Q39
Are you PCI DSS compliant? At what level?
PCI DSS compliance claim found on trust page (Vendor attested)
Public evidencemedium confidence
Dropbox Vendor Risk & Security Assessment
ThirdProof independently checks public intelligence sources to show what your team can verify about Dropbox before Dropbox sends a questionnaire or a security document.
Dropbox's SOC 2 report is confidential. There is no public registry for SOC 2, so the report itself has to come from Dropbox — ThirdProof does not hold or distribute it. What this page gives you is an independent assessment built from evidence anyone can check, and a record of which certifications are registry-verified versus claimed on Dropbox's own trust page.
⚠ Dropbox was not found in the FedRAMP Marketplace. Checked August 2026.
This matters if you place federal workloads with this vendor: agencies may only use cloud services holding a FedRAMP certification. It carries no weight for a purely commercial deployment.
Risk
Tier 3 — Moderate RiskEvidence confidence
100%26 of 27 sources returned data
Questionnaire
91 / 133 answered68% from public evidence
Last assessed
Aug 27, 2026Evidence confidence measures how much of the evidence ThirdProof set out to gather it was able to gather and corroborate. It is not a statement that every fact about this vendor is known.
🟢IP Reputation: Abuse score: 0%, 0 reports🟡SSL/TLS: TLSv1.3🟢Domain Age: 31.2 years🟢Infrastructure: 2 open ports, 0 CVEs
- FedRAMP Status
- Dropbox is not listed on the FedRAMP Marketplace (checked August 2026).
- SOC 2 Status
- Dropbox — SOC 2: Vendor attested — trust page. SOC 2 reports are confidential with no public registry, so compliance status is not publicly verifiable. Request the full Type II report and bridge letter directly from the vendor.
- Sanctions Screening
- Dropbox returned no matches in OFAC SDN, EU Consolidated, and UN sanctions screening.
- Risk Tier
- ThirdProof assigned Dropbox a Moderate Risk tier across 27 intelligence sources, 26 of which returned usable evidence (evidence confidence 100%).
27 sources queried, 26 returning usable evidence. The Dropbox assessment ThirdProof has already run covers both a risk report and an auto-filled security questionnaire, with anything the evidence could not settle listed as an open question.
Get the Latest Dropbox Vendor Assessment →Full risk assessment + 133-question security questionnaire|Free · Delivered by email
Certification & Compliance Status
Security questionnaire — auto-filled
91 questions answered before Dropbox responds.
ThirdProof used public evidence to pre-fill 68% of a 133-question vendor security questionnaire — without waiting for Dropbox. The remaining 42 are listed as open, so the follow-up you send is short and specific.
Q37
Do you have a current SOC 2 Type II report?
SOC 2 Type II: Vendor attested — trust page
Public evidencemedium confidence
Q42
Are you GDPR compliant? Do you have a DPA available?
GDPR compliance / DPA claim found on trust page (Vendor attested)
Public evidencemedium confidence
Q40
Are you HIPAA compliant? Do you sign BAAs?
HIPAA compliance / BAA claim found on trust page (Vendor attested)
Public evidencemedium confidence
Q23
Is data encrypted at rest? What encryption standard is used (e.g., AES-256)?
Dropbox files at rest are encrypted using 256-bit Advanced Encryption Standard (AES), which is confirmed across multiple official sources.
Public evidencehigh confidence
+ 86 additional evidence-backed answers
Get the Complete Dropbox Assessment →
See all 133 questions, evidence links, findings, and the vendor follow-ups still required.
What you can verify before Dropbox sends anything
Independent evidence settles part of the review. The rest still needs the vendor.
Public evidence establishes
- No Sanctions Matches Found
- No SEC Enforcement Filings Found
- Legal Entity Actively Registered
- Clean domain reputation
- Clean Safe Browsing Status
Still requires vendor confirmation
- Current SOC 2 report and its audit scope
- Access Control — 8 of 12 questions need vendor input
- Incident Response — 5 of 10 questions need vendor input
- Network & Infrastructure — 5 of 14 questions need vendor input
- Data Security — 4 of 14 questions need vendor input
Reviewing Dropbox for your company?
Get the complete ThirdProof assessment now, then use the same workflow to assess the rest of your vendor stack.
5 vendors free · No credit card
Need ongoing vendor reviews? ThirdProof includes up to 50 vendor assessments per month for $399. See pricing
Executive Summary
Narrative analysis for Dropbox
Dropbox is a mature, established SaaS file storage and collaboration platform operating at significant scale with strong positive security fundamentals.
Area Requiring Attention
The company demonstrates comprehensive security controls including encryption (AES-256 at rest, TLS 1.3 in transit), robust identity and access management, redundant multi-region infrastructure with 99.9% uptime SLA, and extensive compliance certifications claimed on their trust pages. Strengths include: a 31-year domain history with enterprise-grade infrastructure, clean threat reputation (no malware blacklist presence), a dedicated security team responsible for protecting ~1 exabyte of data across half a billion users, annual security awareness programs (Trustober), formal incident response procedures with GDPR-compliant 72-hour breach notification, third-party penetration testing, and published Data Processing Agreements supporting GDPR and other regulations.
The full risk rationale, every finding and the recommended vendor follow-ups are in the complete assessment below.
Independence Statement
All evidence presented in this report was independently sourced from external data repositories, public registries, domain analysis, threat intelligence, and archived media without participation or validation from Dropbox.
Investigation Findings
4 findings identified for Dropbox
1 high1 medium2 low
high
Significant adverse media in historical archives
Historical media archives contain references to Dropbox data breaches and security concerns. The primary article identified is from Cloudwards.net (July 2026, 29 days old) focusing on data breaches and alternatives. …
medium
AI model training requires customer opt-out
Dropbox's [AI data usage policy](https://www.dropbox.com/privacy) requires customers to actively opt out of AI model training rather than opting in by default. The policy indicates training commitment is 'opt_out' — meaning customer data may be used to train AI models unless the customer explicitly disables this. …
low
Subprocessor list could not be parsed
A subprocessor page exists at https://trust.dropbox.com/subprocessors but automated parsing could not extract individual subprocessor entries. The page may use a non-standard format (JavaScript-rendered, iframe-embedded, PDF, or proprietary layout). …
low
9 certifications claimed but not independently verified
Nine certifications are claimed on Dropbox's [trust pages](https://trust.dropbox.com/) (SOC 1, HIPAA, GDPR, CCPA, SOC 2, ISO 27001, ISO 27017, ISO 27018, PCI DSS) but could not be independently verified through public certification registries (FedRAMP Marketplace, HITRUST Directory, IAF CertSearch, PCI Council registry). The trust page likely includes downloadable certificate documents, but those are vendor-attested evidence. …
Showing the 4 most severe of 5 findings.
✓
Security Strengths
Evidence that positively supports Dropbox's posture
Neutral observations, source coverage notes and items ThirdProof could not independently establish are recorded separately in the complete assessment — they are not counted as strengths.
✓
No Sanctions Matches Found
Sanctions & Watchlist Screening →✓
No SEC Enforcement Filings Found
SEC Filing Search →✓
Legal Entity Actively Registered
Business Registration →✓
Clean domain reputation
Threat Intelligence →✓
Clean Safe Browsing Status
Malware & Phishing Check →✓
Clean Website Security Scan
Website Security Scan →✓
Clean IP Reputation
IP Reputation →Dropbox complete vendor assessment
Tier 3
Moderate Risk
91 / 133
questionnaire answers
27
sources checked
Aug 27, 2026
assessment date
- Complete 133-question security questionnaire
- Evidence behind every answered item
- Full findings and risk rationale
- Recommended vendor follow-ups
- Source and evidence inventory
- Source-cited PDF assessment
Risk tiers are set by a deterministic rules engine. AI summarises sourced evidence and writes the narrative; it does not assign the tier. Read the full methodology.
Dropbox FedRAMP Authorization Status
Dropbox is not listed on the FedRAMP Marketplace and has not pursued FedRAMP authorization. Dropbox maintains SOC 2 Type II, ISO 27001, ISO 27017, and ISO 27018 certifications, along with HIPAA and PCI DSS compliance claims. For organizations with federal compliance requirements, FedRAMP-authorized alternatives include Box (Moderate impact level). ThirdProof's assessment independently verifies Dropbox's claimed certifications and assesses whether the vendor's security controls meet your compliance framework requirements.
Dropbox Security Posture
ThirdProof investigated Dropbox across 27 intelligence sources. Sanctions screening returned clear with no OFAC, EU, or UN matches. Domain reputation is clean across 93 security engines with an A+ SSL/TLS grade. Historical adverse media was flagged in archived sources — organizations should review the full report for details on past security incidents and assess current remediation posture.
Compliance Resources
→ HIPAA Vendor Risk Assessment with ThirdProof→ CMMC Level 2 Supply Chain Risk Assessment→ ABA Model Rule 1.6 Vendor Due Diligence for Law Firms→ FedRAMP Authorized Vendor List→ FedRAMP Vendor Authorization Status Guide→ Sanctions Screening for Vendor Due Diligence→ Vendor Due Diligence Checklist→ All 27 Intelligence Sources
Frequently asked about Dropbox
Is Dropbox FedRAMP authorized?+
Dropbox was not found in the FedRAMP Marketplace when it was checked on August 27, 2026. Absence of a public record is not evidence that the certification is absent; organisations with a hard requirement should confirm directly with the vendor.
Does Dropbox have SOC 2 Type II?+
Dropbox states that it maintains SOC 2 on its trust page. Because SOC 2 reports are generally confidential and there is no public SOC 2 registry, ThirdProof classifies this as vendor-attested until the current report and its scope have been reviewed. Request the report directly to confirm the audit period and which systems are in scope.
Is Dropbox on the OFAC sanctions list?+
Dropbox returned no matches in ThirdProof's OFAC SDN, EU Consolidated, and UN sanctions screening as of August 2026.
What is Dropbox's vendor risk tier?+
ThirdProof assigned Dropbox a risk tier of Moderate Risk as of August 2026, with an evidence confidence of 100% across 27 intelligence sources. Evidence confidence describes how much of the evidence ThirdProof set out to gather it was able to gather — not certainty about every fact concerning Dropbox.
Has Dropbox had any data breaches or security incidents?+
ThirdProof's assessment as of August 2026 records 1 incident-related finding for Dropbox, of which 1 is rated high severity or above. The most severe concerns significant adverse media in historical archives. Each finding states whether the incident affected Dropbox's own systems, a customer's environment, or a third party — a distinction that changes what you should ask about — and links to the source it was drawn from. The complete assessment carries all of them with their evidence.
Is Dropbox PCI DSS compliant?+
PCI DSS compliance claim found on trust page (Vendor attested) ThirdProof records this from Dropbox's published compliance evidence; request the current Attestation of Compliance to confirm the scope that applies to your integration.
Does Dropbox support HIPAA and sign BAAs?+
HIPAA compliance / BAA claim found on trust page (Vendor attested) If protected health information is in scope for your use, confirm BAA availability in writing before contracting.
Can ThirdProof pre-fill a Dropbox security questionnaire?+
Yes. ThirdProof answered 91 of 133 questions (68%) about Dropbox from public evidence, before contacting the vendor. Each answered item carries the evidence it was drawn from. The remaining 42 are listed as open, so the follow-up you send Dropbox is short and specific.
Also investigate these vendors
Represent Dropbox? Submit updated security evidence.
If Dropbox is in your vendor stack, can you prove you assessed them?
SOC 2 CC9.2, HIPAA, PCI DSS and CMMC all require documented vendor due diligence — not just knowing the answer, but holding evidence that you verified it. The Dropbox assessment above is already written; ask for it and it lands in your inbox.
✓ This assessment: free, no account required✓ Your first 5 vendor investigations are free✓ No credit card required