{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f4769bd7-1d96-5ec3-a64b-628b01de13d5",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-04T00:00:00Z"
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "https://jesseahawkins.com/vendors/anthropic/aibom/component",
      "name": "Anthropic: Anthropic API and Claude commercial products",
      "properties": [
        {
          "name": "com.jesseahawkins:fact:customer_data_retention_period",
          "value": "Anthropic API: deleted within 30 days, with listed exceptions"
        },
        {
          "name": "com.jesseahawkins:evidence:customer_data_retention_period",
          "value": "snapshot:sha256:31c58317fd20d708fdb599ee7a29d7d8bd7875152c2cdad9fcc4a427c15149c0"
        },
        {
          "name": "com.jesseahawkins:recorded-at:customer_data_retention_period",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:customer_data_retention_period",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:responsive-to:customer_data_retention_period",
          "value": "iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:data_residency",
          "value": "API inference: global by default (any geography) or US-only via inference_geo on Claude 4.6 and later, on the first-party API (except the OpenAI SDK compatibility endpoint) and some partner platforms; workspace data at rest: US only"
        },
        {
          "name": "com.jesseahawkins:evidence:data_residency",
          "value": "snapshot:sha256:0171e6e8e8a1d63a6e24483d2d437d75b8ef141e26b197787c969208bb2345a7"
        },
        {
          "name": "com.jesseahawkins:recorded-at:data_residency",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:data_residency",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:fact:dpa",
          "value": "Incorporated into the Commercial Terms by reference"
        },
        {
          "name": "com.jesseahawkins:evidence:dpa",
          "value": "snapshot:sha256:97857ac41eabfc4bacacf57225c8385b826ffb63164398912db6e4219e4a8bb3"
        },
        {
          "name": "com.jesseahawkins:recorded-at:dpa",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:dpa",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:fact:trains_on_customer_data",
          "value": "Not by default"
        },
        {
          "name": "com.jesseahawkins:evidence:trains_on_customer_data",
          "value": "snapshot:sha256:54617b76403faa9ba4db2ad4b7ba43a5c8d98fb8d9a2efbdbe18caac95e8a450"
        },
        {
          "name": "com.jesseahawkins:recorded-at:trains_on_customer_data",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:trains_on_customer_data",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:responsive-to:trains_on_customer_data",
          "value": "eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:usage_limits",
          "value": "Spend and rate limits by usage tier, set from usage history and account standing"
        },
        {
          "name": "com.jesseahawkins:evidence:usage_limits",
          "value": "snapshot:sha256:f865562bc3ba79d38ed8e5e7783e1ab30b0557fd518e6c1a7ed412f8caaba3c5"
        },
        {
          "name": "com.jesseahawkins:recorded-at:usage_limits",
          "value": "2026-11-03T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:usage_limits",
          "value": "2026-11-03"
        },
        {
          "name": "com.jesseahawkins:fact:zero_data_retention",
          "value": "Zero data retention, by agreement"
        },
        {
          "name": "com.jesseahawkins:evidence:zero_data_retention",
          "value": "snapshot:sha256:31c58317fd20d708fdb599ee7a29d7d8bd7875152c2cdad9fcc4a427c15149c0"
        },
        {
          "name": "com.jesseahawkins:recorded-at:zero_data_retention",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:zero_data_retention",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:withheld:ai_subprocessors",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:withheld:certifications",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:quote:customer_data_retention_period",
          "value": "For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation"
        },
        {
          "name": "com.jesseahawkins:source:customer_data_retention_period",
          "value": "https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data"
        },
        {
          "name": "com.jesseahawkins:quote:data_residency",
          "value": "Data residency controls let you manage where your data is processed and stored."
        },
        {
          "name": "com.jesseahawkins:source:data_residency",
          "value": "https://platform.claude.com/docs/en/manage-claude/data-residency"
        },
        {
          "name": "com.jesseahawkins:quote:dpa",
          "value": "Data submitted through the Services will be processed in accordance with the Anthropic Data Processing Addendum (“DPA”), which is incorporated into these Terms by reference."
        },
        {
          "name": "com.jesseahawkins:source:dpa",
          "value": "https://www.anthropic.com/legal/commercial-terms"
        },
        {
          "name": "com.jesseahawkins:quote:trains_on_customer_data",
          "value": "By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models."
        },
        {
          "name": "com.jesseahawkins:source:trains_on_customer_data",
          "value": "https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training"
        },
        {
          "name": "com.jesseahawkins:quote:usage_limits",
          "value": "Limits are defined by usage tier. Organizations are placed on a tier automatically based on usage history and account standing and can move to a higher tier over time as they use the API."
        },
        {
          "name": "com.jesseahawkins:source:usage_limits",
          "value": "https://platform.claude.com/docs/en/api/rate-limits"
        },
        {
          "name": "com.jesseahawkins:quote:zero_data_retention",
          "value": "When you and we have agreed otherwise (e.g. zero data retention agreement)"
        },
        {
          "name": "com.jesseahawkins:source:zero_data_retention",
          "value": "https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data"
        }
      ]
    }
  ],
  "properties": [
    {
      "name": "com.jesseahawkins:vendor",
      "value": "anthropic"
    },
    {
      "name": "com.jesseahawkins:record",
      "value": "https://jesseahawkins.com/vendors/anthropic/"
    },
    {
      "name": "com.jesseahawkins:notice",
      "value": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "name": "com.jesseahawkins:signed",
      "value": "false"
    },
    {
      "name": "com.jesseahawkins:signature-note",
      "value": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}