location- and device-independent access to their content, and enabling teams either within an organisation or across different organisations to share content securely with others. However, while this is largely where Box began, the solution has evolved into a much richer environment which is not just about sharing and managing content, but also about supporting the collaborative processes that take place around that content, and the enterprise applications that engage with it.

This latest phase of Box’s evolution from its “sync and share” origins sees the company reinvent itself as a cloud-based content platform, designed to become the powerhouse for an enterprise’s entire inter-connected information economy. Out-of-the-box connectors for common enterprise applications like Salesforce, NetSuite, Jive, Microsoft Office and Google Apps, plus SharePoint and other leading ECM systems, coupled with Active Directory / SAML 2.0 support for single sign-on, the Box API for custom integrations, and Box Embed (HTML 5 technology that embeds Box’s content management and collaboration features in any application), are all helping Box to play for a position nearer the centre of operations.

From a functional standpoint the core web application is, as you might expect, a folder-based file storage and content sharing platform in the cloud, with a superset of functionality across different versions that cover full-text search, comments, tasks, user / device / content / application security controls and a rich administrative interface that provides both management and reporting for full audit trail activity logging data. Box Policies and Automations was released for Enterprise and Elite customers in early 2014. With it, administrators can set up rules and automate processes through an “if this, then that”-style interface so that files are routed to particular people for review, for example, or set aside in a specific folder, depending on content, etc.

[ms-protect-content id=55, 2594]

Individuals and teams can upload or sync existing files to Box, and they can also create and edit documents within Box itself using locally installed editing tools (such as Microsoft Office, Adobe Photoshop) via Box Edit, or via Google Apps. Content can also be created with the new Box Notes tool (a web-based collaborative real-time editor, currently in beta). Box View’s file previewing for web and mobile has been overhauled following the acquisition of Crocodoc HTML 5 conversion and previewing technology in 2013. The new mobile preview compresses the original file prior to sending to a mobile device – reducing bandwidth, and thereby reducing roaming charges for users on the go. It also provides added security over downloading since the files themselves need not leave the enterprise.

In addition to the web client, and Box Sync client for desktops, Box provides native mobile apps for iOS (its January latest release based on technology from Box’s recent acquisition of Folders), Android, Blackberry 10, Windows Phone 7 and 8, and Windows 8 (RT).

When it comes to granularity, files themselves cannot be broken down to extract and exploit content data at a higher granular level (such as pulling out specific cells from a spreadsheet to populate a template, or boilerplate text to add to a sales document). Without such a rich level of extraction capability, Box’s viability as a platform for granular data interchange may still fall short of what its enterprise customers require. However, its metadata capability (in beta) can be used to feed business rules and workflow (in conjunction with Box Policies and Automations on the roadmap). It can also be used to support team workspace-like capabilities such as discussion threads and tasks assignment.

Sharing and access permissions (and email notification) can be applied at the file or the folder level, with enterprise security features including: encryption, content security policies, version history, audit trails, view-only access, deletion and expiration controls; Active Directory integration, single sign-on, two-factor authentication; remote log out and remote wipe, control over ability to save files offline, enforcement of application pin code, device pinning, and a restriction on which third party applications, (and limit on the number of devices) able to access the Box service; Box Embed (which presents Box content in other applications without proliferating multiple copies), applications (based on Box APIs) that open, edit, and re-save content without the need to hold a copy in the app; and hosting compliance (such as SSAE 16 Type 2 SOC1 and SOC2, HIPAA and HITECH, ISO 27001, EU Safe Harbour, UK Government G-Cloud.3). In addition, Mobile Device Management partners provide further device and application security, such as control over cut/copy/paste, open-in, and print for data leakage prevention, and requirement for device encryption.

Who is it for?

Initially positioned as suitable for any size organisation (and indeed Box’s heritage user base consisted mainly of individual professionals, small and medium-sized businesses), the company’s product development, sales, and marketing focus is now firmly set on the enterprise and meeting the increasingly higher expectations of enterprise clients. Box’s mobile strengths mean that use cases don’t just involve traditional executive classes though; they also comprise what the company characterise as the ’new information worker’ – e.g. construction supervisors surveying a site in the field using mobile devices.

While Box is positioned as a horizontal solution, the company has had traction in a number of vertical markets, including construction/architecture, consumer packaged goods, healthcare and life sciences, high tech, legal, manufacturing, media/entertainment, professional services and retail. As noted above, it has a strategy of actively pursuing compliance certification to enhance its credibility in certain verticals such as government and finance. Recent years have seen an intensive geographical expansion program running in parallel with Box’s increased coverage of vertical markets and lines of business (with a declared priority to extend across both dimensions still further during 2014).

Box offers five editions of its solution:

  • Personal is free to use, providing customers with 10GB of storage, and basic file sharing and file name search capabilities, desktop sync for offline access, mobile access, OneCloud apps, SSL encryption, two-factor authentication, office integration and the ability to edit and preview documents (a $10 per month variant increases storage to 100GB).
  • Starter costs $5 per user per month (for one to ten users) with 100GB of pooled storage space, and adds access permissions functionality such as auto-expiration, file locking, access statistics, and a 25 version history.
  • Business costs $15 per user per month (for a minimum of three users) with 1000GB of pooled storage space, and adds device pinning, user management, audit logs, doubles the length of the version history, provides full-text search capabilities, and offers one integration with Box (chosen from Active Directory / Single Sign-On , Salesforce, NetSuite or Jive).
  • Enterprise is priced at $35 per user per month for unlimited storage space, unlimited external collaborators, and adds advanced capabilities including mobile security controls, customised admin roles, granular file and user access statistics, detailed security reporting, custom branding options, custom terms of service, unlimited enterprise integrations, doubling (to 100) of the version history, Box Embed integrations for any applications or websites, and use of the Box reporting API (to pull data into own reporting dashboards), and the Box Content API (for up to three internal apps).
  • Elite (price on application) adds unlimited users, test environments for custom applications, unlimited internal apps, and premier support. It’s targeted at customers who are considering Box as the content platform for building their own custom apps upon, or plan on leveraging Box with a number of existing enterprise applications.

Why is it interesting?

With many employees commonly switching between multiple devices, and a growing need for highly productive mobile collaboration across and between enterprises, customers expect to be able to do more with their content (and do it seamlessly). Box is keen to present its solution as a platform that can underpin a system of engagement which supports just that.

By targeting the space between content management and collaboration – and more particularly in an online, SaaS-based model with the flexibility and cost advantages that this brings – Box has created an interesting niche for itself which has not really been recognised by the broader business software market. While the company is clearly looking to extend its reach, the greatest opportunity for Box has been growing smaller departmental deployments into much larger, enterprise-wide deployments over time – in what the company calls its “land and expand” strategy. This often starts in organisations where teams or departments need some degree of content management, but find even Microsoft SharePoint too complex and inflexible for their needs. Similarly, Box’s support for mobile, as well as for cross-company collaboration, provides a flexibility which many high-end content management tools simply aren’t set up to support.

By fleshing out and strengthening the online storage model – rather than trying to convert on-premise team workspace solutions to a cloud model – Box has captured the interest of business users with the budget, while providing strong enough security to reassure IT departments. At this point an enterprise customer has three options to consider: firstly, whether Box continues simply as the preferred sync and share solution alongside established and well-integrated enterprise applications; secondly, whether in addition, it exploits the company’s OneCloud ‘ecosystem’ of apps to enrich mobile users’ experience; or lastly, whether it invests in placing Box at the heart of an enterprise content collaboration platform – integrating deeply with fundamental enterprise systems like ERP and ECM, and developing / commissioning custom apps of its own.

How established is it?

Box was founded in 2005 by two university students, Aaron Levie and Dylan Smith. As of March 24, 2014 (according to the company’s S-1 regulatory filing for IPO with the US Securities and Exchange Commission), it has 25 million users globally, with 225,000 business customers across 99% of Fortune 500 companies (34,000 paying organisations, including more than 40% of Fortune 500 and 20% of Global 2000 companies) – roughly a four-fold increase in both since MWD Advisors’ 2011 report on Box.

Major clients include Schneider Electric, SUNET, Anglo American, Royal Haskoning DHV, Proctor & Gamble, Gatwick Airport, Hounslow Council, O2 Media, Netflix, Creative Artists Agency (CAA) and Sony Music.

Box now employs around 1,000 people worldwide, with over 90% of the headcount in the company’s Los Altos headquarters, but with a growing presence across EMEA offices in London, Paris and Munich (to be joined shortly by Nordic offices, with expansion into the Asia-Pacific region likely to be next on Box’s list).

Box is a privately-held organisation funded by venture capital, having generated over $400 million in six funding rounds. The latest, in December 2013, raised $100 million from investors including Itochu Technology Ventures, Mitsui & Co, Telefonica Digital, Telstra, Macnica Networks Corp, and DFJ Growth.

Whilst the company’s revenue has continued to grow healthily (more than doubling in each of the last two years, to almost $125 million for the year-ended January 31, 2014), it continues to make a loss (nearly $169 million in the year-ended January 31, 2014, up from $112 million the year before). Box filed for its IPO with the US Securities and Exchange Commission on March 24, 2014, seeking to raise $250 million.

How open is it?

Box provides an open, documented, platform-level API called the Content API, which provides access to the content management features (including metadata) seen in its web app and can be used by developers to provide integration with Box and third-party applications, and to build native apps for mobile platforms. On top of the free developer version, there are three tiers of pricing: Build, Scale, and Transform (depending on usage). There is also a View API in beta which converts PDF and Office documents to HTML 5 for embedding into web and mobile applications; pricing here – Standard, Custom, or Enterprise – is based on the number of conversions and ability to customise. Box also provides SDKs for iOS, Android, Windows and Java; community-built SDKs are available for C#, Ruby and Python. These pricing models, announced in March 2014, provide the means for Box to sell its solution as a platform for development, independent of the number of user seats deployed.

Box also supports integration with on-premise enterprise content management systems via its add-on module, Box Cloud Connect (which includes out-of-the-box integrators for Microsoft SharePoint and Autonomy iManage).

Apps leveraging Box’s APIs for content management can be marketed through the company’s OneCloud ’ecosystem’ for enterprise apps (and these are responsible for nearly 20% of the 5 billion API calls Box handles each month).

Who does it partner with?

To augment Box’s own (mainly file management, content creation, editing and collaboration) apps, it’s the company’s strategy to evolve a very ‘developer-friendly’ platform that encourages third parties to integrate with, and build on, Box. The 35,000 developers Box already boasts not only provide additional takes on file management and sharing, document viewing, editing, note taking, presentations, charts / diagrams, printing, project management, social collaboration, meetings, and forms; they’re also able to extend the company’s mobile and vertical attractiveness by developing apps tuned to specific vertical needs (in healthcare, legal, real estate, and construction, for instance), relying on such specialised third parties’ domain knowledge to serve up what users are likely to require beyond the core Box functionality.

Most of the 1,000+ OneCloud apps are free (with upgrade paths to purchase paid-for editions), and while there is currently no certification, each must go through an application process before being included. For Box’s enterprise customers, these are of course in addition to whatever apps their own in-house IT teams or systems integrators may develop with the Box SDKs and APIs.

Box has developed technology partnerships with a range of vendors for mobile device management (e.g. Mobile Iron, Good Technology, Aruba, Samsung KNOX, Enterproid), identity and access Management, single sign-on (e.g. Okta, OneLogin, Ping Federate, Salesforce Identity), productivity tools (e.g. Microsoft Office, Google Apps), enterprise social networks (e.g. Jive, tibbr, Chatter, IBM Connections), enterprise content management (e.g. SharePoint, iManage), ediscovery / archiving (e.g. Guidance, LiveOffice), data loss prevention (e.g. Skyhigh Networks, CipherCloud, Code Green Networks), and CRM, Financials and ERP (e.g. Salesforce, NetSuite).

It has over 600 Certified Resellers and Solution Providers, including CDW, Insight, Ingram Micro, Soft Choice, Carahsoft, Nexus IS, and SHI International. In addition, the company has strategic agreements with the following partners for resale or distribution of Box: AT&T, Comcast Business Services, Deutsche Telekom, Everything Everywhere, AppDirect, Parallels, LG, Blackberry, OpenPeak, Divide, Aruba, and HP.

Box’s channel partner program is designed to help accelerate its growth into new industries and global markets (since core headcount is still relatively small, globally) and while the model is still primarily direct sale, re-sellers and service providers are seen as an important part of its future.

Are there areas for improvement?

While Box has evolved into much more than just an online storage service, there are still a number of opportunities for the vendor to develop and enhance its platform. One of the main areas for improvement relates to its support for a more people-centric form of collaboration, enabled through social technologies. Though once a standalone block on Box’s indicative product roadmaps, and despite the presence of basic commentary and task assignment capabilities, today Box does not see itself as a ‘social’ platform and has instead chosen to rely on partnerships with others (such as Jive, Chatter, tibbr, and IBM Connections) to provide the full gamut of what its customers might expect in that sphere. The drawback here is that for that ‘full social experience’ around their content, Box customers have to buy more than just Box – and while some may already have made that investment anyway, others will have to rely solely on the rudimentary features included in the standard Box offering.

Discussions, comments, and tasks are fairly pervasive throughout the service; however, more could be done to improve usability and accessibility of these. For example it’s not possible to start a discussion without first navigating to the folder or document concerned, and tagging activity is not tracked, While this may be adequate for small organisations, in larger ones it would become unwieldy as the number of participants or concurrent projects increases. Some of Box’s recent announcements of new features with metadata (currently in Beta, due for general release later in 2014), and policies and automation (generally available now for Enterprise and Elite customers) may go some way towards helping here. Of course large organisations with a platform level investment in Box could leverage its API to design in its own custom capabilities, but none of that would be ‘out-of-the-box’.

Box’s user profiles feature could also be leveraged more effectively with some social networking or people search capabilities, for example. There is little support for enabling information discovery through people recommendations, to highlight opportunities for reuse or to minimise duplication of effort – though future integration with dLoop’s recommender engine may go some way towards improving this.

Another area that would benefit from investment is tighter integration with Microsoft Office tools. While Box for Office does add a ‘Save to Box’ button on the ribbon in Word, Excel and PowerPoint 2013, at present it doesn’t add Box to the list of ‘Save as’ places (that’s still hard-wired to local drives, SharePoint or OneDrive – Microsoft’s own cloud-based sync and share competitor), though, according to Box, this is on the roadmap for future release.

While Box’s strategy of providing ‘good enough’ levels of coverage in some functional areas (relying instead on an extensive ecosystem of partners to plug the gaps and flesh out with more extensive capabilities) covers many bases adequately, it does a) bank on customers being willing and able to integrate further third parties into their platform solution, and b) risks Box missing a trick in bringing certain capabilities in house more properly under a Box badge. The company has chosen to enrich through acquisition in some areas (for example, Crocodoc’s HTML 5 preview and dLoop’s content discovery technologies), but for the most part is partner-reliant outside of core capabilities. How much that ‘core’ grows, and where it moves (to anticipate and satisfy what perceived requirements) over time might give some indication of the direction Box is going in – and the shape it wants to carve its niche out into in the longer run.

What’s next?

Box has used recent funding injections to build out its organisational structure to support a growing global business customer base, and add a credible global enterprise sales and support focus. From a technology standpoint, it plans to continue investing in the service as a whole, maintaining its focus on simplicity, the user experience, and mobile support. Specifically for 2014 the company has some beta features to roll out for general availability (such as metadata and Box Notes) and content discovery capabilities born of its acquisition of dLoop technology (combining information from social graphs, frequently accessed files, and advanced data classification to help users pinpoint hard-to-find content) to work up and release.

It is also building a capability, through an extensive ecosystem of third-party developers and systems integrators, to perform as a content platform for other enterprise applications. Although granularity may be an issue for customers needing to extract atoms of content to drive their business rules, derive actionable insight from content intelligence, or generate new content assets, Box claims these concerns are already on its radar, and moves to address them on its roadmap for future releases (beyond what working with metadata can do for now).

As well-developed as Box’s play has already become, it has now set its sights on a bigger prize – much deeper content collaboration platform integration, potentially bringing with it much fatter margins and a much more secure place at the heart of enterprise IT. The company’s aspiration is to provide a platform that not only disrupts the ECM space, but also disrupts working paradigms across the enterprise – encouraging agile new knowledge workers to collaborate anywhere, anytime, and on any device. Box is confident it can deliver this capability in spades (whether through the 1000+ apps in its OneCloud ecosystem, by way of tight integrations through enterprise application connectors, or via its partner ecosystem). The proof however will be in just how well connected Box can become.

Should I consider it?

As Box continues to carve out a credible position as an enterprise-friendly content storage and collaboration service that really understands the needs of mobile knowledge workers, its solution should be of interest to anyone needing a simple, low-cost way not only to sync and share content, but also work collaboratively with disparate colleagues and partners (either as an extension to existing content management solutions, or perhaps as an alternative to SharePoint).

Looking beyond its current capabilities, Box has broader ambitions to embed itself in the heart of the enterprise, and become the smart content collaboration platform through which all information flows and with which all applications have to do business. There are early signs that some of its enterprises are indeed starting down that road (with their own suites of custom apps to prove it). However, to truly meet enterprise customers’ expectations, Box will need to build more on its nascent metadata, business rules, and content intelligence capabilities so users can perform fine-grained work on their content and build rich social conversations around it. At present customers are forced to look elsewhere for rich functionality in those areas and may consider carefully the cost of integrating Box with what they currently have (if that already does a ‘good enough’ job on the file sharing front) – and it may not have long before deep-pocketed competitors start to commoditise comparable sync and share capabilities into features of their own platforms