Migrate from Box to Nextcloud

How to migrate from Box to Nextcloud without losing control of your files

If your Box renewal, a licensing change, a residency requirement or lock-in is pushing you toward self-hosting, the migration is a bulk export, rebuild and cutover project, not a file copy. Content has to leave Box in bulk, land in Nextcloud with its folder structure intact, and then have sharing, permissions and integrations rebuilt by hand before users switch over. Most organizations run this with internal IT doing the file and identity work and an implementation partner handling the Nextcloud build, the Collabora Online integration and the parts that need careful testing. Effort depends mostly on how many terabytes sit in Box, how many external collaborators hold shared links, and how many integrations depend on Box APIs, so confirm those three numbers with your own tenant reports before anyone quotes a timeline.

Start the export by confirming that your plan includes FTPS or SFTP access, which Box describes as intended for bulk migration and occasional bulk download for Business and Enterprise customers. Note that files transferred over FTPS are capped at 32 GB each, so identify any larger files early and plan a separate route for them. A plain download does not carry version history, comments or the full permission model, so decide up front which versions and metadata you need in Nextcloud and which can stay in an archive. Nextcloud upgrades must also be planned from the start, since it does not allow skipping major releases, so pin the version you deploy and schedule its upgrade path.

DeployOpen plans and runs this work inside your own cloud accounts, data centers or air-gapped networks, under a fixed scope agreed in writing before work starts. In practice that covers the export plan, the Nextcloud and Collabora deployment, a permissions and shared-link mapping, a rehearsal with a pilot group, the cutover runbook and post-cutover support. Ask any partner, including us, to show how they will verify that file counts, checksums and folder permissions match between Box and Nextcloud, and how Box Notes and third-party integrations will be replaced, because those are where migrations usually lose control.

Which Box capabilities map cleanly to Nextcloud and which need rework

This table compares the main Box capabilities that matter during a move with their closest Nextcloud and Collabora Online equivalents. Read each row as a planning signal: clean means a near-direct match, needs rework means the data or configuration must be rebuilt, and gap means no equivalent should be assumed. Confirm each feature against current Nextcloud and Collabora documentation before you commit to a cutover plan.

Box capability	Nextcloud and Collabora equivalent	Status and what to confirm
File storage and folders	Nextcloud Files with folder trees, group folders and external storage mounts	Clean. Confirm folder depth, path length and special characters against your target storage backend before bulk load.
Bulk export from Box	Export over FTPS or SFTP, then import into Nextcloud folders	Needs rework. Files over the 32 GB FTPS limit need a separate route, and a plain download does not carry metadata or permissions.
Version history	Nextcloud file versions, retained per file according to server settings	Needs rework. Decide which versions to carry over, since bulk export typically delivers only current copies. Confirm retention settings with your admin.
Collaborator permissions	Users, groups and per-share permissions set in Nextcloud	Needs rework. Map Box collaborator roles to Nextcloud share rights by hand or with a script, then test each group.
Shared links	Public link shares with passwords, expiry dates and download limits	Needs rework. Recreate links after cutover, since Box URLs will not resolve, and confirm which link options your version supports.
In-browser office editing	Collabora Online through the WOPI integration in Nextcloud Office	Clean for common Office formats. Confirm .docx, .xlsx and .pptx fidelity on your sample files and plan for complex macros or layouts.
Box Notes	No direct one-to-one equivalent; use Nextcloud Text or Collabora documents	Gap. Export notes to a document format, then review formatting, comments and embedded items with the users who own them.
Integrations and API automation	Nextcloud OCS and WebDAV APIs, plus community and custom apps	Gap. Each Box integration and script must be inventoried and rebuilt or replaced. Confirm API coverage for your workflows.
Admin governance and retention	Nextcloud admin settings, user and group management, and LDAP or SAML authentication	Needs rework. Rebuild retention, audit and access policies. Confirm which governance features your edition includes.

The migration sequence from inventory to decommission

This sequence moves Box content into Nextcloud in controlled stages, so every folder has a known owner, a verified copy and a documented cutover. Each stage produces an artifact you can check before the next one starts.

Inventory folders, owners, shares and sizes
Start by listing every top-level folder and its size, owner, collaborators and shared links in Box admin reporting and the Box Admin Console. Mark any single file that approaches or exceeds the 32 GB limit for FTPS transfers, because those files need a separate route. Confirm with your Box administrator which FTPS or SFTP access your plan includes. The output is a signed-off inventory spreadsheet with one row per folder, mapping each to a proposed Nextcloud group folder and an accountable owner.
Pilot one library over FTPS or SFTP
Choose one low-risk folder with a named owner and bulk-download it over FTPS or SFTP, which Box describes as intended for bulk migration and occasional bulk download. Load the copy into a Nextcloud group folder and open a sample of documents in Collabora Online to check that formats, folder structure and file names survive. Record which metadata a plain download does not keep, such as comments, tags and most version history. The output is a pilot report listing counts, checksums or sizes, and any failed or skipped files.
Handle files above the FTPS limit
Files larger than 32 GB cannot be transferred over FTPS, so identify them from the inventory and move them through a separate route agreed with Box support and your IT team. Keep these files in a separate ticket with their own checksum record. The output is a short list of oversized items, each with the method used, the destination path and a verified copy in Nextcloud.
Run the parallel period with a freeze window
Migrate the remaining libraries in waves while users keep working in Box. Agree a freeze window in writing with the business owners, after which no edits are made in Box for the libraries being moved. Re-run the bulk download for changed folders during the freeze, then compare file counts and sizes against the inventory. Set permissions in Nextcloud from the mapping sheet and test access with a sample of users from each group. The output is a reconciliation report showing zero unexplained differences per library.
Cut over users and links
Announce the switch date, point users to Nextcloud, and set Box folders to read-only for migrated content so that no new work lands in two places. Replace shared links with Nextcloud share links, and confirm that external collaborators can log in or receive links they can use. Replace Box Notes and integrations with the Nextcloud app or workflow that each owner chose during inventory. The output is a cutover checklist signed by each business owner, with open issues logged and assigned.
Decommission Box with retained export evidence
After the agreed stabilization period, remove user access to Box and close integrations, after confirming with your Box contract owner what the renewal or termination terms require. Keep the final export archives, the checksum records, the reconciliation reports and the permission mapping in a controlled store that your records policy covers. Ask your compliance lead which retention period applies to that evidence. The output is a decommission record that shows what was exported, when, how it was verified and where the evidence is kept.

Bulk exporting Box content over FTPS or SFTP within the 32 GB per-file limit

Start by confirming which bulk export path applies to your Box tenant. Box supports FTPS and SFTP for Business and Enterprise customers and describes this access as intended for bulk migration and occasional bulk download. The 32 GB per-file limit applies to FTPS transfers, so a file that exceeds it cannot be pulled through that path. Ask Box support, through the Box FTP troubleshooting article as the starting reference, whether your tenant has FTP and SFTP enabled, whether the limit differs for SFTP on your plan, and who in your organization is permitted to enable and use the service. Get the answers in writing before the migration plan depends on them.

Split the work by top-level folder rather than by user or by total size, so each batch maps to a known owner and a known destination library in Nextcloud. Before transferring, list the files in each batch and flag anything near or above 32 GB, such as large video, disk images or database backups. Move those oversized files through a different route agreed with Box, or handle them as separate, named exceptions in your migration log. Record the file count and total size for each batch from the source side, since these figures are the baseline for every check that follows.

After each batch lands, compare file counts and sizes with the source listing, then compare checksums for a sample or for all files where your tooling allows. Mismatched counts usually point to skipped paths, renamed characters or files that failed silently, so treat any gap as a blocker for that batch. Keep the export log, the checksum manifest and the Box confirmation as evidence for your change record. A plain download does not carry permissions, comments or version history, so those items need their own inventory, covered in the sections on version history and collaborator permissions.

What data and integrations need to be moved or rebuilt

Moving from Box to Nextcloud is less a file copy than a rebuild of identity, sharing and automation. Each card below is a separate item to inventory and decide on before cutover, because a plain bulk download carries the files but not the rules around them.

File content and bulk export

Box documents the FTPS and SFTP paths for bulk migration and bulk download, and FTPS caps each transferred file at 32 GB. Identify any larger files early and plan a separate transfer for them. Confirm with Box which export path your plan includes, since FTPS and SFTP access is limited to Business and Enterprise customers. Check file names and paths for characters Nextcloud rejects before loading, and verify file counts and checksums after the copy.

Folder structure and project mapping

Decide how Box folders become Nextcloud folders, groups and team folders. Flat exports of deeply nested trees often hide ownership, so map top-level folders to owning teams first. Remove stale or duplicate content in Box before export rather than after, so the target does not inherit clutter. Document the mapping in a spreadsheet that engineers and business owners both sign off on.

Version history decisions

A plain download returns only the current file, so previous versions stay in Box unless you export them deliberately. Decide per folder whether older versions matter for legal hold, audit or working use, and carry over only what those needs require. Record the decision with the retention owner, because version counts and retention rules differ by Box plan and must be confirmed in your own tenant.

Users and group identities

Nextcloud's LDAP app lets Active Directory and LDAP users appear in Nextcloud and sign in with directory credentials, and Nextcloud also documents OpenID Connect and SAML backends. Choose one authentication backend before loading content, so ownership and sharing attach to stable identities. Map Box groups to directory groups and confirm which accounts are service accounts that must not be migrated as people.

Shared links and external collaborators

Box shared links and invited external users do not transfer as-is, so each one needs a decision. Export a list of links, expiry dates and external recipients, then recreate only those still in use as Nextcloud public shares or guest accounts. Expired or orphaned links should be retired, and any link to regulated data needs an owner who approves the new access rule.

Box integrations and API scripts

Inventory every connector, sync client, SSO hook, automation and script that calls the Box API before cutover. Each one must either be replaced by a Nextcloud app or client, rebuilt against Nextcloud's WebDAV or OCS interfaces, or retired. Assign an owner to each item and test it against a copy of the migrated data, since a broken script often surfaces only after users have moved.

Deciding which version history to carry over into Nextcloud

The first decision is whether to migrate every prior version of each file or only the current version plus an archived export of older versions. Carrying full history keeps the audit trail inside Nextcloud and lets users restore an earlier copy without a separate lookup, but it increases the volume transferred over FTPS or SFTP, the number of objects Nextcloud must index, and the storage consumed on your own infrastructure. A current-only migration is smaller and faster to validate, but older versions then live in an archive that users cannot open from Nextcloud. Confirm with your Box administrator how many versions each tier retains and how many of them your teams actually open, because that count drives the size of the transfer.

A plain bulk download does not keep metadata, permissions or version history, so the team has to decide the rule for each content class before the first transfer starts. Typical classes include active project files, contracts and records under legal hold, finance archives, HR files with restricted access, and personal scratch folders. For each class, record whether versions move into Nextcloud, whether an archive export is kept instead, who approves the choice, and how long the archive is retained. Illustrative example: a legal hold folder might keep all versions and a signed manifest, while a personal folder keeps only the current file. Write these rules in the migration plan so auditors and content owners can trace each decision.

Set retention rules in Nextcloud before any user account is created, not after the first complaint. Review the version retention settings in the Nextcloud admin documentation for the release you deploy, test them on a pilot group, and confirm that old versions are pruned the way your rule says they should be. Check the trash retention for deleted files as well, because a deleted file can still count against storage. Plan quota limits per group so that version history does not exhaust storage on shared drives. Finally, have each content owner sign off on the rule for their class, and keep those approvals with the migration record so the choice can be explained later.

How the migration changes by organization size and starting point

A small team with a limited number of shared folders usually has a short inventory and a small set of people to confirm. The main work is deciding what is worth carrying across, then moving it in a few batches and checking the results by hand. Because the number of permission rules is small, the team can rebuild them directly in Nextcloud and test each share with a real user before cutover.

Inventory first: List every shared folder, its owner and its current collaborators, and mark anything that has not been opened in a long time as a candidate to leave behind.
Export in batches: Pull folders over FTPS or SFTP in small groups so a failed transfer is easy to repeat and verify.
Recreate shares by hand: Rebuild group-based access in Nextcloud and replace each public Box link with a Nextcloud share link after checking who still needs it.
Check Box Notes separately: Export any notes the team relies on to a format Nextcloud can host and confirm that editing works through Collabora Online.
Test with two or three users: Run a short pilot with real files before moving everyone.

Confirm with the team which folders contain regulated or contractual content, because those may need the stricter steps described in the regulated tab even at this size.

What usually goes wrong and how to prevent it

Most failed Box to Nextcloud migrations fail on transfer mechanics, permissions or parallel use, not on the software itself. The six risks below connect at the cutover: each one shows up as missing content, wrong access or users working in the wrong place, so check them before the first production load.

Oversized files failing over FTPS

Box limits files transferred over FTPS to 32 GB, so larger files fail or never arrive in the export. Inventory every file above that size before the run and plan a separate route for them, such as the Box API or a desktop sync client. Confirm the current limit and SFTP behavior with Box support before you rely on either protocol for the full export, and verify file checksums against the Box inventory after each batch.

Permissions and shared links not mapped

A plain download keeps file contents but not who could see them. Export collaborator lists and shared link settings from Box, then map each group to a Nextcloud group and each external link to a Nextcloud share with its own expiry and password. Decide in advance which links are retired instead of recreated, and tell owners before cutover, since recipients will see broken links.

Users editing in both systems

During a parallel run, a user who edits a file in Box while the same file is copied into Nextcloud creates two diverging versions with no merge. Set a freeze date per folder, make Box read-only for migrated content, and send a single notice naming the cutover window. Confirm that the Box admin console can set content to read-only for the relevant folders before you schedule the freeze.

Box Notes content lost

Box Notes are not ordinary files, so a file-level export can miss them or export them in a form people cannot open. Inventory every Note before migration, export its text and any embedded images to documents, and check a sample in Nextcloud with the content owner. Plan a replacement editor for teams that relied on Notes, such as Nextcloud Text or Collabora Online documents, and confirm the export format with Box support.

Collabora sessions routed to different pods

Collabora Online needs every user editing one document to reach the same pod, because scaling breaks collaborative editing and copy and paste. Load balancers must route by the WOPISrc parameter, and replica counts must be set manually rather than autoscaled. Test two users editing the same .docx from different browsers behind your production ingress before opening the platform to staff.

Nextcloud upgrades blocked by third-party apps

Nextcloud does not allow skipping major releases, so each upgrade moves one major version at a time, and third-party apps can block it. Before each upgrade, back up the instance, disable apps that are not confirmed compatible with the target version, and re-enable them after the upgrade. Keep the apps you actually need on a short list, and record the version of each one in your change log.

What drives migration cost and duration, and how to keep each down

This table lists the factors that change the effort of moving from Box to Nextcloud and Collabora Online, with the reason each one matters and the steps that keep it under control. Read each row as a lever: the first two set the size of the transfer, the middle rows set the scope of rebuilt permissions and integrations, and the last rows set the operating cost after cutover. Scope is agreed in writing before work starts, so use these rows to ask for a quote that states its assumptions.

Driver	Why it changes effort or cost	How to keep it down
Data volume and file count	Box limits files over FTPS to 32 GB, so large files need a separate path, and the number of files drives transfer time, checksum verification and import jobs.	Profile the tenant before scoping. Sort out oversized files early, move cold archives in batches, and confirm with Box which FTPS or SFTP path fits each folder.
Version history depth	A plain download keeps only current files. Carrying every prior version multiplies storage and import work and needs a decision on what Nextcloud should hold.	Decide a retention rule per data class, such as current version plus a fixed number of prior versions, and document the rule before the first bulk load.
Number of external collaborators	Each external user needs a Nextcloud account or a share, and each shared link must be mapped to an equivalent share with the right expiry and password settings.	Export the sharing report from Box, remove stale guests before migration, and group the remaining external shares by owner so each owner can confirm them.
Integration count	Each Box integration, connector or API script must be replaced, reconfigured or retired, and each one needs its own test and sign-off.	Inventory integrations and rank them by business use. Retire unused ones, and budget build time only for the connectors that remain in scope.
Identity integration	Users must sign in through LDAP, Active Directory, OpenID Connect or SAML, and group-based access must map to Nextcloud groups and folder permissions.	Settle the identity source before migration. Confirm which Nextcloud user backend fits your directory, and map Box groups to Nextcloud groups in a written table.
Collabora deployment and load routing	Collabora must be sized for concurrent editors. The official Helm chart disables horizontal autoscaling and requires load balancers to route by the WOPISrc parameter so co-editors reach the same pod.	Confirm ingress support (Nginx, HAProxy or OpenShift Router) early, set replica counts manually, test co-authoring under load, and ask the vendor whether the enterprise plan is needed for your user count.
Parallel run length	Running Box and Nextcloud side by side keeps two sets of licenses, sync clients and support processes active, and users must know which system holds the current file.	Set a fixed cutover date per department. Freeze Box writes for each wave, keep the parallel period as short as the validation checks allow, and cancel Box renewals only after exit checks pass.
User training	Users must learn new sharing, sync, editing and Collabora controls, and Box Notes content needs a replacement workflow.	Train by role, publish short guides for sharing and co-editing, and run a support queue during the first weeks. Ask for training hours as a separate line in the quote.
Cost components after cutover	Hosting, storage growth, backups, and optional Nextcloud Enterprise subscriptions recur. Nextcloud Enterprise pricing starts at a 100-user minimum, and Nextcloud Hub releases follow a four-month major cycle that needs upgrades one major version at a time.	Ask for a quote that separates one-time implementation from recurring hosting, storage, backup and subscription costs. Plan upgrade windows for each major release, and confirm the Enterprise tier only if support needs justify it.

Questions buyers ask before moving from Box to Nextcloud

How long does a Box to Nextcloud migration take, and what drives the timeline?

The timeline depends on the volume of content, the number of users and shared folders, how much version history you keep, and how many integrations must be rebuilt, so no single duration applies to every tenant. Box describes FTPS and SFTP as intended for bulk migration and occasional bulk download, so the export itself is only one stage. Expect separate work for pilot users, permission mapping, a Nextcloud deployment that meets your sizing and database requirements, and at least one full test migration before cutover. Ask any implementation partner for a written timeline tied to a fixed scope, and ask them to state which of your assumptions it depends on.

Can our internal team run the migration without an outside partner?

A team with Linux, PHP and database administration skills, and someone who owns Box administration, can usually handle a small pilot alone. Larger tenants tend to need help with bulk export scripting, permission mapping, identity integration and cutover coordination. Nextcloud documents LDAP, OpenID Connect and SAML for user authentication, so decide early how staff will sign in. DeployOpen plans, implements, integrates, hardens, backs up and documents self-hosted platforms in your own infrastructure under fixed-scope agreements, so you can have that work defined in writing before any work starts.

What skills and staff time does the work require from our side?

Plan for four groups of people: a Box administrator who can enable FTPS or SFTP access and confirm your plan includes it, a Linux and container operator who runs the Nextcloud and Collabora Online hosts, a security or identity owner who sets authentication and sharing policy, and business owners who confirm which folders and users matter. Nextcloud does not allow skipping major releases during upgrades, so whoever operates the platform must learn the upgrade path and backup routine before go-live. Ask your partner to list these roles and the hours each one needs in the written scope.

Can Box Notes be moved to Nextcloud?

The supplied sources do not describe a Box Notes export format, so confirm with Box exactly what Box Notes content can be exported, in which format, and whether comments and revision history come with it. Plan to treat notes as documents that you convert and store as files in Nextcloud, then test a sample of notes with real collaborators before you retire Box. For live co-authoring after migration, Collabora Online edits ODF and Microsoft formats such as .docx, so confirm how your converted notes will open and whether formatting survives.

How do we move files larger than 32 GB out of Box?

Box limits files transferred over FTPS to 32 GB, so any larger file needs a different route, which should be confirmed with Box support before the migration plan is final. Test whether SFTP or the Box API handles those files in your tenant, and record the outcome for each large file. Large media and archive files also affect storage sizing and backup windows in Nextcloud, so include them in the capacity plan. Keep a checksum list for every file so you can prove the copy matches the source.

Is Nextcloud Enterprise required, or can we run the community version?

Nextcloud Hub is licensed under the AGPL and is free to self-host, so the community software does not require a subscription. Nextcloud GmbH sells Standard, Premium and Ultimate enterprise subscriptions for support and additional features, with a 100-user minimum, and offers Nextcloud One managed hosting for organizations under 100 users. Standard includes one year of maintenance, Premium adds a maintenance lifecycle of five or more years, and Ultimate adds support up to 24/7. Decide whether you need a vendor support commitment, then price the subscription against your own support staff cost using the current Nextcloud pricing page.

What Collabora Online licensing options exist for editing documents?

Collabora Online has three practical paths: CODE, the free development edition, a Business plan and an Enterprise plan. Collabora describes CODE as suited to testing, home use or small teams and not recommended for production. The Business plan is listed at 3 euros per user per month for up to 99 users and includes long term support, an SLA and signed security updates, while the Enterprise plan for 100 or more users is quoted with volume discounts. The server code is MPL-2.0 licensed. Ask Collabora to confirm the current terms for your user count and whether you need support in production.

How does cutover avoid losing edits made during the move?

Lost edits usually happen when people keep working in Box while a copy is taken, so define a freeze window in which Box folders become read-only for the migrated scope, then run a final delta export. Use the migration log to confirm every file, and check version history and permissions after the copy. Collabora Online load balancing must route each document to the same pod through the WOPISrc parameter, and autoscaling is disabled for that reason, so test concurrent editing before users return. Keep Box available for read access for a period after cutover so staff can verify anything that was missed.

How DeployOpen scopes, runs and supports a Box to Nextcloud migration

DeployOpen plans and implements self-hosted Nextcloud with Collabora Online inside your own infrastructure, including the bulk export from Box, the content load and the permission rebuild. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.

How we scope

Inventory Box folders, file counts, sizes and any files near the 32 GB FTPS limit.
Agree in writing which version history, shared links and collaborator roles move across.
Define which Box integrations and Box Notes content are replaced, retired or rebuilt.
Confirm target hosting, database, identity source and backup location before quoting.

How we build

Set up Nextcloud and Collabora Online in your cloud account, data center or air-gapped network.
Run test exports over SFTP or FTPS and reconcile file counts, checksums and folder structure.
Configure LDAP, OpenID Connect or SAML login and rebuild group-based sharing rules.
Harden the deployment and test permissions, sharing and document editing before cutover.

How we hand over

Document the architecture, configuration, migration runbook and the mapping from Box roles.
Deliver a record of what was exported, what was loaded, and what was deliberately left behind.
Train administrators on upgrades, which require moving one major version at a time with backups.
Provide the backup and restore procedures for your Nextcloud instance and its database.

How we support

Ongoing support, upgrades and continuous security testing are available as retainers.
Plan each Nextcloud major upgrade, including checks on third-party apps before they are enabled.
Keep Collabora Online and Nextcloud on supported release lines as your schedule requires.
Agree response expectations and service levels in the written retainer scope before go-live.