What Management OS does with your Box files.

• File and folder metadata — names, paths, timestamps, sizes — for the picker surface. Enables browse and search without downloading content
• Content of files you select — when you explicitly pick a file in the File Source Picker, that file's content is downloaded so it can become context for the output you're generating
• Shared and collaborated folders — Box surfaces shared content the same way owned content is surfaced; the picker reflects everything the leader's Box account can already see

Management OS does not write to your Box account. Our app registration carries no write or admin permissions. We cannot create, modify, share, move, or delete any file or folder in Box.

All Management OS outputs (Account Plans, Coaching Briefs, Forecast Locks, Meeting Prep dossiers, Pitch Decks) are generated and stored inside Management OS's own database and surfaced through the Management OS application — never written into your Box account.

Box scopes work differently from Google or Microsoft: they're configured at the application level in the Box Developer Console, not passed in the consent URL. Whatever the app is registered with is what every consent grants — there's no per-user widening. Our scope configuration is documented below and stored in lib/box/oauth.ts → BOX_SCOPES for in-app reference.

Application database: Supabase Postgres (Management OS's production database, US East). Encrypted at rest (AES-256), encrypted in transit (TLS 1.3). Workspace-scoped row-level security (RLS) means one customer's data is never visible to another.

OAuth tokens: Stored in Supabase under workspace-scoped RLS. Box access tokens are valid for ~60 minutes; refresh tokens are valid for 60 days and rotate on each refresh. Both are encrypted at rest and never returned to client browsers. Only the Management OS server-side runtime can read them.

File content: When you select a file through the picker, its content is read into memory for the inference call. We persist the extracted text used as context for the specific output you generated, alongside that output. We do not maintain a parallel copy of your Box account.

Inference layer: Anthropic API (Claude models). File content required for a specific output is passed to Anthropic at inference time; outputs are returned to Management OS and stored in our database. Anthropic does not train on customer data per their API terms.

Retention: We retain Box-sourced extracts while your subscription is active. On disconnect we revoke the access token at Box (best-effort) and delete the stored OAuth tokens immediately. On subscription cancellation, customer data is retained for 30 days for restoration, then permanently deleted. Data subject deletion requests are honored within 30 days per our Privacy Policy.

1. Sign up at mgmt-os.ai and complete onboarding to your workspace
2. Open Management OS → Settings → Integrations
3. Find Box in the integration directory and click Connect Box
4. You'll be redirected to Box's authorization screen. Sign in with the Box account you want Management OS to read from
5. Review the requested access ("Read all files and folders stored in Box") and click Grant access to Box
6. You'll return to Management OS with a confirmation. Box will appear as a source in the File Source Picker

Box Enterprise admin notes: if your Box admin has restricted third-party app access, they may need to approve Management OS in the Box Admin Console (Apps → Custom Apps Manager → Authorization required) before users can connect.

Universal File Source Picker: Box shows up as a source alongside Google Drive, OneDrive, SharePoint, Dropbox, and any other file source you have connected. When you generate an Account Plan, Pitch Deck, Coaching Brief, or Meeting Prep dossier, you can pick which Box files feed in as context. Files you don't pick don't get read.

The Weekly Intelligence Brief uses three pillars that span every source:

• Develop Your Business — customer SOWs, contracts, and account plans stored in Box enrich the Brief's view of priority accounts
• Develop Your Team — coaching context and rep development plans stored in Box become part of 1:1 prep
• Develop Yourself — board decks, strategic memos, and operating documents in Box surface relevant decision context to the leader

Ask Anything (AMA) — you can reference Box files in plain-English queries: "pull the renewal SOW for Acme from Box and tell me the auto-renewal date."

1. Open Management OS → Settings → Integrations
2. Find Box in the connected integrations list
3. Click Disconnect → confirm

On disconnect we revoke the access token at Box (best-effort) and delete the stored OAuth tokens immediately. Previously generated outputs that used Box content remain in your Management OS workspace as historical records.

To remove all Box-sourced extracts and historical outputs after disconnect, email privacy@mgmt-os.ai with your workspace identifier. We process deletion requests within 30 days.

1. Sign in to app.box.com with the Box account that authorized Management OS
2. Click your profile (top-right) → Account Settings
3. Open the Apps tab → Authorized Apps
4. Find Management OS in the list and click Disable (the button is labeled Reauthorize / Disable depending on current state)

Box admin path: a Box Enterprise admin can remove the app for the whole enterprise from Box Admin Console → Apps → Custom Apps Manager → Management OS → Disable.

Revoking from Box's side invalidates our tokens immediately. Our next API call returns a 401 and we surface a re-connection prompt in Management OS Settings.

Security incident reporting: security@mgmt-os.ai
Privacy / data subject requests: privacy@mgmt-os.ai
Integration support: support@mgmt-os.ai

For general questions about Management OS, see our Support page or Manifesto.