Applicable Jurisdictions and Measures taken by Dropbox to prevent non-EU governmental access to or transfer of data held in the Union
If you reside outside of the United States of America, Canada and Mexico (“North America”), the Services are provided by Dropbox International Unlimited Company, whose infrastructure is subject to the jurisdiction of the Republic of Ireland. If you reside in North America, the Services are provided by Dropbox, Inc., whose infrastructure is subject to the jurisdiction of the United States of America.
When transferring data from the European Union, the European Economic Area, the United Kingdom, and Switzerland, Dropbox has a number of technical, organizational, and contractual measures measures in place to prevent international government access to Dropbox user data, where such access would create a conflict with Union law or the national law of the relevant Member State.
Technical Measures
Dropbox diligently maintains the security of our back-end network. Our network security and monitoring techniques are designed to provide multiple layers of protection and defense. We employ industry-standard protection techniques, including firewalls, network vulnerability scanning, network security monitoring, and intrusion detection systems to ensure only eligible and non-malicious traffic is able to reach our infrastructure.
Our internal private network is segmented according to use and risk level. The primary networks are:
- Internet-facing DMZ
- Priority infrastructure DMZ
- Production network
- Corporate network
- Dropbox services and applications are isolated via containers when possible
Access to the production environment is restricted to authorized IP addresses and requires multi-factor authentication on all endpoints. IP addresses with access are associated with the corporate network or approved Dropbox personnel. Authorized IP addresses are reviewed on a quarterly basis to ensure a secure production environment. Access to modify the IP address list is restricted to authorized individuals.
Traffic from the internet destined to our production network is protected using multiple layers of firewalls and proxies.
Strict limitation is maintained between the internal Dropbox network and the public internet. Internet-bound traffic to and from the production network is carefully controlled through a dedicated proxy service and this, in turn, is protected by restrictive firewall rules.
Organization and Contractual Measures
Dropbox complies with the EU-U.S. and Swiss-U.S. Data Privacy Frameworks, as well as the UK Extension to the EU-U.S. Data Privacy Framework, as set forth by the U.S. Department of Commerce regarding the processing of personal data transferred from the European Union, the European Economic Area, the United Kingdom, and Switzerland to the United States. Dropbox has certified to the U.S. Department of Commerce that it adheres to these Data Privacy Frameworks with respect to such data, but this does not include the FormSwift portion of the Services. If there is any conflict between Dropbox’s Privacy Policy and the Data Privacy
Framework Principles, the Principles shall govern. In accordance with the Principles, Dropbox shall
remain liable for onward transfers if a processor processes personal data in a manner inconsistent
with the Principles.
To learn more about the Data Privacy Framework, and to view Dropbox’s certification, visit https://www.dataprivacyframework.gov/.
