{
  "@context": "https://spdx.org/rdf/3.0.1/spdx-context.jsonld",
  "@graph": [
    {
      "type": "CreationInfo",
      "@id": "_:creationInfo",
      "specVersion": "3.0.1",
      "created": "2026-11-04T00:00:00Z",
      "createdBy": [
        "https://jesseahawkins.com/vendors/aws/aibom/tool"
      ]
    },
    {
      "type": "Tool",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/tool",
      "creationInfo": "_:creationInfo",
      "name": "jesseahawkins.com vendor record"
    },
    {
      "type": "SpdxDocument",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/document",
      "creationInfo": "_:creationInfo",
      "name": "AI BOM for AWS: Amazon Bedrock",
      "profileConformance": [
        "core",
        "software",
        "ai"
      ],
      "rootElement": [
        "https://jesseahawkins.com/vendors/aws/aibom/ai-package"
      ]
    },
    {
      "type": "ai_AIPackage",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "creationInfo": "_:creationInfo",
      "name": "AWS: Amazon Bedrock"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/ai_subprocessors",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors = A published list, by Region and service. Evidence snapshot sha256:f2060d7e438446b0ed1f7c951c195c9268e686dff08f34a64b33336d68bf2295; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26. Responsive to (not compliant with): dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/certifications",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "certifications = In scope for FedRAMP Moderate, SOC, ISO and HIPAA eligibility. Evidence snapshot sha256:b48072e9d7367e42810904e0a76cd855f3583e22f714aa924bdf453312e751ce; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/customer_data_retention_period",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period = Set by the model and the account's retention mode. Evidence snapshot sha256:a7a8c4c5f2f7d3fbcd9a722db22b01822e09ddbfc7ee27aae794c3e3a757d163; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24. Responsive to (not compliant with): iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/data_residency",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency = Stored at rest in the AWS Region in use. Evidence snapshot sha256:b48072e9d7367e42810904e0a76cd855f3583e22f714aa924bdf453312e751ce; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/dpa",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa = The AWS Data Processing Addendum, under which AWS engages sub-processors. Evidence snapshot sha256:f2060d7e438446b0ed1f7c951c195c9268e686dff08f34a64b33336d68bf2295; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/trains_on_customer_data",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data = No, for Amazon Nova, Amazon Titan and third-party models. Evidence snapshot sha256:b48072e9d7367e42810904e0a76cd855f3583e22f714aa924bdf453312e751ce; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24. Responsive to (not compliant with): eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/usage_limits",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits = Default quotas on token use, and on requests for embedding models; an account’s own quotas can be lower. Evidence snapshot sha256:9fb23c7957aed30b8d8c5cc8144d8240c1808e0dff9c0ef7b6c9f6d4c75d06ad; recorded 2026-11-03T00:00:00Z; valid from 2026-11-03."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/zero_data_retention",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention = Zero data retention mode, for models that allow it; for other models, eligibility is evaluated per account and model. Evidence snapshot sha256:a7a8c4c5f2f7d3fbcd9a722db22b01822e09ddbfc7ee27aae794c3e3a757d163; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/ai_subprocessors/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors, in AWS's own words: \"Sub-processors relevant to an individual customer will depend on the AWS Region the customer selects and the particular AWS services that the customer uses.\" Source: https://aws.amazon.com/compliance/sub-processors/"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/certifications/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "certifications, in AWS's own words: \"Amazon Bedrock is in scope for common compliance standards such as Fedramp Moderate, Service and Organization Control (SOC), International Organization for Standardization (ISO), Health Insurance Portability and Accountability Act (HIPAA) eligibility, and customers can use Bedrock in compliance with the General Data Protection Regulation (GDPR).\" Source: https://aws.amazon.com/bedrock/faqs/"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/customer_data_retention_period/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period, in AWS's own words: \"Default means the data retention policy of the model applies. There is no change to previous model retention behavior; if ZDR applied previously, then ZDR still applies. Actual retention depends on the model — consult the model's terms for specifics.\" Source: https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/data_residency/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency, in AWS's own words: \"Any customer content processed by Amazon Bedrock is encrypted and stored at rest in the AWS Region where you are using Amazon Bedrock.\" Source: https://aws.amazon.com/bedrock/faqs/"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/dpa/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa, in AWS's own words: \"This page provides information about the sub-processors that AWS has engaged in accordance with the AWS Data Processing Addendum (AWS DPA) to provide processing activities on Customer Data (as defined in the AWS DPA) on behalf of customers.\" Source: https://aws.amazon.com/compliance/sub-processors/"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/trains_on_customer_data/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data, in AWS's own words: \"No, AWS and the third-party model providers will not use any inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan, or any third-party models.\" Source: https://aws.amazon.com/bedrock/faqs/"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/usage_limits/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits, in AWS's own words: \"Model inference in Amazon Bedrock is controlled by quotas on token usage.\" Source: https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/zero_data_retention/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention, in AWS's own words: \"Zero data retention. No request or response data is written to durable storage by AWS or shared with the model provider.\" Source: https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/notice",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/document",
      "contentType": "text/plain",
      "statement": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/aws/aibom/annotation/signature",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/aws/aibom/document",
      "contentType": "text/plain",
      "statement": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}