Trust
What BoxAI checks, stores and promises
Plain answers for whoever reviews BoxAI before your team uses it: security, compliance or procurement.
Every value passes the checks real systems run
- Emirates IDs: 15 digits starting 784, with the birth year and a correct Luhn check digit.
- IBANs: the ISO 13616 mod-97 check, with the right length for each country.
- Tax numbers: 15-digit UAE TRNs; Saudi VAT numbers start and end with 3.
- Money: every total is subtotal plus VAT, to the fils or halala.
- Links: every foreign key points at a real parent row.
- E-invoices: UBL 2.1 for the UAE and Saudi Arabia, with broken copies whose fault is named in a manifest.
Each check has an automated test that runs before every release, and the box Code tab has ready-made scripts to run the same checks on your data.
No real people, ever
Every name, ID, account and company is made up. Formats follow national rules, so values look real and pass validation, but none belongs to anyone.
Dubai's Synthetic Data Framework (Digital Dubai) encourages synthetic data for safe testing and sharing. BoxAI follows the same idea; it is not certified against the framework.
Where data is kept
Generator downloads are never stored: data is made for your request and sent straight back.
Boxes keep their files and run history with our cloud hosting provider until you delete them or they expire. We cannot yet promise that this data stays in the UAE, so keep anything that must stay in the UAE out of boxes. Since box data is synthetic, most teams don't need it to.
API keys are stored only as SHA-256 hashes. Card details go to Stripe and never reach BoxAI.
Security
A strict content security policy, rate limits on every public route, scripts in boxes run in a restricted interpreter with no network or file system, and hard daily caps on every paid resource.
Found a problem? Our security page explains how to report it.
What BoxAI is not
Test data and fixtures, not a compliance product: using BoxAI does not by itself make a system compliant with any regulator. E-invoice packs are test fixtures, not certified, and never for submission to the FTA or ZATCA.
BoxAI Test Data is not affiliated with Box, Inc. or its Box AI product.