Activates and delivers.
Box manages licence activation, approved software delivery and configured public-domain connections.
Box architecture
Meet the boundary that keeps your platform yours.
Box supplies licensed software. Your organisation operates the deployment, connects providers and owns the commerce data.
Your Box deployment
Architecture is built into every operating decision.
The line between licensed software and the estate that runs it determines data ownership, provider responsibility and how merchant surfaces are composed.
Operates the deployment.
Your team runs the infrastructure, database, access controls and connected provider implementations.
Uses only what is installed.
The merchant experience is composed from the packages and tier assigned by the institution.
Focus on the operating system, not integration ambiguity.
Four parts keep the relationship legible from installation to a public merchant experience.
One domain model.
Products, customers, orders, payments and settlements compose through licensed packages.
Navigation from entitlement.
The merchant workspace exposes the capabilities installed and assigned to that merchant.
Website and counter.
Customer-facing and staff-facing interfaces use the same deployment and commerce record.
Activation without data custody.
Box validates the licence and delivers approved releases without hosting the institution’s merchant database.
See the boundary from every side.
Operational responsibilities stay explicit across data, deployment and public delivery.
Data plane
Commerce records and institution configuration remain inside the operated deployment.
Provider ports
Payments, messages and external services bind through implementations supplied by the operator.
Release channel
Approved versions arrive as a coherent package set rather than independent surface updates.
Domain delivery
Configured public domains connect visitors to the website surface without making Box the merchant backend.
Learn more about operating Box.
Continue into the detailed boundaries and workflows.
SECURITY
Keep payment credentials outside.
See the security model and responsibility split.
COMPLIANCEUnderstand what evidence belongs where.
Review the self-hosted compliance boundary.
TESTINGRun the deployment locally.
Inspect the package graph and API before connecting live providers.
RELEASESFollow what changes.
Review versioned product updates and operational notes.
Ready to inspect the architecture?
Start with the boundary your institution needs to preserve.