Is Dropbox Dash safe for work?
Low risk · 11Dropbox · Search · facts (medium-confidence)
Dropbox Dash is low-risk for default at-work use (11/100): it does not train on your data, and holds SOC 2 Type II.
11
Low risk
Watch out: Dash inherits Dropbox's compliance stack (SOC 2 Type II, its own ISO 27001 certificate and a dedicated subprocessor list) and states content is not used to train third-party models, with a 90-day retention window. Dropbox explicitly excludes Dash from HIPAA BAA coverage, so it is not suitable for PHI on any plan.
Data and compliance facts
- Trains on consumer-tier data
- No
- Trains on business-tier data
- No
- Training opt-out available
- Unverified
- SOC 2 Type II
- Yes
- ISO 27001
- Yes
- ISO 42001 (AI management)
- Unverified
- GDPR Data Processing Addendum
- Yes
- HIPAA BAA
- No
- EU data residency
- Unverified
- SSO / SAML
- Yes
- Data retention
- 90-day retention window for content processed through Dash before deletion.
- Safer tier
- Business or Enterprise (note: no HIPAA BAA for Dash on any tier)
Why it scores 11 out of 100
- +11HIPAA BAA. A Business Associate Agreement, required for protected health information.