Loading…
Search the Dropbox Watchdog archive
Reference
Direct answers to the questions people actually ask about Dropbox — sourced from Dropbox's own help documentation and this archive's documented record.
Quite a lot, by design. Dropbox's own help documentation says the Dash browser extension requires the broad permission to "read and change all your data on all websites," plus a separate permission to read your browsing history — and Dash's privacy documentation says it imports up to 90 days of that history to power its AI search.
Read the full answer →A real dropbox.com share link is a legitimate file host, not a scam by itself. But that legitimacy is exactly what phishers exploit: this archive documents years of criminals hosting credential-harvesting pages on Dropbox's own domain, and building convincing fake Dropbox login pages, so the link — or the email carrying it — looks completely genuine.
Read the full answer →It depends entirely on your plan. Dropbox's own help documentation gives three tiers — 30, 180, or 365 days of file-recovery window depending on your plan — after which deleted files are marked for permanent deletion and can't be recovered. Dropbox's help center doesn't state a retention period for how long personal or team activity-log entries themselves are kept.
Read the full answer →There is no evidence that it is, as of 6 September 2026. An independent compliance tracker found no Dropbox listing in the FedRAMP Marketplace in August 2026, and Dropbox's own compliance page lists SOC 2 Type II, ISO 27001, HIPAA business-associate agreements, GDPR, and PCI DSS — with no mention of FedRAMP or CMMC anywhere on that page.
Read the full answer →Yes. Between 4 and 21 August 2026, an attacker used a flaw in Lenovo's own email-verification process — not a flaw in Dropbox's password system — to register a Lenovo ID on a victim's email address, and Dropbox's 'Continue with Lenovo' sign-in link then trusted that identity without asking for a Dropbox password, reaching roughly 5,000 linked Dropbox accounts.
Read the full answer →These answers are informational, not legal or security advice. Dropbox Watchdog is independent and not affiliated with Dropbox, Inc.