Content management firm Box is making Singapore its first step into Southeast Asia, betting that the city-state’s mature digital economy and growing AI adoption make it the right base for regional growth.
The move builds on Box’s experience in Japan, where it has operated since 2013. Japan now accounts for 25 percent of its FY2026 revenue, second only to the US at 62 percent.
As in Japan, Box will grow in Singapore mainly through partners, with Netpoleon as distributor and resellers including Chass Asia, Hitachi, NCS, NTT, and SoftwareOne. It has more than 300 customers in Singapore — from a 10,000-strong financial institution to an asset management fund and a telecommunications firm.
Central to this expansion is Box Zones, which lets customers store content and process uploads, downloads and file encryption within Singapore while still collaborating globally. On September 23, the service was awarded MTCS Level 3 certification, the highest tier of Singapore’s cloud security standard and a key requirement for public sector and regulated industries. Singapore joins Australia and Japan as Box’s in-region locations in Asia-Pacific.
Instead of selling AI models itself, Box provides a secure layer that connects enterprise content to leading AI models and agents, with granular access controls, model isolation and prompt injection detection built in. Pricing is per user rather than by token consumption.
That governance focus is timely. Box’s State of AI in the Enterprise 2026 report shows that 73 percent of organisations worldwide now have established or advanced AI governance, an increase of 24 percent from 2025. Yet, an Okta research shows only 31 percent are confident they could detect an AI agent acting outside its intended scope.
Rand Wacker, Vice President of Product Strategy at Box, said agents sometimes pose a different kind of risk from malicious human actors. “Sometimes these agents do it accidentally, and people don’t intend for that to happen,” he said. To counter this, Box has built agent guardrails that limit what an agent can do, monitor its behaviour, and cut it off if it appears to act maliciously.
As Box hosts the data and keeps unlimited file versions, even accidental deletions can be reversed. “If something was to get deleted, then we can restore it immediately,” Wacker said, citing the company’s rapid recovery from ransomware incidents where others have been knocked out for long periods.
