{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:127463c4-cd64-5882-8401-b088049f1f13",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-04T00:00:00Z"
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "https://jesseahawkins.com/vendors/aws/aibom/component",
      "name": "AWS: Amazon Bedrock",
      "properties": [
        {
          "name": "com.jesseahawkins:fact:ai_subprocessors",
          "value": "A published list, by Region and service"
        },
        {
          "name": "com.jesseahawkins:evidence:ai_subprocessors",
          "value": "snapshot:sha256:f2060d7e438446b0ed1f7c951c195c9268e686dff08f34a64b33336d68bf2295"
        },
        {
          "name": "com.jesseahawkins:recorded-at:ai_subprocessors",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:ai_subprocessors",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:responsive-to:ai_subprocessors",
          "value": "dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1"
        },
        {
          "name": "com.jesseahawkins:fact:certifications",
          "value": "In scope for FedRAMP Moderate, SOC, ISO and HIPAA eligibility"
        },
        {
          "name": "com.jesseahawkins:evidence:certifications",
          "value": "snapshot:sha256:b48072e9d7367e42810904e0a76cd855f3583e22f714aa924bdf453312e751ce"
        },
        {
          "name": "com.jesseahawkins:recorded-at:certifications",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:certifications",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:fact:customer_data_retention_period",
          "value": "Set by the model and the account's retention mode"
        },
        {
          "name": "com.jesseahawkins:evidence:customer_data_retention_period",
          "value": "snapshot:sha256:a7a8c4c5f2f7d3fbcd9a722db22b01822e09ddbfc7ee27aae794c3e3a757d163"
        },
        {
          "name": "com.jesseahawkins:recorded-at:customer_data_retention_period",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:customer_data_retention_period",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:responsive-to:customer_data_retention_period",
          "value": "iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:data_residency",
          "value": "Stored at rest in the AWS Region in use"
        },
        {
          "name": "com.jesseahawkins:evidence:data_residency",
          "value": "snapshot:sha256:b48072e9d7367e42810904e0a76cd855f3583e22f714aa924bdf453312e751ce"
        },
        {
          "name": "com.jesseahawkins:recorded-at:data_residency",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:data_residency",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:fact:dpa",
          "value": "The AWS Data Processing Addendum, under which AWS engages sub-processors"
        },
        {
          "name": "com.jesseahawkins:evidence:dpa",
          "value": "snapshot:sha256:f2060d7e438446b0ed1f7c951c195c9268e686dff08f34a64b33336d68bf2295"
        },
        {
          "name": "com.jesseahawkins:recorded-at:dpa",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:dpa",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:fact:trains_on_customer_data",
          "value": "No, for Amazon Nova, Amazon Titan and third-party models"
        },
        {
          "name": "com.jesseahawkins:evidence:trains_on_customer_data",
          "value": "snapshot:sha256:b48072e9d7367e42810904e0a76cd855f3583e22f714aa924bdf453312e751ce"
        },
        {
          "name": "com.jesseahawkins:recorded-at:trains_on_customer_data",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:trains_on_customer_data",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:responsive-to:trains_on_customer_data",
          "value": "eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:usage_limits",
          "value": "Default quotas on token use, and on requests for embedding models; an account’s own quotas can be lower"
        },
        {
          "name": "com.jesseahawkins:evidence:usage_limits",
          "value": "snapshot:sha256:9fb23c7957aed30b8d8c5cc8144d8240c1808e0dff9c0ef7b6c9f6d4c75d06ad"
        },
        {
          "name": "com.jesseahawkins:recorded-at:usage_limits",
          "value": "2026-11-03T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:usage_limits",
          "value": "2026-11-03"
        },
        {
          "name": "com.jesseahawkins:fact:zero_data_retention",
          "value": "Zero data retention mode, for models that allow it; for other models, eligibility is evaluated per account and model"
        },
        {
          "name": "com.jesseahawkins:evidence:zero_data_retention",
          "value": "snapshot:sha256:a7a8c4c5f2f7d3fbcd9a722db22b01822e09ddbfc7ee27aae794c3e3a757d163"
        },
        {
          "name": "com.jesseahawkins:recorded-at:zero_data_retention",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:zero_data_retention",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:quote:ai_subprocessors",
          "value": "Sub-processors relevant to an individual customer will depend on the AWS Region the customer selects and the particular AWS services that the customer uses."
        },
        {
          "name": "com.jesseahawkins:source:ai_subprocessors",
          "value": "https://aws.amazon.com/compliance/sub-processors/"
        },
        {
          "name": "com.jesseahawkins:quote:certifications",
          "value": "Amazon Bedrock is in scope for common compliance standards such as Fedramp Moderate, Service and Organization Control (SOC), International Organization for Standardization (ISO), Health Insurance Portability and Accountability Act (HIPAA) eligibility, and customers can use Bedrock in compliance with the General Data Protection Regulation (GDPR)."
        },
        {
          "name": "com.jesseahawkins:source:certifications",
          "value": "https://aws.amazon.com/bedrock/faqs/"
        },
        {
          "name": "com.jesseahawkins:quote:customer_data_retention_period",
          "value": "Default means the data retention policy of the model applies. There is no change to previous model retention behavior; if ZDR applied previously, then ZDR still applies. Actual retention depends on the model — consult the model's terms for specifics."
        },
        {
          "name": "com.jesseahawkins:source:customer_data_retention_period",
          "value": "https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html"
        },
        {
          "name": "com.jesseahawkins:quote:data_residency",
          "value": "Any customer content processed by Amazon Bedrock is encrypted and stored at rest in the AWS Region where you are using Amazon Bedrock."
        },
        {
          "name": "com.jesseahawkins:source:data_residency",
          "value": "https://aws.amazon.com/bedrock/faqs/"
        },
        {
          "name": "com.jesseahawkins:quote:dpa",
          "value": "This page provides information about the sub-processors that AWS has engaged in accordance with the AWS Data Processing Addendum (AWS DPA) to provide processing activities on Customer Data (as defined in the AWS DPA) on behalf of customers."
        },
        {
          "name": "com.jesseahawkins:source:dpa",
          "value": "https://aws.amazon.com/compliance/sub-processors/"
        },
        {
          "name": "com.jesseahawkins:quote:trains_on_customer_data",
          "value": "No, AWS and the third-party model providers will not use any inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan, or any third-party models."
        },
        {
          "name": "com.jesseahawkins:source:trains_on_customer_data",
          "value": "https://aws.amazon.com/bedrock/faqs/"
        },
        {
          "name": "com.jesseahawkins:quote:usage_limits",
          "value": "Model inference in Amazon Bedrock is controlled by quotas on token usage."
        },
        {
          "name": "com.jesseahawkins:source:usage_limits",
          "value": "https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html"
        },
        {
          "name": "com.jesseahawkins:quote:zero_data_retention",
          "value": "Zero data retention. No request or response data is written to durable storage by AWS or shared with the model provider."
        },
        {
          "name": "com.jesseahawkins:source:zero_data_retention",
          "value": "https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html"
        }
      ]
    }
  ],
  "properties": [
    {
      "name": "com.jesseahawkins:vendor",
      "value": "aws"
    },
    {
      "name": "com.jesseahawkins:record",
      "value": "https://jesseahawkins.com/vendors/aws/"
    },
    {
      "name": "com.jesseahawkins:notice",
      "value": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "name": "com.jesseahawkins:signed",
      "value": "false"
    },
    {
      "name": "com.jesseahawkins:signature-note",
      "value": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}