Your institution
Runs the engine, console, data, network, identity, and monitoring. Keeps merchant records in its estate.
Security and compliance built around your boundaries.
Box runs in your environment, keeps merchant records in your estate, and leaves payment capture with the provider your institution has already approved.
Responsibility boundaries
Where each control sits.
Approved providers
Handle payment capture, authorization, settlement, card data, and provider credentials.
Box services
Run licensing, registry, and package delivery without processing merchant traffic or card data.
Reduce disputes and ambiguity across merchant journeys.
Retail
Keep orders, payments, refunds, and receipts attached to one record.
Explore in-person commerce →
Food and service
Give operators a complete timeline when a customer questions a transaction.
Explore Commerce Engine →
Online commerce
Keep checkout evidence connected to fulfilment and customer activity.
Explore Website →Unsure where a control sits? Let’s map it.
Start a security reviewReview the supporting material.
Box provides technical information about its software and deployment model. Institutions remain responsible for their own legal, regulatory, certification, and compliance assessments.