ZapBounce

ZapBounce and Box

Box is chosen by organizations that care about governance: retention policies, classifications, audit trails on every file access.

A verification job on a file in Box should respect the same rules the file does, and our retention setting is the control that makes that possible.

A governed file processed by an ungoverned service

A file classified as restricted in Box, with a retention policy and an access log, does not stop being restricted when its contents are sent to a third-party API.

If that third party holds the data for thirty days by default, your retention policy has quietly been extended by thirty days in a system your audit does not cover.

Setting retention to zero on the key used for those files means results are deleted once downloaded, which is the setting that lets the classification hold.

How the data moves

  1. Match the retention setting to the file's classification

    Zero for restricted data. It is a per-key setting, so one key per classification level is a reasonable arrangement.

  2. Read through the Box API with a service account

    So the access appears in Box's audit log like any other access.

  3. Write results back into Box with the same classification

    The results file contains the same addresses and deserves the same treatment.

  4. Record the batch id in your own audit trail

    So a later question about what was processed has an answer that does not depend on our records.

Setting it up

  1. Create a separate API key for restricted-data work and set its retention to zero.
  2. Read files through the Box API with a service account so access is logged.
  3. Verify and download results immediately, since zero retention means there is no second chance.
  4. Upload the results file to Box with the same classification as the source.
  5. Record the batch id and date in your own processing log.
  6. Review the arrangement with whoever owns the classification policy before the first run.

Box: common questions

How do I keep a restricted file restricted?

Use a key with retention set to zero, download the results immediately, and classify the results file the same as the source.

Can I re-download results later?

Not at zero retention. That is the trade, and it is why the download has to be part of the job.

Does verification need a processing agreement?

For governed data, ask before the first run. It is a shorter conversation than an audit finding.

Reference

Check a Box export today

100 free checks a month, no card. Unknown results and duplicates are never billed.

Get an API keySee pricing