Open-source alternatives to Box: Nextcloud and Collabora

Which open-source option replaces Box, and why teams look for one

For most Box workloads, Nextcloud Hub with Collabora Online is the stronger starting point: it covers file storage, sharing links, permissions and in-browser editing of Microsoft formats such as .docx, .xlsx and .pptx in one self-hosted stack. Teams that need a broader office and collaboration suite, including calendar, mail and groupware alongside documents, should evaluate openDesk or OX App Suite instead. The choice depends less on feature checklists than on which of your users only store and share files and which also need the surrounding suite, so map your Box usage by workload before you pick a platform. The usual triggers are a contract renewal, a licensing or pricing change, a data residency requirement that the current hosting region cannot meet, or a growing concern about lock-in to one vendor's export formats and APIs. Each of these is a reason to model the exit cost early, not only the license line. Box's own documentation describes its FTPS and SFTP interfaces as intended for bulk migration and occasional bulk download, and it caps files transferred over FTPS at 32 GB, so large estates will need to plan transfers in batches. Confirm current Box plan eligibility for these protocols, and the file size limit, with Box before scheduling any extraction.

Before you commit, confirm three things in your own environment: where your data must physically reside, which Box features your teams depend on (such as shared link expiry, watermarking or legal hold, which you should verify against Nextcloud's current apps rather than assume), and whether you will self-host Nextcloud in your own cloud account or use a managed option. Nextcloud GmbH's pricing page describes Standard, Premium and Ultimate subscriptions for support and additional features, and Nextcloud One for organizations under 100 users, so ask which tier covers the support and feature set you need. Ask your implementation partner for a written scope that names the permission model, retention settings and extraction method for your Box tenant.

Open-source options that cover Box use cases

Box covers file storage, sharing, document editing and governance in one service. The open-source options below split those jobs across a file platform, a document editor and, for some organizations, a full office suite. Each card covers one component and what to check before you commit to it.

Nextcloud Hub as the content layer

Nextcloud Hub holds the files, folder structure, sharing links, user and group access and sync clients that replace Box's core repository. It is licensed under the AGPL and is free to self-host, so the license cost is zero and the recurring cost is your infrastructure, storage and staff time. Nextcloud GmbH sells Standard, Premium and Ultimate enterprise subscriptions for support and additional features, and Nextcloud One for managed hosting for organizations under 100 users. Check which Box governance features (retention, legal holds, audit logs, device controls) your deployment needs and confirm which are included in the core product and which sit in an enterprise tier.

Collabora Online for document editing

Collabora Online provides browser-based editing for ODF and Microsoft formats, including .docx, .xlsx and .pptx, and integrates with Nextcloud. It is licensed under the Mozilla Public License 2.0. CODE is the free development edition, while the paid enterprise edition adds support, SLAs and signed security updates. Production use for a regulated organization usually means the enterprise edition, so ask for the support scope in writing. Test complex Office documents, macros and co-authoring with real files from your Box estate before setting user expectations.

openDesk for a full office suite

openDesk is an office and collaboration suite built for public administration and managed by ZenDiS, the German federal Centre for Digital Sovereignty. It is deployed to Kubernetes with Helmfile and Helm charts, with both a Community and an Enterprise Edition, and the deployment repository is licensed under Apache 2.0. It fits organizations that want file storage, documents and collaboration delivered as one platform, and that have Kubernetes operations skills. The trade-off is operational weight: you take on cluster, identity and component upgrades, and you should confirm that the feature set matches the Box capabilities you actually use.

OX App Suite for on-premises or managed hosting

OX App Suite from Open-Xchange provides email, calendar, documents, drive and tasks, and can run on premises, in a public cloud or as the managed OX Cloud service. Dovecot is part of the Open-Xchange product line. It fits organizations that want a suite with a commercial vendor behind it and the option of managed hosting, while keeping data in their own environment. Confirm whether its drive and document features cover your Box sharing and version needs, and compare licensing and support terms with the Nextcloud enterprise tiers before deciding.

How Box capabilities map to open-source options

This table compares the main Box capabilities with what Nextcloud and Collabora Online provide out of the box, and where an app, a third-party component or a vendor confirmation is needed. Read each row as a planning question: covered means the capability is native, partial means it exists but needs configuration or add-ons, and confirm-with-vendor means the exact behavior must be verified against the version you deploy.

Box capability	Nextcloud and Collabora Online	Status and what to check
Shared links	Public share links with optional password, expiry and download restrictions	Covered. Confirm link policies match your Box settings before migration.
Folder permissions	Group folders and share permissions per user or group, with access rules via apps	Partial. Box collaboration roles must be mapped by hand to Nextcloud permission levels.
Collaborative editing	Collabora Online edits .docx, .xlsx, .pptx and ODF files within the browser	Partial. Test complex Office layouts, macros and tracked changes against real documents.
Sync clients	Desktop and mobile sync clients for Windows, macOS, Linux, iOS and Android	Covered. Validate selective sync and large-folder behavior for your user profiles.
Version history	File versioning with restore, retention controlled by server settings	Partial. Confirm version retention limits meet your Box policy before cutover.
External collaborators	Guest accounts and external shares, governed by admin settings	Partial. Confirm how external users are onboarded and offboarded in your identity system.
Admin reporting	Activity and audit logging through built-in and optional apps	Partial. Confirm the log fields and export formats your SIEM requires.
Retention and legal hold	Retention policies available through apps, not a native legal hold feature	Confirm with vendor. Verify hold, immutability and eDiscovery needs in the current release.
E-signature and Box integrations	Third-party apps and API connectors; no direct Box connector assumed	Confirm with vendor. Inventory every Box integration and check each one for a Nextcloud equivalent.

What you give up and the usual workarounds

Moving from Box to self-hosted Nextcloud and Collabora Online trades vendor-run services for components you operate yourselves. The cards below cover the gaps most often raised in reviews, the workaround that usually closes each one, and what to verify in your own environment before committing to a cutover date.

Box integrations and marketplace apps

Box has a catalog of third-party connectors that many teams take for granted, from workflow tools to line-of-business systems. Nextcloud has its own app store and a documented API, but coverage for your specific connectors is not guaranteed. Inventory every integration that reads from or writes to Box, then check whether a Nextcloud app or a custom API connector exists for each one. Budget for custom integration work where it does not.

Box Shield and content classification

Box offers threat detection and classification features that scan and label content. Nextcloud provides file tagging, access controls and some auditing, but you should not assume equivalent malware scanning or automated classification. Confirm with your security team which Box Shield controls are mandatory, then decide whether to add an antivirus or data loss prevention layer on the Nextcloud side, or accept a documented gap with compensating manual review.

Retention and governance depth

Box retention policies, legal holds and governance reporting are mature and tied to e-discovery workflows. Nextcloud can enforce retention through its own tooling and auditing, but depth varies by app and version. Map each Box retention rule to a Nextcloud setting, a scheduled job or a documented manual procedure. Ask an independent auditor or your legal team to confirm that legal hold behavior meets your obligations before you retire Box.

Vendor-run uptime and support SLAs

With Box, Box operates the service and commits to availability. Self-hosting moves uptime, patching and incident response onto your team or your implementation partner. Nextcloud GmbH sells enterprise subscriptions that include support, and Collabora sells an enterprise edition with support and SLAs. Decide whether you need a support contract for each component, and write the response times and maintenance windows into the contract rather than assuming them.

Admin tooling and reporting

Box admin consoles provide user lifecycle, device controls and usage reports out of the box. Nextcloud has an admin interface and audit logging, but reports, provisioning hooks and alerting usually need configuration or a log pipeline. Confirm which reports your compliance team needs, such as access by user or external sharing activity, and test that the Nextcloud logs can produce them. Feeding logs to a SIEM is a common workaround, and it adds ingestion and storage costs.

How to export bulk content out of Box with FTPS

Box supports FTPS and SFTP for Business and Enterprise customers, and Box positions these protocols for bulk migration and occasional bulk download. Before any transfer starts, build an inventory of what sits in the tenant: folder tree, file counts per folder, total size, and the largest individual files. Box limits files transferred over FTPS to 32 GB, so any file above that threshold needs a different route or a manual check. Record the inventory in a spreadsheet or a small script output that you can compare against the destination later. Confirm with your Box account team and the current Box FTP support article whether FTPS or SFTP is enabled for your enterprise, which admin role can turn it on, and which user accounts are permitted to connect.

Split the transfer by top-level folder or by business unit rather than pulling the whole tenant in one session. Smaller batches make failures easier to isolate and retry, and they let you map each batch to a target folder in Nextcloud before the data lands. Keep the original folder paths intact in the batch plan so that permissions can be mapped against the same structure. Check the admin settings that govern external access, including allowed protocols and any IP or device restrictions, before scheduling batches. Ask Box in writing which limits apply to concurrent connections and session length for your plan, because those values are not something this page can state.

After each batch, verify the transfer rather than assuming it succeeded. Compare file counts and total byte sizes per folder against the inventory, then compute checksums such as SHA-256 on both the exported copy and the Nextcloud target for a sample or for the full batch, and log any mismatch. Store the manifest, hash list and error log with the migration record, since these are the evidence that governance and retention reviewers will ask for. Note that Box file metadata, comments and version history are not carried by a plain file transfer, so decide in advance which of these you must preserve and confirm how Box exposes them before you rely on the export.

How the Box to Nextcloud migration runs in phases

The sequence moves content out of Box in controlled stages, so each group of users is verified on Nextcloud before Box is switched off. Each phase closes with a written check, so the client knows what is finished before the next phase starts.

Inventory Box content, users and sharing
Start by listing what exists in Box: folders, file counts and sizes, owners, groups, external collaborators and shared links. The client provides admin access to Box, the list of business owners for key folders, and any retention or legal hold requirements that apply to content. DeployOpen documents the inventory in the agreed scope. The phase is complete when the client signs off the inventory and the list of content that must move, including what can be archived instead.
Export content over FTPS in bulk
Box supports FTPS and SFTP for Business and Enterprise customers, positioned for bulk migration and occasional bulk download, with a 32 GB limit per file transferred over FTPS. The client confirms the account and the service is enabled for its plan, and the team exports content in batches sized to fit that limit. The phase closes with a checksum or file count comparison between the export and the inventory, so gaps are found before any data is loaded into Nextcloud.
Map permissions to Nextcloud groups and shares
Box roles, collaborators and shared links are translated into Nextcloud groups, folder shares and link settings. The client supplies the directory source, such as LDAP or an identity provider, and approves the mapping for each business area. Mappings that do not translate cleanly are listed for a decision. The phase is complete when the client approves a written permissions map that covers every folder in scope.
Run a pilot with one user group
A single business group loads its content into Nextcloud and works in it for normal tasks, including document editing through Collabora Online where it is deployed. The client picks the pilot group and the people who will report problems. DeployOpen tracks sync issues, missing shares and permission gaps. The phase closes when the pilot group and the client agree that the content, shares and editing workflow match the inventory.
Run Box and Nextcloud in parallel
Remaining groups move in waves while Box stays readable, so users can check content before they depend on the new system. The client sets the rule for which system is the record during this period and tells users where to save new work. The team reconciles file counts and recent changes between the two systems on a schedule the client agrees. The phase is complete when reconciliation shows no unexplained differences for the last agreed period.
Cut over with DNS and client changes
The Nextcloud hostname is pointed to the production service, desktop and mobile clients are updated, and shared links or bookmarks are reissued where needed. The client manages DNS, the desktop client rollout, and the communication to users. DeployOpen supports the change window and watches authentication and sync errors. The cutover is complete when the agreed users can sign in, sync and open shared content from Nextcloud and Box is set to read-only.
Decommission Box after the retention period
Once the retention period set by the client and its legal team has passed, Box access is removed and the final export is kept in the archive location the client chose. The client confirms the retention length, the contract end date with Box, and the records that must be preserved. DeployOpen documents the final state. The phase closes with written confirmation that the archive was verified and that Box access has been removed.

Mapping Box permissions and governance to Nextcloud

Start by mapping Box collaborators to Nextcloud identities before any content moves. Box folder collaborators, shared links and their roles (viewer, editor, uploader and similar) need a target in Nextcloud: named users from your directory, groups for teams and departments, and folder shares that carry read, edit or share rights. The main mapping risk is flattening Box's per-folder grants into broad group shares, which quietly widens access. Export a list of folders with their collaborators and link settings from Box admin reporting, then decide for each folder whether it becomes a group share, a user share or a team folder with group-level rules. Shared links that were open to anyone need a separate decision, since Nextcloud's public link options, expiry and password settings must be set deliberately rather than copied across.

Governance features are where Box and Nextcloud differ most in practice, so treat each one as a feature to verify rather than an assumed equivalent. Retention, legal hold, audit logging and content classification depend on the Nextcloud Hub release and on the apps you choose, so confirm each against the Hub 25 Autumn release notes (released September 27, 2025) and the exact app versions in your test environment. Ask whether retention rules apply to deleted and versioned files, whether a legal hold can freeze content regardless of user action, whether audit logs record sharing changes and downloads, and where those logs are stored. Document the answers in a control matrix. DeployOpen can prepare these controls, configuration and evidence for your compliance assessment, but independent auditors issue any audit report or attestation.

Which option fits by situation

Data residency is the most common reason to move content out of a multi-tenant SaaS service. Nextcloud Hub is licensed under the AGPL and can be self-hosted in your own data center, a cloud account you control, or an air-gapped network, so the storage location is set by you. Collabora Online, licensed under the Mozilla Public License 2.0, can run alongside it to edit documents in the browser without sending files to a third-party editor. Confirm the following before you commit:

Storage location: Confirm where Nextcloud data, the database and backups will physically reside, including any object storage backend.
Editing path: Confirm that Collabora Online runs inside the same boundary as Nextcloud, since document content passes through it.
Sub-processors: Ask any managed or hosted provider you consider for a written list of where data and logs are processed.
Access paths: Confirm which administrators, support staff and integration accounts can reach the server.

Trade-off: residency control shifts operations, patching and backup responsibility onto your team or a services partner. Ask your DeployOpen scope to name who owns each of these tasks.

What buyers ask before moving off Box

What drives the cost of moving off Box to Nextcloud?

The biggest cost drivers are the volume and structure of content, the number of users and external shares, the permission model you need to reproduce, and how much integration work sits around Box, such asapps, workflows and single sign-on. Nextcloud Hub is licensed under the AGPL and is free to self-host, so the recurring costs are infrastructure, storage, backups, and any support you choose to buy. Nextcloud GmbH sells Standard, Premium and Ultimate enterprise subscriptions for support and additional features, plus Nextcloud One managed hosting for organizations under 100 users. Ask any provider for a quote that separates one-time migration work from recurring support and hosting.

How long does a Box to self-hosted migration usually take?

The duration depends on total data volume, the number of accounts and shared folders, how many permission rules must be mapped, and how much testing your users require before cutover. Bulk transfer time depends on your bandwidth and the size of the export, so measure a representative sample before you commit to a schedule. Your engagement scope should list the phases, the cutover window and the parallel-run period in writing. Ask for those dates in the statement of work rather than relying on a general estimate.

What does my team need to provide for the migration?

Your team needs to name business owners for each content area, confirm which users, groups and external collaborators should keep access, and approve the permission mapping before data moves. You also need a target environment in your own cloud account, data center or air-gapped network, with identity integration, backup storage and certificates available. Someone must own the decision on retention periods and legal holds, since those cannot be inferred from the files alone. Budget internal time for user acceptance testing and communication to staff.

Can our own IT staff run this migration without outside help?

Yes, if you have engineers who can operate Nextcloud, Collabora Online, your identity provider and backup tooling, and who can script a bulk export and import. The work is less about the copy itself than about permissions, shared links, version history and user communication, which often take longer than expected. Many teams split the work: internal staff handle access reviews and user change management, while an implementation partner handles deployment, hardening and the migration tooling. DeployOpen plans, implements, integrates, hardens, backs up and documents self-hosted platforms in your environment under a fixed scope agreed in writing.

What are the file size limits when exporting from Box over FTPS?

Box supports FTPS and SFTP for Business and Enterprise customers and describes FTPS as intended for bulk migration and occasional bulk download. Files transferred over FTPS are limited to 32 GB each, so very large files need a separate plan, such as splitting them, exporting them through another route, or confirming their handling with Box support. Check the current limits and account eligibility in Box's documentation before you rely on them. Test the export with your largest and most nested folders early, since the limit affects the design of the transfer more than the total data volume.

Which Nextcloud license should we choose for an enterprise deployment?

Nextcloud Hub is licensed under the AGPL and is free to self-host, so the license does not charge you for the software itself. The choice is about support, service levels and additional features, which Nextcloud GmbH sells as Standard, Premium and Ultimate enterprise subscriptions. Nextcloud One is a managed hosting option for organizations under 100 users. Compare the subscription tiers on the pricing page against your support hours, compliance needs and whether you have internal staff to run the platform. Confirm the terms and any feature differences directly with Nextcloud before you sign.

What happens to our Box data after cutover?

After cutover, Box should be kept read-only for a defined period so users can verify content and you can resolve any missing items. Your retention, legal hold and audit obligations still apply to the data in Box, so decide with your legal and compliance teams how long it stays and how it is finally deleted or archived. Confirm with Box how your contract and data deletion terms apply at the end of the subscription. Keep a verified, documented copy of the exported data and the permission mapping as evidence of the migration.

Does moving off Box mean we also need to replace our editing tools?

Not necessarily, but Office files will need an editor. Collabora Online is licensed under the Mozilla Public License 2.0 and edits ODF and Microsoft formats including .docx, .xlsx and .pptx, and it integrates with Nextcloud. Test your most common document types with real users, since macros, complex formatting and embedded objects often show differences. The free CODE edition is for development, so for production use confirm which Collabora Online edition and support level you need.

How DeployOpen scopes, migrates and supports the replacement

DeployOpen plans, implements, integrates, hardens, backs up, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For a Box replacement, that means agreeing a written scope for Nextcloud, Collabora Online and the migration path before any content moves.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
The written scope lists which Box folders, users, groups and sharing links are in and out of the migration.
We record which Box retention, legal hold and governance settings must be rebuilt, and which your team must confirm.
A quote follows from the written scope, so ask for each component to be priced separately.

How we build

We deploy Nextcloud Hub and Collabora Online inside your environment, with the hosting model you choose.
Permissions are mapped from Box groups and collaborators into Nextcloud groups, shares and folder rules.
We run FTPS bulk transfers out of Box in test batches, then check file counts, sizes and version history.
Integrations with identity, storage backends and email are configured and tested against your own settings.

How we hand over

Handover includes configuration, architecture and runbooks written for your administrators, in your environment.
A migration report lists what moved, what was excluded, and which permission mappings need owner review.
We document backup and restore steps and test them before cutover to the new platform.
Compliance readiness evidence is prepared for your assessors, who issue any audit report or certification.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Security testing of the Nextcloud deployment, including applications, APIs and infrastructure, can be scoped separately.
Upgrades to new Nextcloud Hub and Collabora Online releases are planned, tested and documented before rollout.
Ask whether your organization needs an enterprise subscription from the vendor for support terms, and confirm it in writing.

Open-source alternatives to Box: self-hosted Nextcloud and Collabora Online