How to export data from Box when the contract is ending
If a renewal, price change or exit decision means getting files out of Box, the documented route for bulk download is FTPS and SFTP, available to Business and Enterprise customers. A plain download from the web or desktop app does not carry metadata, permissions or full version history, so plan for those separately before the contract ends. Box describes FTP access as intended for bulk migration and occasional bulk download, and it limits files transferred over FTPS to 32 GB each, so check your largest files against that figure early.
Content falls into three groups. Ordinary files in standard formats usually export cleanly over FTPS or SFTP, and you can confirm the exact folder structure that comes across by testing a representative subset first. Metadata such as custom fields, tags, comments, task history and collaborator roles, along with shared link settings and version history, needs a plan: decide which versions matter for legal hold or audit, record who holds access to what, and export those details through Box's admin reports or the API where your plan allows. Box Notes, Box-specific integrations and any content stored in a Box Zone also need their own decisions, because they may not map to a file system at all. Treat the export as one step in a move, not the move itself. Before you start, confirm with Box which FTP or SFTP options your contract includes, how long your administrator access remains after termination, and whether the export is covered by your support terms. Then run a pilot export, check file counts, sizes and checksums against the source, and keep a written record of what was exported and what was left behind. That record becomes the baseline for the target platform, whether it is Nextcloud with Collabora Online or another system.
What you can export from Box and how
This table maps each type of Box data to the export path that can carry it, the format it arrives in, and the limits to check. Read it as a list of questions to put to Box before you plan the move, because a plain bulk download does not keep everything an assessor or a new platform will expect.
| Data type | Export method | Format delivered | Documented limits and what to confirm |
|---|---|---|---|
| Files and folders | FTPS or SFTP bulk download for Business and Enterprise accounts | Original file bytes in folder structure | FTPS transfers are limited to 32 GB per file. Confirm the SFTP per-file limit with Box. |
| File versions | Confirm whether FTPS or SFTP returns prior versions, or whether a separate export is needed | To be confirmed with Box | Confirm in the admin console and the Box Support article which versions are included and how they are named. |
| Collaborators and sharing details | Not documented as part of the FTPS or SFTP path. Plan a manual or scripted inventory from the admin console or the Box API | Export format to be confirmed | Ask Box which collaborator roles, shared links and expiry settings can be read in bulk. |
| Comments and file metadata | Not documented as part of the FTPS or SFTP path. Confirm with Box | To be confirmed with Box | Metadata templates and comments may need the Box API. Confirm what the admin console and API expose. |
| Box Notes | Confirm whether Notes are included in bulk download or need a separate export | To be confirmed with Box | Notes are a Box-specific format. Plan how to convert or store them before cutover. |
| Account-level records | Admin console reports and audit logs, where available for your plan | Report format to be confirmed | Check which logs and user records you can export and how long Box keeps them before you give notice. |
| Permissions and folder ownership | Not carried by a plain download. Record them before migration starts | Your own inventory | Export group membership and ownership from the admin console so you can rebuild access on the new platform. |
FTPS, SFTP or the web app: which path fits your content
FTPS is the File Transfer Protocol secured with TLS, and Box supports it for Business and Enterprise customers. Box limits files transferred over FTPS to 32 GB each, so any file above that size will not come across this way and needs a different route. Box describes FTP and SFTP as intended for bulk migration and occasional bulk download, which means the protocol is a supported bulk path rather than a day-to-day sync tool.
- Per-file ceiling: Check your largest files first. Anything at or above 32 GB must be exported by another method or split before transfer.
- Client support: Most command-line and graphical FTP clients can connect with explicit TLS, which suits scripted exports.
- Folder structure: Confirm how your client handles paths with unusual characters, long names or deep nesting before a full run.
- Verification: Compare file counts and sizes against a Box-side inventory after each batch, because a dropped connection can leave partial files.
- Retries: Build resume logic into your script, since large transfers over a single session are the most likely to be interrupted.
Before you plan around FTPS, ask your Box administrator whether FTP access is enabled for your account and which users may use it, because access is controlled per account and tier.
SFTP runs file transfer inside an SSH session, and Box lists it alongside FTPS for Business and Enterprise customers as a bulk migration and occasional bulk download option. For an export that covers many folders and mixed file sizes, SFTP is usually the path to script around, since it fits automated runs from a bastion or export server. Confirm the current per-file behavior for SFTP with Box, because the 32 GB limit documented for FTPS is the figure you have verified for this path.
- Key-based authentication: Plan for SSH key management on the machine that runs the export, and remove or rotate keys once the migration ends.
- Scheduled runs: A long export can be split across windows, with each job logging the paths it has completed.
- Network path: Run from a host with stable, high-throughput connectivity to Box, ideally in the same region as your target storage.
- Logging and evidence: Keep transfer logs with timestamps and checksums, which you will need when someone asks what left the tenant and when.
- Ownership of the script: Someone on your team must own and maintain the script, since Box will not do this work for you.
Ask your Box administrator to confirm that SFTP is enabled, which credentials to use and whether any IP allow list applies to your export host.
The Box web app and desktop tools let a user download individual files or folders directly. This route needs no protocol setup, no separate credentials and no scripting, so it suits small sets, spot checks and content that a single person needs urgently. It is not a substitute for a bulk export, because it depends on a person clicking through folders and it does not carry the full set of metadata and history that a migration needs.
- Spot checks: Use it to confirm that a sample of files opens correctly after an FTPS or SFTP run.
- Small collections: Individual project folders or a handful of contracts can be pulled quickly this way.
- Limits of manual work: Large folder trees invite missed items, so do not treat a manual download as a complete inventory.
- Permissions: The download runs under the user's own access rights, so content they cannot see will not come across.
- Local storage: Make sure the destination drive has room and that file paths will not exceed operating system limits.
Before relying on this route for anything your organization must keep, confirm with your Box administrator which download and sync tools are approved on managed devices.
Most leavers use more than one path. The practical split depends on three questions: how big your largest files are, which network path your export host can reach Box over, and whether your team can write and run a transfer script. A small tenant with mostly documents may finish with the web or desktop route, while an organization with large media, engineering archives or scanned records will need FTPS or SFTP for the bulk of the work.
- File size distribution: Sort your content by size so you know how many files exceed 32 GB and need separate handling.
- Network path: Test throughput from the machine that will run the export, not from a laptop on the office Wi-Fi.
- Scripting capacity: If nobody can maintain a script, a managed migration may be the better route than a manual one.
- Mixed batches: Assign oversized files to a separate, monitored batch so failures are easy to spot.
- Reconciliation: Run a final count and size comparison across all paths before you end the subscription.
Confirm current FTP, SFTP and download settings with your Box administrator before you start, since access and limits depend on your plan and admin configuration.
What a plain Box download does not keep
A standard download copies file bytes and folder names, and little else. The cards below cover the items that usually sit outside the file itself and need a separate export, a recorded inventory or a rebuild in the target system.
Version history beyond the current file
A plain download returns the current version of each file, so earlier revisions are at risk of being left behind. Decide early whether older versions must move, since they multiply storage and migration time. Ask Box which export method keeps prior versions and whether the bulk FTPS or SFTP route includes them. Confirm how the target platform stores versions before you choose a retention rule.
Collaborator roles and folder permissions
Roles such as editor, viewer and co-owner live in Box, not in the files, so they disappear on download. Export a permissions inventory from the admin console or admin reports and store it as a spreadsheet keyed by folder path. Use that record to recreate groups and roles in the target system. Ask Box which reports list folder-level collaborators for your plan.
Shared link settings and expiry
Shared links carry access settings such as password, expiry date and download permission, none of which travel with the file. Inventory active links before the cutover and note which ones external partners still use. Plan to issue new links from the target system and retire the Box links on a fixed date. Ask Box whether link reports include expiry and password status.
Comments and tasks
Comments, task assignments and their due dates are stored as platform objects rather than file content. A download keeps none of them, so review threads that explain a decision will be lost. Export or screenshot the threads that matter for audit or contract history, and record task owners in the same inventory as permissions. Ask Box whether comments and tasks can be exported in bulk.
Metadata and custom fields
Custom metadata templates, tags and classification fields are structured data attached to each file. A plain download keeps only file names and folder paths, so classifications may be lost. Export metadata values per file through the API or a documented export before you rely on folder structure alone. Confirm the field types and template names with Box before mapping them to the target schema.
Box Notes, embedded content and app connections
Box Notes and embedded items are not ordinary files, and third-party app connections hold their own configurations. Identify which Notes must be converted or exported separately, and list every connected application with its owner and purpose. Rebuild the important connections in the target system, because the connection settings do not transfer with the files.
Retention and legal hold state
Retention policies and legal holds control whether content may be deleted, and they are not carried in a download. Before deleting anything in Box, list every active hold and retention policy and the custodians they cover. Keep Box content under hold until the target system has a documented equivalent. Ask Box how holds appear in exports and whether a hold blocks bulk export or deletion.
Export sequence for a complete Box data export
This sequence moves content out of Box in an order that lets you verify every batch against a known inventory before the account is closed. Each step produces a record that the next step depends on.
Confirm plan tier and FTPS or SFTP access
The account owner or a Box administrator checks that the account is on a Business or Enterprise plan and that FTPS or SFTP access is enabled for it. Box describes these protocols as intended for bulk migration and occasional bulk download, and it limits files transferred over FTPS to 32 GB. Confirm the current access method and any limits with Box Support before you plan further, because the rest of the sequence depends on this route being available. The step is done when a test login succeeds from the machine that will run the transfer.
Inventory folders, file counts and sizes
Build a complete list of folders, file counts and sizes from the Box admin console or a reporting export, and record each item's path, last modified date and current version. This inventory becomes the baseline for verification, so every later batch can be compared against it. Note any items in Box Notes or other formats that a plain file download will not carry, and keep them on a separate list. The step is done when the inventory total matches the account's reported content.
Flag files above 32 GB for a non-FTPS route
Filter the inventory for any file larger than 32 GB, since FTPS will not transfer those files. Mark each flagged item with its path and owner, and agree with Box Support or your migration partner which alternate route will carry it, such as a different download method or a separate transfer. Keep flagged files out of the batches until that route is confirmed. The step is done when every oversized file has a named route and an owner.
Set up a staging store with enough capacity
Provision a staging location in your own infrastructure with enough free capacity for the full export, plus headroom for the staging copies and any reprocessing. Use a path with access controls and encryption at rest, and restrict access to the migration team. Size the store from the inventory total rather than an estimate. The step is done when a write test succeeds and free space covers the inventory total with room to spare.
Run a test transfer on a small folder
Choose a small folder that contains nested directories, mixed file types and a few files with multiple versions. Transfer it over FTPS or SFTP into the staging store, then compare file names, sizes and checksums against the inventory. Record which metadata and version history survive the transfer, and which do not. Use the results to adjust your batch sizes and naming rules. The step is done when the test folder matches the inventory and the gaps are written down.
Run the full transfer in batches
Split the remaining inventory into batches by folder, keeping each batch small enough to restart cleanly if a connection drops. Transfer each batch into its own directory in the staging store and log the start time, end time and any errors. Retry failed items individually rather than rerunning the whole batch. The step is done when every batch in the inventory has a transfer log with no unresolved errors.
Export permissions and sharing inventory from admin reports
Download the permissions, collaborator and shared link reports from the Box admin console for every folder and file in scope. Store them alongside the content, mapped to the same paths used in the inventory. A plain file download does not keep these records, so this is the only copy you will have once the account is closed. The step is done when each folder in the inventory has a matching permissions record and the sharing report is saved in the staging store.
Verify each batch before closing the account
Compare each batch in the staging store against the inventory for file count, total size, names and checksums, and confirm the permissions records cover the same paths. Keep a signed verification record for each batch that lists any exceptions and how they were resolved. Only when every batch and the flagged oversized files pass should the account be closed. The step is done when the verification records cover the full inventory and the owner has accepted them.
How to verify a Box export before you close the account
Do not cancel the Box account until the export has been checked against the source. Start by building an inventory from Box while access is still open: list every folder with its file count and total bytes, and keep that listing as the baseline. Then compare the same counts and byte totals against the files on your target storage, folder by folder. A mismatch in one folder is easier to chase while the source still exists. Where the transfer tool writes checksums or where you can compute them on both sides, compare hashes for a sample or the full set. Confirm this capability with your transfer tool and your Box plan before you rely on it, since the FTPS and SFTP paths do not necessarily give you the same metadata.
Run spot checks on files that must open correctly: pick representative documents across types and sizes, including large files near the 32 GB FTPS per-file limit, open them, and confirm content and modification dates. Verify that folder paths and file names survived the transfer, especially characters that differ between systems, long paths and names with trailing spaces. Keep in mind that a verified file is not a verified right. Permissions, collaborator roles, shared links and version history are not carried by a plain download, so each needs its own check against an export or a manual record taken from Box before access ends. Decide in advance which version history you must retain, because the verification plan should test exactly that.
Keep the export logs, the Box inventory, the checksum lists and your sign-off record together. Auditors and legal teams may ask how content left the system and whether it was complete, and these records answer that question. Store them in a location you control, with a retention period that your legal and compliance owners set. Keep Box access open until verification passes and the signed record exists. Closing the account first removes your ability to re-export missing items, and recovery from a closed account is a conversation with Box support rather than something you can plan for.
What to plan before the Box contract ends
Leaving Box is mostly a set of decisions with owners and deadlines, and the export itself is the last step. The cards below cover the contract dates, the export window, the obligations that outlast the account, and the integrations and shared links that break when access stops.
Notice window and access end date
Confirm in your Box contract the notice period for non-renewal and the exact date the account stops granting access. Procurement or legal owns this decision, and the finance and IT leads should agree on it in writing. Keep the signed order form, renewal notice and any written confirmation of the access end date, because the export plan must finish before that date.
Export window for the largest folders
Estimate how long the biggest folders will take to transfer over FTPS or SFTP, and test a sample first. Box limits files transferred over FTPS to 32 GB each, so identify any larger files now and plan a separate method for them. The IT owner should keep the test transfer logs and the list of files that needed special handling.
Retention and legal hold obligations
Legal, records management and compliance teams decide which content must be kept after the account closes, including content under legal hold or subject to a retention policy. Confirm with Box how retained content is handled at exit, because a plain download does not carry retention settings. Keep a written register of held matters and the retention schedule you applied to each export.
Integrations and API consumers to retire
List every application, script and workflow that calls the Box API or relies on Box connectors, including backup jobs and sync clients. Assign each one an owner and a shutdown date, so nothing fails silently when access ends. Keep the inventory with the owner's sign-off, since auditors and incident responders often ask which systems touched the data.
Shared links and collaborator handover
Shared links and collaborator access in Box do not move with downloaded files. Decide which external partners and internal teams need access in the new platform, and send them the new locations before the old links stop working. Record the mapping from each old shared link to its new location so the business owner can confirm that access was restored.
User communication and sign-off
Employees and external collaborators need dates, the new locations and a contact for questions. HR or the business unit leads should send the notices, and the IT lead should confirm that each team has checked its content after migration. Keep copies of the announcements, the acknowledgments and the final sign-off by each data owner.
Questions buyers ask before exporting data from Box
Can our team run the Box export ourselves?
Yes, a team with Box admin rights can start the export themselves, because Box supports FTPS and SFTP for Business and Enterprise customers and describes that access as intended for bulk migration and occasional bulk download. The harder part is not the transfer but deciding what to keep. A plain download does not carry metadata, permissions, shared links or version history, so someone must map those by hand or with scripts. Teams that have run a few exports before often handle the transfer in-house and bring in outside help only for permission mapping and verification. Confirm your plan tier and admin rights with Box before you plan the work.
What makes a Box export take more effort?
Effort rises with four factors: total data volume, the number of files above the 32 GB per-file limit for FTPS transfers, the number of permission rules and shared links, and the number of integrations that depend on Box. Large single files need a different transfer path or a separate handling plan, so count them early. Permission sprawl is often the largest hidden cost because each folder may have inherited and direct grants that must be recreated in the target. Each connected app, workflow or Box Notes collection adds its own replacement work.
How long does a Box export take?
The duration depends on data volume and the network path between Box and your staging server, so no duration is documented here. Ask for a measured estimate based on a sample of your own content, not a generic figure. Plan for transfer time to repeat if files change during the export, and schedule a freeze or a final delta pass near cutover. Verification also takes time, because checksums or file counts must be compared before anyone treats the copy as complete.
What does the internal team need to provide?
The work needs three things from your side. First, admin access to Box with rights to export content and read permission and sharing settings. Second, a staging server with enough disk space and network throughput to hold the export before it is loaded into the target. Third, a named owner who signs off on verification and decides which content is archived, migrated or retired. Without a named owner, verification tends to stall and cutover slips. Ask your legal or records team to confirm which retention rules apply before anything is deleted.
What does an outside partner do in a Box export?
An implementation partner typically plans the export scope, sets up the staging environment, scripts or runs the bulk transfer, maps permissions and shared links to the target platform, and documents the verification evidence. DeployOpen works under a fixed scope agreed in writing before work starts, so deliverables and timelines are set out in advance. A partner does not issue audit reports or certifications, so any compliance evidence it prepares still goes to an independent auditor. Ask each bidder to show how it handles version history and permissions, not only the file transfer.
Can version history be carried over from Box?
A plain bulk download delivers the current version of each file, so previous versions are not carried over automatically. Whether you can keep history depends on your target platform, the export method you choose and how much history matters for audit or legal holds. Decide in advance which versions to keep, because retaining every version can multiply storage and transfer effort. Confirm the export options available for your Box plan with Box Support before you commit to a migration design.
What should we ask for in a written quote?
Ask for the scope in writing: the volume and file count you provided, the number of files above 32 GB, the permission and shared-link inventory, the integrations to replace, the version history policy, and the verification method. Ask what is one-time work, such as the export, mapping and cutover, and what recurs, such as support, upgrades and backups on the target. Also ask which items depend on your own inputs, such as admin access or staging capacity, and what happens if the volume is larger than measured.
How DeployOpen scopes and delivers a Box data export
DeployOpen treats a Box export as a scoped delivery, not a single download. We agree in writing which content, metadata and permissions must leave Box, where the export lands in your own infrastructure, and how it is checked before the Box account is closed.
How we scope
- Inventory which folders, users and shared content are in scope for the export from Box
- Confirm your plan tier, since FTPS and SFTP access is limited to Business and Enterprise customers
- Record the 32 GB per-file FTPS limit and decide how larger files will be transferred
- Agree which metadata, collaborator permissions and version history must be preserved in the target
How we build
- Set up FTPS or SFTP bulk transfer on a staging host inside your own network
- Script the transfer and log each file path, size and checksum so results can be compared
- Export Box Notes and integration data separately, since a plain file download does not keep them
- Map exported folders and metadata to the target platform before any production load
How we hand over
- Provide a reconciliation report comparing file counts, sizes and checksums against the Box inventory
- Document each step, the known gaps and the decisions your team made on version history
- Deliver the export to your storage with retention settings you approve in writing
- Run a sign-off review with your IT, security and compliance owners before the Box account is closed
How we support
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing first
- Ongoing support, upgrades and continuous testing are available as a retainer after handover
- Ask any provider for a written quote that lists each deliverable, assumption and exclusion
- Confirm with your own Box administrator the current plan limits before scoping begins
