2021

ESG Impact
ReportDropbox2021 ESG Impact Report1

A message from our CEO
Dear colleagues, customers, investors,
and partners:
At Dropbox, our mission is to create a moreenlightened way of working. We can only succeed
if all of our stakeholders—customers, employees,
shareholders, partners—are able to thrive. The past
few years certainly have been challenging. Despite
that, communities have demonstrated remarkablecourage, strength, and resilience in overcoming
hardship and seeking solutions for a better future.
At Dropbox, we believe that there’s never been agreater opportunity to put the well-being of people
front and center in the way we build products andconduct business.
To accomplish this, we at Dropbox are committed
to achieving our sustainability goals, investing insocial impact initiatives, and being a force for good
both inside and outside our (virtual) walls. I’m proud
to share our inaugural Environmental, Social, andGovernance (ESG) Impact Report. A lot of this work
has been going on behind the scenes for years, so I’m
excited to share our progress publicly for the first time.
We know we have more work to do and are committed
to being transparent as we build upon our efforts.
Over the last few years, we’ve invested heavily in
our people, shining a light on the need for flexible
work options and increased employee wellness in
the remote environment, as well as investing inour diversity, equity, and inclusion efforts. We’ve
created a new way of working through our VirtualFirst operating model—allowing employees more
flexibility in how and where they work, and enabling
us to significantly expand our recruiting footprint.
We’ve made substantial headway on our 2020
sustainability goals by sourcing 100% renewable

2021 ESG Impact Report

Drew Houston
Co-founder & CEO, Dropbox

energy for all of our data center IT power. Thismeans our users can store data with us, knowing it’scovered by 100% renewable electricity. In addition,
last year Dropbox became a signatory to the United
Nations Global Compact (UNGC) on human rights,
labor, environment, and anti-corruption. In doing so,
we’ve integrated the UNGC and its 10 principles into
our strategy, culture, and day-to-day operations.
I’m also humbled by the work of our Dropbox
Foundation partners. These organizations promote
and protect human rights by fighting for equal
opportunity, basic freedoms, and fundamental
necessities for people around the world. Witnessing
their impact, particularly throughout the pandemic,
gives me hope for the future. We’re honored tosupport them.
I believe that business is uniquely positioned tocreate positive change in society, change that is also
important to our own success. We’re working hard
to seize on that unique opportunity at Dropbox, andI look forward to continuing this journey.

2

Table of Contents

4

About Dropbox

8

About this report10

Our ESG priorities andstrategy

16

Environmental

27

Social45

Governance61

Appendix

2021 ESG Impact Report3About Dropbox

05

We're creating a new way of working

06

Our products and notable awards07

Our values and culture

2021 ESG Impact Report4

We're creating a new way of working

About Dropbox

Dropbox is one place to keep life organized and keep work moving. We were foundedin 2007 with a simple idea: Life would be a lot better if everyone could accesstheir most important information anytime from any device. Over the past 15 years,
we’ve largely accomplished that mission by building tools to help people work fromanywhere—and along the way we recognized that for most of our users, sharing andcollaborating on the Dropbox platform was even more valuable than storing files.

2021 Stats

2,667*EMPLOYEES9

CENTERS$2.15 BREVENUE

700 M+REGISTERED USERS

San Francisco

Today, we're reimagining the way work gets done. We’re focusing on
reducing the inordinate amount of time and energy the world spends on“work about work”—tedious tasks like searching for content, switching
between applications, and managing workflows. The Dropbox platform
breaks down silos by centralizing the flow of information between
the products and services our users prefer, even if they’re not our own.
In a world where using technology at work can be fragmented anddistracting, the Dropbox platform makes it easy to focus on the workthat matters.
But there’s more to our success than simply building great products.
Our actions have impact, and we believe our long-term success depends
on supporting equity and sustainability for our users, our employees, andour communities. Dropbox only succeeds if our stakeholders succeed.
And we believe accomplishing our environmental, social, and governanceobjectives is essential to that success.

HEADQUARTERS

DBX
NASDAQ*2,293 were in the United States, and 374 were outside of the United States

2021 ESG Impact Report5Our products and notable awards

About Dropbox

Voropbox
Dropbox DocSend>CDropbox Sign

•
~BEST

:::,~.!~PLACESTO WORKPOUIIO'-TlOI!

2021 ESG Impact Report

Dropbox named one of the “Most Innovative
Companies” in 2022 by Fast Company.

Dropbox named “Best Place to Work for LGBTQ
Equality” for the 8th year in a row.

6

Our values and culture

About Dropbox

Values are a compass and part of everyday life for Dropbox employees. Since ourfounding, we’ve recognized the importance of values and made sure that they’re built
into everything we do—from how we create new products and support our users to
the ways we interact with and advocate for each other. Every value at Dropbox is anaspiration for how we treat each other and our users.

e

1. Be Worthy of Trust.

4. Own It.

Integrity is the foundation of our culture.
We strive to always do the right thing.

We take responsibility for our work, fromstart to finish. We learn from our mistakes
and keep going—until we have real impact.

2. They Win, We Win.

5. Make Work Human.

Our users come first. When they succeed,
our business (and everything else) falls

Our mission is to design a more enlightened
way of working. So we make products thatprioritize our needs as humans and build
a compassionate culture where employees

into place.

3. Keep It Simple.
Simple things work better—and make more
sense. We don’t over complicate life at
Dropbox, whether it’s a plan or a process.

2021 ESG Impact Report

can do their best work—no matter who they
are or where they’re from.

7

About this report

2021 ESG Impact Report8About this report

This 2021 Dropbox Environmental, Social, and Governance (ESG) Impact Report isour first ESG report, building on the ESG Fact Sheet we released last year. Even
though much of this work isn’t new, we’re still just getting started building our
ESG infrastructure. To develop this report, Dropbox consulted with a broad range
of internal and external stakeholders, including investors, Dropbox employees andexecutives, and users.
Reporting frameworks

Online content

The contents of this report are informed by our
ESG priority assessment, which was informed by
the Global Reporting Initiative (GRI) standards.
Our sustainability reporting is aligned with the
Sustainability Accounting Standards Board (SASB)
standards. Dropbox is a signatory of the UN Global
Compact (UNGC), and this report also serves as
our UNGC Communication on Progress (CoP).

Additional content related to the Dropbox ESG
program can be found online at www.dropbox.com/esg.

Reporting period and boundary
This report includes information on Dropbox’s
ESG performance from January 1, 2021, throughDecember 31, 2021, unless otherwise indicated.
The boundary of this report includes the activities
of Dropbox, Inc. and its wholly owned subsidiaries.

Assurance
Dropbox received a limited assurance verification of
our greenhouse gas (GHG) emissions performance,
disclosed in this report, from Apex Companies, LLC.
A copy of the assurance statement is available here.

2021 ESG Impact Report

Forward-looking statements
Certain statements in this report constitute “forward-looking
statements,” which are made pursuant to the safe-harborprovisions of Section 21E of the Securities Exchange Act of 1934and other federal securities laws. These statements are based on
management’s opinions, expectations, beliefs, plans, objectives,
assumptions, or projections regarding future events or results
as of the date of this report, including, but not limited to, our
ESG commitments, strategies, and initiatives and the impact of
those commitments, strategies, and initiatives on our business;our business plans and strategy; our business operations; ourtechnology and services; our opportunities for growth; andour stakeholder engagement efforts. These forward-looking
statements are only predictions, not historical fact, and involvecertain risks and uncertainties, as well as assumptions. Actual
results, levels of activity, performance, achievements, and events
could differ materially from those stated, anticipated, or impliedby such forward-looking statements. While Dropbox believes
that its assumptions are reasonable, there are many risks anduncertainties that could cause actual results to differ materiallyfrom forward-looking statements, including the risks discussed
under the heading “Risk Factors” in our Annual Report on Form
10-K for the year ended December 31, 2021, filed with the U.S.
Securities and Exchange Commission (SEC) as well as otherfactors described in our filings with the SEC. Dropbox undertakes
no obligation to update or revise any forward-looking statement
contained in this report, except as otherwise required by law.

9

Our ESG priorities
and strategy
11

ESG highlights

12

Our ESG priority assessment

14

ESG commitments

2021 ESG Impact Report10ESG highlights

ESG priorities and strategy> 100% renewable energy1> 98% YoY reduction in Scope 1, Scope 2 (market-based), and Scope 3
business travel emissions2

Environmental> Achieved carbon neutrality for Scope 1, Scope 2 (market-based), andScope 3 business-travel emissions> 42% of senior leaders are women> 12% of workforce identifies as an underrepresented minority (URM)3> Co-developed the Black Equity Index to drive change in racial equality
in the workplace

Social

> $1.68 million total employee donations and corporate gift matching> Our partner, the Dropbox Foundation, donated $1.3 million to humanrights organizations> Completed first ESG priority assessment, mapping a path forcomprehensive management of ESG issues and transparent reporting> Delegated oversight of ESG activities, programs, and disclosures toGovernancethe Nominating and Corporate Governance committee of our board of
directors in May 2022

> Delegated oversight of human capital management activities to theCompensation committee of our board of directors in May 2022

1Renewable energy goals and performance reflect electricity use for corporate offices and data center IT load. Direct combustion fuels(e.g., natural gas, diesel) and data center heating and cooling energy (outside of Dropbox's control boundary) are excluded.
2GHG Protocol provides the following definitions for Scope 1, 2, and 3 emissions:
SCOPE 1: Direct greenhouse gas emissions that occur from sources that are controlled or owned by an organization.
SCOPE 2: Indirect emissions associated with the purchase of electricity, steam, heat, or cooling.
SCOPE 3: Emissions resulting of activities from assets not owned or controlled by the reporting organization, but that the organization
indirectly impacts in its value chain. Scope 3 emissions include all sources not within an organization's scope 1 and 2 boundary.
SCOPE 3 Business Travel Emissions: This category includes emissions from the transportation of employees for business related
activities in vehicles owned or operated by third parties, such as aircraft, trains, buses, and passenger cars.
Market-based emissions: A market-based method calculates emissions based on the electricity that organizations have chosen topurchase, often spelled out in contracts or instruments like Renewable Energy Certificates (RECs).
3At Dropbox, underrepresented minorities (URMs) are defined as Black/African American, Hispanic/Latinx, Native American, or Pacific Islander.

2021 ESG Impact Report11Our ESG priority assessment

ESG priorities and strategy

We believe long-term success at Dropbox depends on helping to create a more
equitable and sustainable world for our stakeholders. And that begins with assessing
impacts, setting priorities, and creating a strategy for improving our performanceacross environmental, social, and governance topics.

To inform our ESG strategy and reporting, we
conducted a priority assessment in 2021 to identify themost important ESG topics for our business, basedon the views of external and internal stakeholders,
including investors and users. The process was led
by our Social Impact team, which handles Dropbox
philanthropic and sustainability initiatives, withsupport from an external sustainability expert.
We identified 34 ESG topics that we believe aremost relevant to Dropbox, and used a survey tocollect data on our perceived impacts on each topic,
together with the relative importance of each topic
to our stakeholders. We collected data from four
stakeholder groups: employees, internal leadership,
users, and investors. We validated the survey results
through discussions between our Social Impact
team and leadership. These priority topics were
subsequently approved by internal leadership anddiscussed with our board.

2021 ESG Impact Report12Our ESG priority assessment

ESG priorities and strategy

Through this assessment, we narrowed the list to 12 ESG priority topics, which inform the content of thisreport. We’ll conduct this process regularly to reassess priorities and evaluate our performance.
The next step of the journey is to develop a comprehensive ESG strategy that is in line with our businessstrategy and identifies important risks. Cross-functional working groups and expertise will drive progress
toward our ESG goals.

Dropbox priority topics

Environmental impact

Employee experience

IT infrastructure sustainability
Energy, emissions, and climate
Talent attraction and engagement
Employee health, safety, and well-being
Diversity, equity, and inclusion

Diversity, equity, andinclusion

Equal pay and wage gap
Accessibility
Business ethics and integrity

Ethical businesspractices

Privacy and data
security

2021 ESG Impact Report

Product responsibility and data ethics
Human and labor rights
Privacy and data security
Risk management

13

ESG commitments

UN Sustainable
Development Goals

ESG priorities and strategy

The United Nations Sustainable Development Goals (SDGs) are a set of 17
goals aimed at sustainably achieving peace and prosperity for people and theplanet. We support these goals through our commitment to the UNGC andaspire to further integrate the SDGs with business operations going forward.

s
SUSTAINABLE
DEVB.OPMENT

GALS

2021 ESG Impact Report

14

ESG commitments

Sustainability goals

ESG priorities and strategy

In 2020, we set the following Sustainability Goals for 2030:
1.

Achieve carbon neutrality for Scope 1 and Scope 2 (market-based)emissions, as well as Scope 3 business travel emissions

2. Source 100% renewable energy for operations, including data centers1,2
3. Support organizations working for climate action, such as the Natural
Resources Defense Council and the Environmental Justice Foundation3
4. Mobilize employees to use volunteer time off for environmental causes

Diversity, equity, andinclusion goals

At Dropbox, diversity, equity, and inclusion (DEI) are infused in our culture.
In 2021, we focused on how to further incorporate DEI into our Virtual First
operating model.
In addition to sustainability goals, we have three multi-year
diversity commitments:
1.

Hire a diverse team

2. Develop and advance people equitably
3. Engage in personal growth

1Our renewable energy goal reflects electricity use in corporate offices and data center direct IT load, and excludes direct combustion fuels(e.g., natural gas, diesel) and data center heating and cooling (outside of Dropbox control boundary). This includes the use of renewableenergy credits (“RECs”) to cover our energy consumption. We achieved our goal to source 100% renewable energy by reducing our energy
needs as described and purchasing enough RECs to cover our remaining corporate office and data center direct IT electricity consumption.
2More than 90% of our users’ data is stored on our own infrastructure in our data center colocation facilities. We utilize Amazon Web
Services (AWS) for the remainder of our users’ storage needs and purchase RECs to cover energy used by AWS on behalf of Dropbox.
3We support the Environmental Justice Foundation through our partner, the Dropbox Foundation, and employee gift matching.

2021 ESG Impact Report

15

Environmental

17

Energy efficiency and renewables

25

Case Study

26

Electronic waste

2021 ESG Impact Report16

Energy efficiency and renewables

Environmental

Dropbox relies on data centers in order to run our business, and use of electricity
is one of the largest causes of our greenhouse gas emissions. Proper energy
management is an important component of operating our business in a sustainable
manner. That is why we’ve set a goal of sourcing enough renewable energy to meet
100% of our electricity consumption, including corporate offices and data center
IT power. To reach this goal, we’ve taken a multitiered strategy of improving energy
efficiency, working with property managers to directly source renewable energy forcolocated data centers, and purchasing renewable energy certificates (RECs) for
the rest of our energy footprint.

Facilities and studios

In April 2021, we transitioned to a Virtual First operating model in whichremote work is the primary mode for employees. We also believe in-person
connection with teammates is incredibly important, so we optimized
our offices as “studios” for that purpose. In addition to sourcing renewableenergy for our data centers, we’re also focused on reducing energy
consumption within studios by occupying sustainability-certified space
wherever possible. In 2021, 79% of our office/studio footprint was coveredby either LEED Platinum or LEED Gold certification, and our San Francisco
location was both LEED and WELL certified.
Overall, the shift to Virtual First has allowed us to reduce total office space.
We’re still working to understand how the remote work model—including
employees’ at-home energy consumption—will affect our total energy
consumption and emissions.

2021 ESG Impact Report17

Energy efficiency and renewables

2021 performance

Environmental

In 2021, we reduced total energy consumption in leased offices/studios anddata centers by 26% from 2020. Data-center energy use decreased 25%
from 2020 to 2021 due to switching to newer, more efficient servers. The 47%
reduction in energy use in leased offices/studios was largely due to the shift
to Virtual First, which led to reductions in overall leased space and resource
use in the remaining locations. Total energy use, shown below, includes
natural gas, diesel in emergency generators, and purchased electricity.
We’re proud to report that in 2021, we sourced 100% renewable electricity
for our directly-managed offices/studios1 and our data center direct IT load.

Energy Use
200,000
180,000
160,000

8,520

14,907(MWh)

140,000

7,906

120,000
100,000
80,000167,659

167,579
126,447

60,00040,00020,0000
2019
Data Centers

2020

2021
Corporate Offices

1Excludes serviced offices/studios, which fall under our Scope 3 emissions.

2021 ESG Impact Report18

Energy efficiency and renewables

IT infrastructure
sustainability

Environmental“Data centers are critical to our business, but we know
they can also be energy intensive. We’re taking accountability for our emissions and reducing our impact. Not
only is renewable energy a primary focus for our data
center strategy, we’re also doubling down on reducing
our emissions through innovative technologies.”— LATANE GARETSON, HEAD OF DATA CENTER PHYSICAL INFRASTRUCTURE
In 2020, we committed to sustainability in IT infrastructure. We set a goalof carbon neutrality for Scope 2 emissions, including those from our data
centers, as well as a goal of sourcing renewable energy that covers 100%of electricity consumption, including at data centers.
While sourcing renewable energy is an important component of our ESG
strategy, we know that reducing overall consumption of energy is just as
important for our long-term sustainability goals. The Dropbox PhysicalInfrastructure team is responsible for managing the lifecycle of our
network and server fleet and for monitoring the facilities in which they
reside. The team is focused on maintaining our position as one of the
top global performers for power usage effectiveness (PUE) and overall
power consumption.
We are actively working with our landlords to ensure that the spaces we use
are state of the art in terms of energy efficiency. Currently, five of nine data
centers have been certified for energy efficiency by EnergyStar, and three
have earned at least LEED Gold certification.

2021 ESG Impact Report19Energy efficiency and renewables

Environmental

We’re also enhancing our server design and management. One way of
optimizing consumption is by quickly powering down decommissioned
hosts. At the data centers, we have a continuous flow of servers reaching
their end of life. We used to decommission servers manually, but now we’releveraging a new system created in-house called Pirlo, which automaticallypowers down a server host after it’s out of service. This has saved us anestimated 5% in power over each server’s lifespan. We also have servers that
sit in an idle state yet still use power. To address this, we’re in the processof introducing a new state in the data centers—hard-drive disk (HDD)
standby—which will yield power savings of 25% to 50%, depending onserver type, while still allowing the servers to be accessible when needed.
In 2021, we saw an increase in energy efficiency at our data centers. We now
operate them at a PUE level well below industry average.

Data Center PUE Benchmark
1.8
1.6
1.4
1.2

1.53
1.27

1.32

1.2

1.1

1.1

1.59

1.18

1.0
0.8
0.6
0.4
0.2
0
Dropbox Dropbox Dropbox Google Facebook Microsoft
2019
2020
2021

2021 ESG Impact Report

IBM

Globalaverage20

Energy efficiency and renewables

Greenhouse gas
emissions

Environmental

Dropbox measures direct and indirect GHG emissions from energy consumption in our facilities and our data centers, and fugitive emissions fromrefrigerants—Scope 1 and Scope 2 GHG emissions. We also measure
Scope 3 GHG emissions from business travel.

GHG emissions by scope

2021

2020

2019
0

10,00020,00030,00040,00050,00060,000Metric tons of carbon dioxide equivalent (MTCO2 e)

Scope 12021 ESG Impact Report

Scope 2—Market-based

Scope 3—Business travel

21

Energy efficiency and renewables

2021 performance

Environmental

In 2021, we reduced absolute Scope 1 and Scope 2 (location-based)emissions1 by 31%, compared with 2020. Some of this reduction was due
to our shift to remote work. We also reduced emissions by transferring ourdata center loads to more efficient locations. Specifically, we moved out oflegacy data center designs to sites with lower PUE. We also optimized ourunderutilized sites by increasing capacity throughout the year.
We achieved the remainder of our carbon neutrality goal by procuring
renewable energy credits (RECs) to address scope 2 market-based
emissions and carbon offsets to cover scope 1 and scope 3 business travelemissions. The figure on the previous page reflects our scope 1, scope 2(market-based), and scope 3 business travel emissions prior to accounting
for carbon offsets.
The tables below compare procured energy attribute certificates (EACs)
with actual electricity use in 2021. We procured EACs to cover electricity
use in all leased offices/studios2, and to cover data center IT power in both
colocated and third party-operated data centers.

DATA CENTER
ELECTRICITY USE (MWh)DATA CENTER EACs (MWh)128,582

128,582

OFFICE/ STUDIOELECTRICITY USE (MWh)OFFICE/ STUDIO EACs (MWh)

3,198

3,198

1Location-based emissions are calculated using average electricity grid factors for each region
or sub-region and do not account for REC purchases. Market-based emissions are calculated
based on the electricity that organizations have chosen to purchase, often spelled out incontracts or instruments like RECs.
2Excludes serviced offices/studios reported under our Scope 3 emissions.

2021 ESG Impact Report22Energy efficiency and renewables

Environmental

The table below compares carbon offsets procured in 2021 with greenhousegas emissions.

SCOPE 1 EMISSIONS(MTCO2E)

SCOPE 3 BUSINESSTRAVEL EMISSIONS(MTCO2E)

PERCENTAGE OFCARBONEMISSIONS OFFSET

1,053

41

100%

While we’re proud of our achievements, we still have work to do. We’ll
continue to emphasize reducing overall emissions, favoring carbon
reductions over offsets, and seeking opportunities to partner with ourlandlords to directly procure renewable energy.

2021 ESG Impact Report23

Energy efficiency and renewables

Carbon-offset projects

Environmental

Our Social Impact team reviewed a wide range of carbon-offset projects
and selected several to achieve our carbon neutrality goals, reduce ourcarbon footprint, and make progress on the UN Sustainable Development
Goals (SDGs). We select offset projects based on the following guidelines:
1.

CERTIFICATION: We only select offset projects that undergo certificationor verification to ensure that they genuinely offset GHG emissions as
they claim.

2. CO-BENEFIT: We strive to support projects that not only reduce emissions
but also provide other positive impacts. Specifically, we prioritize projects
that achieve progress on as many UN SDGs as possible.
3. LOCATION: We’re a global company, and our partner Dropbox Foundation
supports human rights work all around the world. To that end, we aim for
geographic diversity in our projects.

PROJECT / PRODUCT NAMEPROJECT MARKET

CERTIFICATION/ VERIFICATIONTECHNOLOGY
TYPE

Acre Amazonian Rainforest Conservation
REDD+ Portfolio

BrazilClimate, Community, Biodiversity(CCB) Standard Verra VCS

Forestry

Bondhu Chula Stoves

Bangladesh

Gold Standard VER

Clean cookstoves

Acapa REDD+ Avoided Deforestation

Colombia

Verra VCS

Forestry

Agrocortex REDD

BrazilVerra VCS

Forestry

Crow Lake Wind Emissions Reduction

USA

Verra VCS

Renewable energy

Read about one of the projects we supported in 2021 on the following page.

2021 ESG Impact Report24Case study

Environmental

The Acre Amazonian rainforest is 90% forested, but at the current rate of destruction
it’s expected to drop to 65% by 2030. This collection of three projects is working
to prevent deforestation across 105,000 hectares of rainforest in the Amazon basin,
where some of the world’s most biodiverse habitats exist.
With the support of carbon finance, the projects work with local communities
and conservation groups to protect economies dependent on a healthy
ecosystem by providing alternative models of development.

Acre Amazonian Rainforest
Conservation REDD+ Portfolio
Project location
BrazilIn addition to protecting critical rainforest habitat and delivering approximately
360,000 metric tonnes of emissions reduction each year, this project delivers
several sustainable development benefits that are relevant to these UN SDGs:
No Poverty, Zero Hunger, Life on Land, Good Health and Well-being, Quality
Education, Decent Work and Economic Growth, and Life Below Water.

2021 ESG Impact Report

Project type
Natural climate solutions, forest
conservation
Quantity of offsets purchased
1,350 (mtCO2e)25

Electronic waste

Environmental

Maintaining resource efficiency and reliability in our data centers requires periodic
upgrades to IT hardware. It’s critical that we do our best to dispose of decommissioned
hardware responsibly.

We partner with a leading provider of services forrefurbishing and recycling electronic waste so that
IT hardware is handled responsibly and that asmuch material as possible is salvaged. Our recycling
partner first tries to repair broken equipment. Whenequipment becomes obsolete, most parts are either
repurposed or recycled.

Our total landfill diversion is 84% including compost
and recycling in studios, and recycled and resold IT
equipment from data centers.

2021 ESG Impact Report

1,000
900
800
700
short tons

In 2021, we achieved a 63% reuse rate for data
center hardware by refurbishing and reselling
decommissioned servers. The remainder of data
center IT equipment was recycled.

E-Waste Generated: Resold vsRecycled Servers

600
500

IT components
resold596 (63%)

400
300
200

IT components
recycled

100351 (37%)

0
2021

26

Social28

Our people

30

Talent attraction and engagement

31

Diversity, equity, and inclusion

36

Pay equity

37

Health, safety, and well-being

39

Philanthropy

42

Human and labor rights

44

Accessibility

2021 ESG Impact Report27

Our people

SocialAt Dropbox, we believe the strength of our workforce is one of the most significant
contributors to our success. We take immense pride in investing in our people, andstrive to cultivate a community that is authentic, inclusive, and connected. That’s
why we’re consistently cited as a leader in people-first culture, which celebrates andunderscores a commitment to our employees.

As we’ve navigated the ever-changing reality of
the world, we prioritized employee flexibility byofficially becoming a Virtual First company in April
2021. Remote work (outside of an office) is now
the primary experience for all employees and theday-to-day default for individual work. The Dropbox
studios are designed to provide space for in-person
collaboration and team gathering. While we’re stilllearning and adapting as we go, we believe VirtualFirst has promoted a more balanced and meaningful
way of life for our employees, and allowed us toexpand our talent pool by recruiting from a broader
set of locations.

2021 ESG Impact Report

We’ve also invested heavily in employee educationand development, offering robust opportunities
such as team effectiveness sessions to foster
cohesion, skills-building workshops, and coachingpods to support connection and peer learning in aremote context. Employees also have access to live
workshops, one-on-one coaching, and annual careerdevelopment days to support them.

28Our people

2021 Highlights

Social1.

CAREER DEVELOPMENT: In April, we held Career Development Days
focused on “Designing Your Virtual First Career.” Each week of themonth we focused on a different aspect of how employees can think
about their careers.

2. PERKS AND ALLOWANCE: In 2021, we started offering a flexible quarterly
allowance that can be used to cover expenses related to health andfitness, family and caregiver support, productivity and ergonomics,
financial wellness, and learning and development programs.
3. COMPANYWIDE PAID TIME OFF: To help facilitate work–life balance,
we now offer monthly companywide PTO days for full-time employees.
Having the entire workforce off at the same time helps reduce
notifications and pings so that employees can truly recharge.
4. ENGINEERING CAREER FRAMEWORK: This enlightening resource
describes what’s expected of engineers at every career level. We madethe framework available to the public last year to be transparent aboutleveling and career progression in the Engineering team at Dropbox.

2021 ESG Impact Report29Talent attraction and engagement

Social

We want all employees to grow, develop, and thrive in their careers here at Dropbox.
To help employees succeed here, we provide access to skills-building programs,
on-demand learning options, mentoring programs, and leadership courses.

We also offer extensive onboarding and training
programs to prepare employees at all levels for career
progression and personal development, including
how-tos for managing up, delivering constructive
feedback, and improving financial wellness.
In addition, we conduct a biannual engagement
survey called “Soapbox,” which provides employees
and company leaders with a formal channel forsubmitting feedback on what’s going well and where
we need to improve. In 2021, 90% of employees
responded to a Soapbox survey.

2021 ESG Impact Report

Total rewards—compensation andbenefits program
Our compensation program is designed to attract
and reward talented people who have the skills
necessary to support the business, contributeto strategic goals, and create long-term value
for stockholders. We provide employees withcompetitive compensation packages that include
base salary, annual incentive bonuses, 401(k) planwith company match, and equity awards tied to
the value of our stock price. Our highly competitive
benefits package includes medical, dental, vision,
life, and disability plans. In addition to these corepackages, Dropbox provides enhanced mental
health benefits, family formation benefits, and an
adoption and surrogacy assistance program. Thesecomprehensive programs also provide various leave
benefits—including 24 weeks for new parents.

30

Diversity, equity, and inclusion

Social

We want Dropbox employees to reach their full potential and reflect the diverse
customers we serve. We believe DEI is important to the success of our business.
We’re focused on building diverse teams and providing opportunities for all
employees at Dropbox to succeed.

We encourage employees to contribute to ouroverall DEI goals by committing to thesediversity commitments:• HIRE A DIVERSE TEAM: working with recruiters
to use fair and equitable processes during
screening, interviewing, and hiring.
• DEVELOP AND ADVANCE EQUITABLY:
providing equitable opportunity for growth anddevelopment at Dropbox.
• ENGAGE IN PERSONAL GROWTH: expanding
an individual's understanding of diversity in theworkplace, whether through trainings by the
DEI team or numerous opportunities each year
for learning through employee resourcegroups (ERGs).

2021 ESG Impact Report31Diversity, equity, and inclusion

2021 highlights

1.

SocialESTABLISHED AN HBCU PARTNERSHIP (historically black colleges anduniversities) with the Thurgood Marshall College Fund for internships
with the User Success team.

2. LAUNCHED THE DEI TRAILBLAZER AWARD, which recognizes employees
who’ve gone above and beyond to make Dropbox a more diverse,
equitable, and inclusive place to work.
3. HOSTED MORE THAN 60 VIRTUAL EVENTS and seven major awarenessmonths to engage, highlight, and educate communities and allies
across Dropbox.
4. COLLABORATED WITH OTHER COMPANIES in the tech industry todevelop the Black Equity Index, a set of standards for driving measurable
change, tracking true progress, and demonstrating commitment to racial
equity in the workplace.
5. PUBLISHED OUR ANNUAL DIVERSITY REPORT. We’ve published adiversity report every year since 2019
As we look ahead to the second half of 2022 and beyond, we’ll continue
investing in programs that promote DEI in the workplace, and help Dropbox
continue to diversify our workforce.

2021 ESG Impact Report32Diversity, equity, and inclusion

2021 diversity
performance

SocialIn 2021, we set an aspiration to maintain or exceed representation of
women and URMs at the mid-career level and higher due to an increasinglycompetitive talent environment. Setting these annual aspirations are key toachieving business objectives, increasing the quality of the work experience,and creating a stronger sense of belonging for all employees.
Over the past five years, we’ve seen an overall increase in representation forboth URMs and women at Dropbox, however in 2021, overall representation
for women was slightly down (year over year) and for URMs was flat (yearover year).
A key benefit of the Virtual First remote-work strategy is that we’re able toremove most geographic barriers to hiring within the United States, giving
us access to more-diverse talent pools. In 2021, we saw this reflected incandidates we interviewed and in new hires at all levels.
Our DEI team provides trainings and workshops that focus on topics such as
unconscious bias, creating an inclusive workplace, leading and developing
teams equitably, and much more.
DEI training progress to date:•••

2021 ESG Impact Report

62% of employees have completed the DEI fundamentals course
60% of people managers have completed inclusive leadership training
56% of managers have completed the DEI Pathways assessment

33

Diversity, equity, and inclusion

Board diversity

SocialAt Dropbox, we’re committed to maintaining an independent and diverse
board of directors. We believe that a diverse board strengthens the overall
company, giving us more unique knowledge and viewpoints, a more inclusivecompany culture, a broader view of risk management, and an enhanced
brand and business reputation through alignment of company values andactions. As of May 19, 2022, five of the eight members of our board weremembers of underrepresented communities (URC)1 or self-identified
as a woman.
The chart on the following page provides summary information about ourboard directors with respect to their diversity.

1Dropbox uses the following definition to define “member of an underrepresented community”: an individual who self-identifies asBlack, African American, Hispanic, Latino, Asian, Pacific Islander, Native American, Native Hawaiian, or Alaska Native, or who selfidentifies as gay, lesbian, bisexual, or transgender.

2021 ESG Impact Report34Diversity, equity, and inclusion

Social2022 board diversity snapshot1,2

Number of directors based on gender identity

FEMALE

MALE

3

5

0

1

1

1

2

3

NON-BINARYDID NOT DISCLOSE
GENDER

Number of directors who identify in any of thecategories below
African American or Black
Alaskan Native or Native American
Asian
Hispanic or Latinx
Native Hawaiian or Pacific IslanderWhite
Two or more races or ethnicities
LGBTQ+
Did not disclose demographic background

1As of May 19, 2022
2Categories are based on NASDAQ Rule 5606(a)2021 ESG Impact Report35

Pay equity

SocialDropbox pay structures are designed with equity in mind. We conduct annualcompensation reviews and promote pay equity across the company throughprograms, processes, and trainings.

Our compensation philosophy is based on the following principles:
1.
2.
3.
4.

Market competitiveness
Alignment to business and individual results
Fairness and equity
Alignment with Dropbox culture and values

At Dropbox, “fairness and equity” means that employee pay accurately reflects legitimate factors—such as
experience, performance, role level, and time in role—and is in line with the pay of similarly situated peers.

2021 ESG Impact Report36

Health, safety, and well-being

SocialDropbox is committed to a safe and healthy work environment for employees
and considers it a key component of continued success. This commitment is led
by the Global Physical Security and Safety team, which includes a Global Security
Operations Center (GSOC). GSOC helps employees whenever there’s an emergency
or incident, and is the main contact during a crisis response by Dropbox. GSOC
provides around-the-clock support for employees whether they’re in a studio, on abusiness trip, or at home.

At the start of the pandemic, we established Global
COVID-19 Workplace Health & Safety standards forwhen employees or other personnel needed to enterour offices or gather together. These standards
mandated locally compliant health screening,social distancing, and face covering and advised
all visitors to follow personal health and hygiene
best practices. The standards were reviewed andupdated as we received further guidance from publichealth authorities.

To holistically support employees during thetransition to Virtual First, we revamped our
employee program (Dropbox Cares) to bettersupport a distributed workforce. We provided
all employees with access to tools and resources
for creating a fully functional home office. This
included accommodations funds, ergonomic
best-practices guidelines, and online training.
Soapbox, the biannual engagement survey, also
helps refine our employee wellness anddevelopment initiatives.

In 2021, Dropbox implemented an array of digital
tools and working groups to expand wellness
resources for employees—emphasizing mental
health above all.

2021 ESG Impact Report37

Health, safety, and well-being

2021 highlights

1.

SocialLAUNCH OF THE WELL-BEING KIT: As part of the Virtual First initiative,
we launched a digital toolkit that helps employees guide, evaluate,
and incorporate well-being into their work and their personal life. Usefultips focus on strategies for rethinking unhelpful thoughts, managing
energy levels, and setting healthy boundaries.

2. VIRTUAL WELLNESS WEEK: Over 1,050 employees throughout the world
participated in 19 workshops.
3. IMPLEMENTATION OF THE MODERN HEALTH PARTNERSHIP: This
program ensures that our employees have access to an expanded arrayof mental health and wellness benefits. It includes up to eight sessions
each of therapy and eight sessions of coaching. Ninety-one percent of
employees who utilized the benefit reported an increase in health andwell-being as a result of the program.

2021 ESG Impact Report38Philanthropy

SocialAt Dropbox, we’re committed to leveraging our people, products, and resources
for good, which we believe positively contributes to our work culture and helps us
recruit and retain talented employees. We firmly believe that all people deserve alife that has dignity, freedom, and safety. Led by our Social Impact team, many ofour philanthropic initiatives are grounded in human rights and focus on supportingorganizations that fight for equal opportunities, basic freedoms, and fundamental
necessities for people around the world.

Dropbox for Good
Dropbox for Good is an employee-led group thatencourages people to use their skills and time toserve their communities. We provide 32 hours ofvolunteer time off per year, donations of Dropbox
products, and charitable gift matching up to $2,000
per year per full-time employee. Employee donations
and corporate gift matching in 2021 totaled$1.68 million.

Dropbox Foundation
We partner with the Dropbox Foundation, which
provides unrestricted grants and empowers Dropbox
employees to give back through skills-based volunteering. Learn more about the Dropbox Foundationin the 2021 Year in Review. As of December 2021,
the Dropbox Foundation had donated $4.22 million
to human rights organizations.

2021 ESG Impact Report39Philanthropy

2021 highlights

Social1.

IMPACT DAYS: Dropbox for Good launched a day of service for every
quarter, with both in-person and virtual volunteer activities. These
Impact Days encourage global Dropbox employees to use their “doing
good benefits”—volunteer time off, company gift matching, andproduct donations—to give to, learn from, and be immersed in theirlocal communities. With the help of global ambassadors, the leads ofDropbox for Good, and committed employees, we supported over 1,500
nonprofit causes, including Missing Maps, SF Marin Food Bank, CASA,
and Sydney’s Children’s Hospital. We also mobilized employees to use
volunteer time off for environmental causes such as Clean Coasts,
Forterra, and San Francisco Recreation & Parks.

2. DOING GOOD AWARD: We launched this award to recognize Dropbox
employees who are outstanding members in their communities andtaking some time to give back.
3. APPRENTICESHIP PROGRAM (FORMERLY KNOWN AS IGNITE):
Mentorship and hands-on learning opportunities are being provided
to new software engineers who have nontraditional computer sciencebackgrounds. We hosted 19 apprentices in 2021.
4. NEXT CHAPTER: We’ve sponsored two cohorts of apprentices from
Next Chapter, a program founded by Slack that provides opportunities
in the tech sector to formerly incarcerated individuals. We’re excited tocontinue this program at Dropbox with a third cohort in 2023.

2021 ESG Impact Report40Philanthropy

Social

5. EDUCATION PARTNERS: Dropbox employees have long supported local
schools and educational programs. Our main partners:

2021 ESG Impact Report•

San Francisco Education Fund: Supporting schools like Mission
High and Bret Harte Elementary through teacher-appreciation
months and in-kind donations such as technology and air purifiers.

•

Oakland Public Education Fund: Supporting Skyline High throughcareer panels, graduation sponsorships, and read-aloud activities
for heritage months such as Black History, Asian American andPacific Islander, and Pride.

•

Code Nation: (New York City, San Francisco Bay Area) The 2020–21
school year marked our first bicoastal partnership with Code Nation,
which we’ve been supporting for three years. Code Nation equips
students in under-resourced high schools with the skills, experiences,and connections that create access to careers in tech. In addition topartnering with students and schools in the greater New York area,
we also now work with students in the San Francisco Bay Area.

41

Human and labor rights

SocialDropbox is committed to the protection of internationally recognized human andlabor rights within our operations and supply chains. These efforts are importantto retaining many of our users and employees, and to maintaining our brand andreputation. As outlined in our Worldwide Code of Business Conduct and Ethics,
respect for all people and maintaining ethical working conditions and business
operations are integral to the work we do and reflective of the impact we strive
for. We prohibit all forms of slavery, human trafficking, and discrimination in ouroperations, and we strive to ensure that our policies and procedures are reflectiveof our commitment to human and labor rights.

Protection of human rights also includes protecting
against discrimination. Dropbox is committed toproviding equal employment opportunities for
all Dropbox employees and people who apply towork at Dropbox. We celebrate diversity and arecommitted to creating an inclusive environment.
We’re committed to promptly addressing reportsof discrimination and harassment.

The Supplier Code of Conduct establishes our
expectations of a supplier’s commitment tosafeguarding human rights in their own operations.
Within our operations and supply chains, we respect
employees’ rights to associate freely, bargain
collectively, join or refrain from joining labor unions,seek representation, and join workers’ councils.

We advise any employee who observes, suspects,
or is subjected to slavery or human trafficking,discrimination or harassment, or any other behavior
that violates our Worldwide Code of BusinessConduct and Ethics to immediately contact their
manager or human resources business
partner (HRBP).

2021 ESG Impact Report42

Human and labor rights

2021 and recent
highlights

2021 ESG Impact ReportSocial•DROPBOX BECAME A SIGNATORY OF THE UN GLOBAL COMPACT, joining
over 10,000 businesses that have entered a pact with the United Nations
to help solve major global issues such as protection of human andlabor rights. As a signatory of the UN Global Compact, we’re educating
employees about the UN SDGs and evaluating opportunities for further
embedding human rights protections into our supply chains.

•

For the eighth year in a row, Dropbox was named BEST PLACE TO WORKFOR LGBTQ EQUALITY using the Human Rights Campaign Foundation’s
Corporate Equality Index, a national benchmarking tool for corporate
policies, practices, and benefits pertinent to lesbian, gay, bisexual,
transgender, and queer employees.

43

Accessibility

Social

Our mission is to design a more enlightened way of working—for everyone who uses
our products. Inclusion is at the heart of our mission. The Dropbox for All initiative
is a commitment to making Dropbox more inclusive and broadens the possibilitiesof who can work together, how they can contribute, and what it means to be part ofa team. This means designing our products for people who have varying functional
abilities, and using a range of assistive technologies that make it possible for everyone
to access our tools and services.

2021 highlights

2021 ESG Impact Report

We saw tremendous advancements in the way we design for accessibility.
By directing new resources to these efforts in a proactive and time-sensitive
manner, we’ve enabled our products to continue meeting the needs of users
and promoted a better, more inclusive Dropbox experience.
•

VOLUNTARY PRODUCT ACCESSIBILITY TEMPLATE: By shifting thisreport from biannual to annual, we’re continuing to meet the WCAG 2.1
AA standard and ensuring the transparency of our accessibility efforts.

•

ENABLE: Launched in late 2020, the newest employee resourcegroup helps empower those who identify as challenged by visibleor hidden disabilities.

44

Governance46

Board of directors

48

Business ethics and integrity

51

ESG governance and oversight

52

Data privacy, security, and reliability

2021 ESG Impact Report45

Board of directors

Governance

At Dropbox, we’re committed to strong corporate governance to support our missionof creating a more enlightened way of working. It’s the duty of our board of directors
to exercise its power in the best interest of the company and our shareholders. Ourboard and its committees oversee management and set standards for ensuring that
Dropbox operates with integrity, business excellence, and ethical and honest conduct.

Board highlights•

87.5% of directors are
independent (as of May
19, 2022)•

One class of directors electedannually• Annual board and committee
evaluations•

Lead independent director

Dropbox had eight directors—seven of whom qualified as an “independent”
director—as of the date of our annual shareholder meeting (May 19, 2022).
Drew Houston, our chief executive officer and chair of the board, is notconsidered independent, as defined in the Nasdaq listing rules. Drew
has served as a board member and CEO for the past 15 years, and is best
positioned to identify strategic priorities, lead critical discussions, andexecute our business plans.
Because Drew is not an independent director, the board has determined—
in accordance with our Corporate Governance Guidelines—that it is in thebest interest of our shareholders to have a lead independent director topreside over meetings of the independent directors and help set the agenda
for board meetings. Donald Blair, a director since 2017, has served as leadindependent director since March 2020.
As discussed in the Board Diversity section above, our board of directors
is also diverse—five of our eight directors are members of an URC or selfidentify as a woman. At the time of our last annual shareholder meeting, theaverage tenure for directors was four years.
During the fiscal year ended December 31, 2021, the board of directors
held seven meetings. Each director attended at least 75% of the aggregateof (i) the overall board meetings held while they served as director, and (ii)the total number of meetings held by committees on which they served.

2021 ESG Impact Report46

Board of directors

GovernanceAlthough we don’t have a formal policy regarding director attendance at our annual shareholder meetings,
100% of our directors who then served on our board attended the 2021 annual meeting of our stockholders.

Board diversity snapshot1

Racial/ethnic diversity2

Director independence

1

3

7 out of 8

37.5%

■ independent

directors are
independent

directors are
members of
a URC■ non-independent■ member of an URC■ not a member of an URC
5

Director tenure

Gender diversity

1

1

3

37.5%
directors are
women

4 years■ femaleaverage tenureof directors■ male5■ <5 years■ 5–9 years■ >9 years

6

1As of May 19, 2022.
2Dropbox uses the following definition to define “member of an underrepresented community”: an individual who self-identifies asBlack, African American, Hispanic, Latino, Asian, Pacific Islander, Native American, Native Hawaiian, or Alaska Native, or who selfidentifies as gay, lesbian, bisexual, or transgender.

2021 ESG Impact Report47

Business ethics and integrity

Governance

At Dropbox, we’re not just changing the way people work—we’re designing a moreenlightened way of working, and it starts from within. Our Worldwide Code ofBusiness Conduct and Ethics (previously discussed in the Human and labor rights
section) reflects a belief that all work at Dropbox should be consistent with our values
and be held to the highest standards of ethical business conduct. Our values serve
as a compass, and we expect them to guide how we treat each other and our users.

The Worldwide Code of Business Conduct andEthics is designed to deter wrongdoing and promote
integrity, honesty, compliance with laws, rules, andregulations, fiscal responsibility, and accountability.
All employees are required to take an annual code of
conduct training, in addition to annual security andprivacy trainings. This training includes information
about policies for anti-corruption, anti-facilitation oftax evasion, insider trading, external communications,and global gifts. In 2021, 99% of full-time employees
completed this training.

Anti-corruption policy
Bribery, corruption, facilitation of tax evasion, andother unethical or illegal behavior are prohibitedby our Anti-Corruption and Anti-Facilitation of Tax
Evasion policy. All employees, officers, directors,
and contingent workers at Dropbox are required toseek approval from our Chief Legal Officer before
giving anything of value to a government official.
In addition, employees must comply with dollar

2021 ESG Impact Report

guidelines and exercise good judgment in accepting
or providing gifts, travel, or entertainment, and areencouraged to contact a member of the legal teamwhen in doubt about whether a gift is appropriate.
Vendors and resellers are required to go through an
FCPA (Foreign Corrupt Practices Act) compliancescreening prior to onboarding.
In addition to compliance screening, Dropbox standard
form agreements contractually require vendors andresellers to comply with applicable anti-bribery, anticorruption laws, and our company’s FCPA and AntiBribery Policy and Supplier Code of Conduct.

Anti-competitive behavior policy
At Dropbox, we want to win, and win fairly. We
strive to compete vigorously for business basedon the merits of our products and services anddetailed guidance can be found in our Worldwide
Code of Business Conduct and Ethics.

48

Business ethics and integrity

Governance

Whistleblower policy
We’re committed to having a workplace where
employees can report concerns free from any
harassment, discrimination, or retaliation in
violation of Dropbox policies.
As detailed in our Whistleblower Policy, if an
employee, officer, director, or contingent worker
discovers questionable behavior that might
violate our policies, they’re encouraged to report
it immediately by talking to their manager, humanresources business partner, our chief legal officer,
or our chief financial officer, or through ourthird-party whistleblower hotline, which can bedone anonymously.

2021 ESG Impact Report

All reported violations will be investigated, and specificactions will be based on the nature and gravity of the
conduct. The Audit committee directs and oversees
the investigation of significant complaints regarding
accounting and financial matters.
The Audit committee reports to the board when
there are significant complaints, including theresults of any investigation into a complaint andcorrective actions taken.

49

Business ethics and integrity

The board’s role in risk management
Risk is inherent with any business, and managing
it is critical to the sustainability of our company.
We face a number of risks and we’ve implemented
processes for addressing them. Managers are
responsible for day-to-day oversight of strategic,
business and operational, legal and compliance,
cybersecurity, and financial risks. The board of
directors, assisted by its committees, is responsible for our risk management framework, which
establishes priorities for managing the risks ourcompany faces.

Governance

The Nominating and Corporate Governancecommittee assesses risks related to corporate
governance practices, board independence,and potential conflicts of interest.
The committees regularly report on their risk
management efforts to the full board. The board
believes its current leadership structure is appropriate for its risk oversight responsibilities.

The Audit committee assists the board in fulfilling
its responsibilities for risk management in financial
reporting and disclosures, as well as in legal andregulatory compliance. The Audit committee also
oversees initiatives related to operational infrastructure—such as reliability, business continuity, cybersecurity, and data privacy—as well as enterprise risk
management. The Audit committee also discusses
risk assessment guidelines with managers and the
independent auditor.
The Compensation committee assesses risks related
to executive compensation plans and arrangements
and our compensation policies and programs.

2021 ESG Impact Report50

ESG governance and oversightGovernance

ESG governance and ethical business practices are a collaborative effort. Multiple
teams, with oversight from our board of directors, play a role in managing our
ESG governance structure. Ultimately, Dropbox employees share responsibility for
operating ethically.

In May 2022, the board approved an amendment
to the Nominating and Corporate Governancecommittee’s charter to delegate oversight ofDropbox’s ESG activities, programs, anddisclosures to its Nominating and Corporate
Governance committee.
The board also approved an amendment to theCompensation committee’s charter to delegate
oversight of Dropbox’s human capital management
activities to its Compensation committee.
Additionally, the Audit committee oversees initiatives
related to our operational infrastructure, particularly
reliability, business continuity, cybersecurity, and data
privacy, as well as our enterprise-risk management
program, which is further described in the “Role ofBoard in Risk Oversight Process” above.
The Social Impact team leads Dropbox’s internal
ESG working group, which consists of members
from the legal, investor relations, communications,policy, DEI, risk, and infrastructure teams.

2021 ESG Impact Report

This ESG working group is responsible for executing
on Dropbox’s ESG strategy. Senior leadership teammembers oversee the strategy and direction of the
ESG program as well as the ESG working group.

2021 and recent highlights•

Published the first ESG Fact Sheet, sharing datafor 2019 and 2020 performance•

Conducted ESG priority assessment and definedpriority topics•

Amended the Nominating and Corporate
Governance committee charter in May 2022
to delegate oversight of ESG activities,
programs, and disclosures to the Nominating
and Corporate Governance committee•

Amended the Compensation committee
charter in May 2022 to delegate oversight of
human capital management activities to theCompensation committee

51

Data privacy, security, and reliability

Governance“Be Worthy of Trust is our first company value, and we’re committed to keeping
it at the forefront of all we do. We’ve invested heavily in security and privacy
programs that keep your data safe, and we respect our users’ rights to access,correct, delete, and move their data.”— BART VOLKMER, CHIEF LEGAL OFFICER

Be Worthy of Trust is one of our company values—
the foundation of our relationship with the millions
of people and businesses around the world who rely
on Dropbox to protect their most valuable content.
Protecting our users’ information and emphasizing
privacy, security, and compliance is our top priority.
Our approaches to compliance, security, privacy, anddata protection are constantly evolving to respondto market changes as well as new challenges. Up-todate resources regarding compliance with security,
data storage, and privacy standards and regulations
are available on our website.

2021 ESG Impact Report52Data privacy, security, and reliability

Privacy: our commitment

GovernanceOur business model is built with a strong focus on user privacy. We don’tsell users’ data, and we don’t make any money from advertising. Our
Privacy Policy describes the handling and protection of user information,
including how we collect, use, and store your personal data when you use
Dropbox services. You can find more information in our Privacy and Data
Protection whitepaper.
Dropbox also enables business users to configure and monitor their accountin ways that meet their organization’s privacy, security, and compliancerequirements. Our shared responsibility guide can help business users
understand more about what we do to keep accounts safe, and what users
can do to maintain visibility and control over personal data.
PRIVACY GOVERNANCE
Our Privacy team is responsible for the Dropbox Privacy Program,
implementing key privacy initiatives, and ensuring that privacy is built
into all products and internal processes. The team reports to our boardof directors, Audit committee, and senior leaders from our information
security, legal, and information technology teams, including our chief
privacy officer, data protection officer, vice president of security, and chief
legal officer.
In accordance with the EU General Data Protection Regulation (GDPR),
we have appointed a data protection officer (DPO) who monitors how wegather, store, and process personal information in order to comply with
GDPR. Our DPO possesses independence, enabling them to drive change
in policies and practices.

2021 ESG Impact Report53Data privacy, security, and reliability

Security: protect andcontrol

Governance

Dropbox is designed with a secure and distributed infrastructure, withmultiple layers of protection. We work to protect user data and empower IT
administrators with tools that provide control and visibility. Our robust risk
management framework is designed to assess risks and build a culture of
security at Dropbox.
Dropbox infrastructure for files includes the components depicted below.

Block Storage se,ve,sPreviews Stora.g.e Servers•:•

P:eviews $tomg.e Service
PrjN1E1w
data stored in
cm;,yplod t.hu-nk$•

Block StoroSe Servlco
F1ledata stored in encr~pted blocks

Metadata

LJ-

Databases

Mctn,dJ)Hl Slorng,o $Ct'\l"lcernformoMn.aboutyoulfs.lOfedf1le-s.ttkJ1

i-----1/-i------'
Previews Servers

P~7,II SSUTLS

Met<1d<1t<1Servers

Pr 'Iii w, Proeosslflg ServiceMOl;)dflto

Prev:ewdat.a proc-es.sed
mtg ('m;ryptc-d c.hu-11k1,

lnformat1(1Jl .nbout f1l,c-1proee-!l$ed lsu(:t111$ fit(!

ProcOMing

SOrvicO

oome& type!

-i

SSUTL.S,----------J,--------J,---J,----,
Multiple oevice·s

Enforced by the Dropbox Security team, we’ve established a thorough setof security policies, which are reviewed at least annually. Employees, interns,
and contractors participate in mandatory security training when joining
the company, which they repeat annually throughout the duration of theiremployment. They also receive ongoing security awareness education via
informational emails, talks and presentations, and resources available on our
intranet. Read more about our security measures in the Dropbox Business
Security whitepaper.

2021 ESG Impact Report54

Data privacy, security, and reliability

Vulnerability and risk
management

2021 ESG Impact Report

Governance

The Security team regularly conducts automated and manual security
testing and patch management, and works with third-party specialists to
identify and remediate security vulnerabilities and bugs. Their findings arecommunicated to Dropbox management and appropriate action is taken
when necessary. Issues that have high severity are documented, tracked,
and resolved by assigned security engineers. Testing includes:•

TABLETOP EXERCISES: We conduct regular tabletop exercises to test andfortify the controls of our cyber incident response. We also conduct anannual, company wide data breach exercise to practice and strengthenincident response procedures.

•

PEN TESTING: The Security team regularly performs automated andmanual application security testing to identify and patch security
vulnerabilities and bugs on our desktop, web (Dropbox and Paper),and mobile (Dropbox and Paper) applications. Additionally, Dropbox
contracts with third-party vendors to perform periodic penetrationand vulnerability tests of the production environment. We work withthird-party specialists, other industry security teams, and the security
research community to keep our applications secure. We also leverage
automatic analysis systems to identify vulnerabilities. This processincludes systems we develop internally, open-source systems we
modify for our needs, and external vendors we hire for continuous
automated analysis.

•

BUG BOUNTY: While we work with professional firms for penetration
testing engagements and conduct our own testing in-house, bugbounties (or vulnerability rewards programs) tap into the expertise of
the broader security community. Our bug bounty program, operated
through HackerOne, provides an incentive for researchers to identify
and responsibly disclose software bugs. This involvement of the external
community provides the Security team with independent scrutiny of ourapplications to help keep users safe. We strive to be among the industry
leaders in bounty rewards, and response and remediation times.

55

Data privacy, security, and reliability

Governance•

RISK MANAGEMENT: Dropbox has employees dedicated to measuring,
testing, documenting, and quantifying systemic cyber risks.

•

INCIDENT RESPONSE: We have incident-response policies andprocedures to address service availability, integrity, security, privacy,
and confidentiality issues. As part of this effort, we have dedicatedteams that are trained to:•Promptly respond to alerts of potential incidents•

Determine the severity of an incident•

Execute mitigation and containment measures, if necessary•

Communicate with relevant internal and external stakeholders,
including notification to affected users•

Gather and preserve evidence for investigative efforts•

Document a postmortem and develop a permanent triage plan

• The incident-response policies and procedures are audited as part of
SOC 2, ISO/IEC 27001, and other security assessments.

2021 ESG Impact Report56

Data privacy, security, and reliability

Compliance: trust andverifyGovernanceTo maintain a foundation of trust with users, we’ve established a
Trust Management team that oversees risk management, compliance,and reporting.
Dropbox has a track record of being ahead of the compliance curve.
We were one of the first cloud service providers to achieve ISO 27018
certification for its business users.
Our privacy, security, reliability, and business continuity practices comply
with the most widely accepted standards and regulations, including:•

ISO 27001 (information security management)•

ISO 27701 (privacy information management)•

ISO 27017 (cloud security)•

ISO 27018 (cloud privacy and data protection)•

ISO 22301 (business continuity management)•

HIPAA/HITECH (health information privacy regulations)•

SOC 1, SOC 2, and SOC 3 (service organization controls)

Independent third-party auditors test our controls and provide theirreports and opinions. More information on the standards that wecomply with and how we verify security practices is available on the
Dropbox compliance page.
More information about the security and privacy practices of HelloSign(acquired in 2019) and DocSend (acquired in 2021) are available through
HelloSign Trust Center and DocSend Trust Center. Dropbox is working
to fully integrate both companies with the Dropbox Trust Program.

2021 ESG Impact Report57

Data privacy, security, and reliability

Product responsibility anddata ethics

2021 ESG Impact Report

Governance

Dropbox is used by millions of people, and we’re proud of the trust
they place in us. By the same token, we expect people to use ourservices responsibly, which means complying with our Acceptable Use
Policy (AUP). Dropbox uses a variety of tools, including industrystandard automated detection technology, to find potentially violating
content and take action as appropriate. We also encourage our users
to report inappropriate content through our reporting tool. Informationon the enforcement of AUP is found in our biannual Transparency at
Dropbox report.

58

Data privacy, security, and reliability

Responding togovernment data
requests

Governance

Like most online services, Dropbox sometimes receives requests fromgovernments seeking information about our users. Our Guiding Principles—
to be transparent, fight overly broad requests, provide trusted services, andprotect all users—describe our philosophy on handling government requests.
We analyze every request to determine whether it is legally and procedurally
valid, and we work to narrow or resist requests when appropriate. The
transparency report also indicates how often we receive and respond to
government data requests.

Reliability

2021 ESG Impact Report

Minimizing disruption to services is critical to our long-term success andthe success of our users. We strive to limit disruptions as much as possible,and have a team dedicated to responding to them immediately. The
business continuity management system (BCMS) details how to respondto disruptions so that we’re able to continue providing services to users. We
conduct a cyclic process consisting of the following phases:•

BUSINESS IMPACT ASSESSMENTS: We conduct a business impact
assessment (BIA) at least annually to identify processes criticalto Dropbox, assess the potential impacts of disruptions, and set
timeframes for recovery.

•

BUSINESS CONTINUITY PLANS (BCPS): Teams identified in the BIA
as critical to Dropbox continuity can use the assessment to develop
BCPs for their processes.

•

PLAN TESTING/EXERCISING: Dropbox tests selected elements of its
BCPs at least once a year.

•

REVIEW AND APPROVAL OF BCMS: At least annually, the executive
staff reviews the BCMS as part of the Dropbox Trust Program.

59

Data privacy, security, and reliability

Governance

Users trust us with their most important content, and we focus on providingthem with a secure and easy-to-use platform. More than 90% of users’ datais stored on custom-built infrastructure, which has been designed from theground up to be reliable and secure and to provide annual data durabilityof at least 99.999999999%. We have data center colocation facilities in
California, Oregon, Texas, and Virginia. We also utilize Amazon Web Services(AWS) for the remainder of users’ storage needs and to help deliver services.
Our technology infrastructure, combined with select use of AWS resources,
provides us with distributed and scalable architecture on a global scale. We
designed the platform with multiple layers of redundancy to guard against
data loss and deliver high availability.
We maintain a disaster recovery plan that addresses information security
requirements during a major crisis that impacts our system operations.
The plan specifies actions to be taken in the event of a major incident or
emergency at our 18 data center colocation facilities. The plan also includes arecovery time objective (RTO) and recovery point objective (RPO) that shouldbe met in the event of a disaster. Read more in our annual SOC 3 report.

Data center reliability
We have a 99.9% uptime service-level agreement(SLA), maintained January–December 2021. Uptime
is the guaranteed availability of a data center.

2021 ESG Impact Report60Appendix

62

Data tables

65

2021 SASB index

67

UN Global Compact Communication
on Progress2021 ESG Impact Report61Data tables

Appendix

Due to rounding, numbers presented throughout the tables below may not add up precisely to the totals provided,and percentages may not precisely reflect the absolute figures.

Greenhouse gas (GHG) emissions
GHG EMISSIONS (MTCO2E)

2019

2020

2021

Scope 1

773

1,623

1,053

Scope 2 (location-based)

54,60253,414

37,106

Scope 2 (market-based)

54,72953,5330

Scope 3 (business travel)

5,113

419*

41

Total reported emissions (location-based)

60,48955,45638,200Total reported emissions (market-based)

60,61655,575

1,094

Carbon offsets

0

0

1,094

Scope 1 and Scope 2 emissions by location(studios/offices and data center)2019 (mtCO2e)2020 (mtCO2e)

2021 (mtCO2e)

United States (location-based)

54,72054,392

38,094

United States (market-based)

54,72054,392

1,013

Australia (location-based)

108

112

0**

Australia (market-based)

108

112

0**

Ireland (location-based)

311

321

64

Ireland (market-based)

438

440

39

Israel (location-based)

236

212

0**

Israel (market-based)

236

212

0**

Scope 1 and Scope 2 emissions by source

2019 (mtCO2e)2020 (mtCO2e)

2021 (mtCO2e)

Studios/offices (location-based)

2,688

3,771

1,827

Studios/offices (market-based)

2,815

3,890

1,053

Data centers (location-based)

52,68751,26636,332

Data centers (market-based)

52,68751,2660

GHG Emissions Intensity (market-based)

2019

2020

2021

GHG emissions intensity (mtCO2e/$M)

36.49

29.04

0.51

GHG emissions intensity (mtCO2e/employees)

21.64

20.14

0.41

*Our Scope 3 emissions decreased significantly between 2019 and 2020 due in large part to a reduction in business travel due to the COVID-19 pandemic.
**In April 2021, we transitioned to a Virtual First working model in which remote work is the primary mode of working for employees. Dropbox leases all of our studio space, andshifting from full-time office space to studios has decreased the amount of physical space needed for our operations. Additionally, the move to Virtual First means that emissions
associated with our studios and offices in certain locations that are owned and managed by third parties fall under Scope 3 of the GHG Protocol Corporate Accounting andReporting Standard. We currently only report emissions from our studios, offices and data center locations that fall under Scope 1 and Scope 2. We do not currently reportemissions from studios, offices, and data center locations that are owned and managed by third parties, as these fall under Scope 3.

2021 ESG Impact Report62

Data tables

Appendix

GHG emissions calculation methodology
Calculations are consistent with the GHG Protocol

SCOPE 1 DIRECT EMISSIONS include emissions from

Corporate Accounting and Reporting Standard, madeonsite natural gas and diesel fuel consumption, andavailable by the World Business Council for Sustainablefugitive gas leakage from refrigerants used in studios/

Development and the World Resources Institute, andoffices and data centers.

The Climate Registry’s General Reporting Protocol. All
facilities over which Dropbox has operational control

SCOPE 2 INDIRECT EMISSIONS include emissions

are included in the Scope 1 and Scope 2 GHG inventory,

from purchased electricity. For leased colocation data

including all leased facilities. Where actual energy bills

centers, we’ve taken an operational-control consolidation

were not available, emissions were estimated using theapproach and are accounting for upstream emissions ofCommercial Buildings Energy Consumption Survey

leased colocation data centers in the Scope 2 reporting.

(CBECS) database. Reported GHG emissions include
CO2, CH4, and N2O emissions from electricity, naturalgas, and fuel consumption, and HFC emissions fromrefrigerant use in buildings and data centers. Dropbox
has no emissions resulting from use of PFCs, SF6, or NF3.
To convert energy consumption, fuel combustion, andbusiness travel data into GHG emissions, we used factors
from the US Environmental Protection Agency (EPA)
Emissions & Generation Resource Integrated Database(eGRID), International Energy Agency, Environment
Canada National Inventory Report, US EPA Emission
Factors Hub, US EPA Office of Research and Development
Supply Chain Greenhouse Gas Emission Factors for US
Industries and Commodities, and the UK Department
for Environment, Food and Rural Affairs (DEFRA). Global

LOCATION-BASED EMISSIONS are calculated using alocation-based electricity grid emissions intensity factor,
which defines the amount of GHG emissions generated
per unit of electricity consumed in a certain geography.

MARKET-BASED EMISSIONS are calculated using a
residual factor for grid emissions intensity, after accounting
for the use of renewable energy in a certain geography.
For 2019, 2020, and 2021, Dropbox is reporting only
Scope 3 emissions associated with business travel,
which includes emissions generated from flights, hotel
rooms, rental cars, and rail transportation.

warming potentials used for converting emissions intoCO2e are sourced from the Intergovernmental Panel on
Climate Change Fourth Assessment Report.

2021 ESG Impact Report63Data tables

Appendix

Energy use
CATEGORIES

2019

2020

2021

Total energy use (MWh)176,177

182,486

134,354

Electricity (MWh)173,848

175,308

129,645•

Studios/offices

6,191

7,729

3,198

•

Data centers

167,657

167,579

126,447•

Renewable

00129,645•

Renewable (%)

0

0

100%

Other fuels (MWh)

2,328

7,178

4,708

Data-center power usage effectiveness

1.27

1.32

1.20

2019 (SHORT TONS)

2020 (SHORT TONS)

2021 (SHORT TONS)

Recycled IT waste

Data unavailable

Data unavailable

351

Remarketed IT waste

Data unavailable

Data unavailable

592

Composted waste

Data unavailable

Data unavailable

6

Landfilled waste

Data unavailable

Data unavailable

193

Recycled waste

Data unavailable

Data unavailable

36

Waste generated
CATEGORIES
Data center

Studios/offices

2021 ESG Impact Report642021 SASB index

Appendix

We are committed to providing transparent information about our material sustainability information to our investors andother stakeholders. The table below references the SASB Software and IT Services Standard version 2018–10, which ismost relevant to our operations. Unless otherwise specified, the data and descriptions are current as of year-end 2021.
We’ll continue to evaluate additional topics and metrics for inclusion in future reports.

Software and IT Services Standard
SASB CODEACCOUNTING METRICRESPONSE

TC-SI-130a.1(1) Total energy consumed, (2) percentage gridelectricity, (3) percentage renewable

In 2021, our data centers consumed 455,209 gigajoules(GJ) of electricity. 100% was grid electricity, and 100%of colocated data-center direct IT load was renewablethrough purchase of RECs. See Environmental.

TC-SI-130a.2(1) Total water withdrawn, (2) total water
consumed, (3) percentage of each in regions withhigh or extremely high baseline water stressIn 2021, our data centers withdrew 130,860 cubic metersof water. The water was used for cooling in a closed-loop
process, so no water was consumed. 3.07% of thesewithdrawals occurred in areas identified by the World
Resources Institute (WRI) as having high or extremely
high baseline water stress.

Discussion of integrating environmental
considerations with strategic planning for datacenter needs

Dropbox is focused on reducing energy consumption
at its data centers by maintaining excellent powerusage effectiveness (PUE), optimizing overall power
consumption, and sourcing 100% renewable electricity
for its direct data-center IT load. See Environmental
and here for more information about our data centersustainability efforts.

TC-SI-220a.1

Description of policies and practices related tobehavioral advertising and user privacy

See Data privacy, security, and reliability and thePrivacy Policy.

TC-SI-220a.2

Number of users whose information is used forsecondary purposes

Dropbox doesn’t make money from advertising, so we
don’t compromise our commitment to users and theirprivacy. See Data privacy, security, and reliability formore information.

TC-SI-220a.3

Total amount of monetary losses as a result oflegal proceedings associated with user privacy

See Note 10 in our 2021 Form 10-K.

TC-SI-220a.4(1) Number of law enforcement requests foruser information, (2) number of users whose
information was requested, (3) percentage
resulting in disclosure

See our Transparency at Dropbox reports for information
about how we handle requests from law enforcement.

List of countries where core products or services
are subject to government-required monitoring,
blocking, content filtering, or censoring

Dropbox believes that government data requests should
be limited in the information they seek and narrowly
tailored to specific people and legitimate investigations.
In accordance with our privacy policy, Dropbox may
disclose user information to third parties only if wedetermine that such disclosure is reasonably necessary.
We abide by specific guiding principles when receiving,
scrutinizing, and responding to government (including
national security) requests for user data.

Environmental footprint of
hardware infrastructure

TC-SI-130a.3

Data privacy and freedom of
expression

TC-SI-220a.5

2021 ESG Impact Report65

2021 SASB index

Appendix

Software and IT Services Standard
SASB CODEACCOUNTING METRICRESPONSE

TC-SI-230a.1(1) Number of data breaches, (2) percentage
involving personally identifiable information (PII),(3) number of users affected

See pages 16 and 17 of our 2021 Form 10-K.

TC-SI-230a.2

Description of approach to identifying andaddressing data security risks, including useof third-party cybersecurity standards

See Data privacy, security, and reliability.

Percentage of employees who are (1) foreign
nationals, (2) located offshore(1) Not reported(2) 14% of employees are located offshore

TC-SI-330a.2

Employee engagement as a percentage

In 2021, 90% of Dropbox employees responded to our
engagement surveys. Known internally as “Soapbox,”
the exercise is designed to provide employees andcompany leaders with a formal channel for submitting
feedback on what’s going well and where we needto improve.

TC-SI-330a.3

Percentage of gender and racial/ethnic identification
among (1) managers, (2) technical staff, (3) allother employees

See Diversity, equity, and inclusion.

Total amount of monetary losses as a result oflegal proceedings associated with anti-competitive
behavior regulations

See Note 10 in our 2021 Form 10-K.

TC-SI-550a.1(1) Number of performance issues, (2) number ofservice disruptions, (3) total customer downtime

In 2021, Dropbox experienced one performance issue
and zero service disruptions, for a total of 20 minutesof customer downtime.*

TC-SI-550a.2

Description of business continuity risks related todisruptions of operations

See Data privacy, security, and reliability, page 19 of
our 2021 Form 10-K, and our SOC 3 report.

Data security

Recruiting and managing a global,
diverse, and skilled workforce
TC-SI-330a.1

Intellectual property protection
and competitive behavior
TC-SI-520a.1
Managing systemic risks fromtechnology disruptions*This does not include performance from HelloSign or DocSend.

2021 ESG Impact Report66

UN Global Compact Communication
on Progress

Appendix

In December 2021, Dropbox became a signatory to the United Nations (UN) Global Compact, a voluntary initiative toimplement universal sustainability principles regarding human rights, labor rights, the environment, and anti-corruption.
This Dropbox ESG Impact Report and the disclosures, policies, and codes included by reference serve as our inauguralcommunication on progress, covering all of our activities in fiscal year 2021.

x ESG IMPACT REPORT SECTIONDROPBOXPRINCIPLE
Human Rights

PRINCIPLE 1

Businesses should support and respect the protectionof internationally proclaimed human rights.

Human and labor rights

PRINCIPLE 2Businesses should make sure that they are notcomplicit in human rights abuses.

Human and labor rights
Data privacy, security, and reliability

PRINCIPLE 3

Businesses should uphold the freedom of associationand the effective recognition of the right tocollective bargaining.

Human and labor rights

PRINCIPLE 4

Businesses should uphold the elimination of all
forms of forced and compulsory labor.

Human and labor rights

PRINCIPLE 5

Businesses should uphold the effective abolition ofchild labor.

Human and labor rights

PRINCIPLE 6

Businesses should uphold the elimination of
discrimination with respect to employment
and occupation.

Human and labor rights
Diversity, equity, and inclusion

PRINCIPLE 7

Businesses should support a precautionary approachto environmental challenges.

Dropbox supports the precautionary principle and seeks
ways to reduce the company’s environmental impacts.
See Environmental.

PRINCIPLE 8Businesses should undertake initiatives to promote
greater environmental responsibility.

Environmental

PRINCIPLE 9Businesses should encourage the development anddiffusion of environmentally friendly technologies.

Environmental

Businesses should work against corruption in all its
forms, including extortion and bribery.

Business ethics and integrity

Labor

Environment

Anti-corruption

PRINCIPLE 10

2021 ESG Impact Report67Appendix

Dropbox, Inc.
1800 Owens Street
Suite 200
San Francisco, CA 94158
2021 ESG Impact Report

For questions about this report, please contact esgreport@dropbox.com
68