{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b6250f2e-d0fd-5d11-8687-033514d6ab37",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-04T00:00:00Z"
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "https://jesseahawkins.com/vendors/cohere/aibom/component",
      "name": "Cohere: Cohere SaaS platform",
      "properties": [
        {
          "name": "com.jesseahawkins:fact:ai_subprocessors",
          "value": "Listed on its Trust Center"
        },
        {
          "name": "com.jesseahawkins:evidence:ai_subprocessors",
          "value": "snapshot:sha256:efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb"
        },
        {
          "name": "com.jesseahawkins:recorded-at:ai_subprocessors",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:ai_subprocessors",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:responsive-to:ai_subprocessors",
          "value": "dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1"
        },
        {
          "name": "com.jesseahawkins:fact:certifications",
          "value": "ISO 27001, ISO 42001 and a SOC 2 Type II report, on request"
        },
        {
          "name": "com.jesseahawkins:evidence:certifications",
          "value": "snapshot:sha256:efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb"
        },
        {
          "name": "com.jesseahawkins:recorded-at:certifications",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:certifications",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:fact:customer_data_retention_period",
          "value": "Deleted after 30 days, with listed exceptions"
        },
        {
          "name": "com.jesseahawkins:evidence:customer_data_retention_period",
          "value": "snapshot:sha256:efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb"
        },
        {
          "name": "com.jesseahawkins:recorded-at:customer_data_retention_period",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:customer_data_retention_period",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:responsive-to:customer_data_retention_period",
          "value": "iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:dpa",
          "value": "On request, for SaaS Platform customers"
        },
        {
          "name": "com.jesseahawkins:evidence:dpa",
          "value": "snapshot:sha256:efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb"
        },
        {
          "name": "com.jesseahawkins:recorded-at:dpa",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:dpa",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:fact:trains_on_customer_data",
          "value": "Opt-out offered"
        },
        {
          "name": "com.jesseahawkins:evidence:trains_on_customer_data",
          "value": "snapshot:sha256:efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb"
        },
        {
          "name": "com.jesseahawkins:recorded-at:trains_on_customer_data",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:trains_on_customer_data",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:responsive-to:trains_on_customer_data",
          "value": "eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:usage_limits",
          "value": "Per-model rates for trial and production keys, some by contact with sales; 1,000 calls a month on trial keys and on production keys for newer Chat models"
        },
        {
          "name": "com.jesseahawkins:evidence:usage_limits",
          "value": "snapshot:sha256:0aa2efdb3c0f298467bf5c8f028ee86a49feb09ae07a5065441a22fb63fb2f5a"
        },
        {
          "name": "com.jesseahawkins:recorded-at:usage_limits",
          "value": "2026-11-03T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:usage_limits",
          "value": "2026-11-03"
        },
        {
          "name": "com.jesseahawkins:fact:zero_data_retention",
          "value": "Zero data retention, on request, for enterprise customers who make additional usage commitments"
        },
        {
          "name": "com.jesseahawkins:evidence:zero_data_retention",
          "value": "snapshot:sha256:efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb"
        },
        {
          "name": "com.jesseahawkins:recorded-at:zero_data_retention",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:zero_data_retention",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:withheld:data_residency",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:quote:ai_subprocessors",
          "value": "You can view a list of sub-processors by visiting Cohere’s Trust Center."
        },
        {
          "name": "com.jesseahawkins:source:ai_subprocessors",
          "value": "https://cohere.com/enterprise-data-commitments"
        },
        {
          "name": "com.jesseahawkins:quote:certifications",
          "value": "Seamlessly complete your privacy and security compliance reviews by visiting Cohere’s Trust Center where you can request a copy of our certifications (including ISO 27001 and ISO 42001) or of our SOC 2 Type II Report or review our other compliance resources."
        },
        {
          "name": "com.jesseahawkins:source:certifications",
          "value": "https://cohere.com/enterprise-data-commitments"
        },
        {
          "name": "com.jesseahawkins:quote:customer_data_retention_period",
          "value": "For the SaaS Platform, we automatically delete logged prompts and generations after 30 days, unless we need to retain them to comply with a legal requirement or a customer contract, or unless your usage is flagged as potentially violating our terms, including our Usage Policy (e.g. abuse or misuse of our services)."
        },
        {
          "name": "com.jesseahawkins:source:customer_data_retention_period",
          "value": "https://cohere.com/enterprise-data-commitments"
        },
        {
          "name": "com.jesseahawkins:quote:dpa",
          "value": "Yes, we can provide our DPA to potential customers of the Cohere SaaS Platform for review."
        },
        {
          "name": "com.jesseahawkins:source:dpa",
          "value": "https://cohere.com/enterprise-data-commitments"
        },
        {
          "name": "com.jesseahawkins:quote:trains_on_customer_data",
          "value": "Enterprise customers can access opt out toggle in the Cohere dashboard settings. If you are opted out, prompts and generations will not be used to train Cohere models."
        },
        {
          "name": "com.jesseahawkins:source:trains_on_customer_data",
          "value": "https://cohere.com/enterprise-data-commitments"
        },
        {
          "name": "com.jesseahawkins:quote:usage_limits",
          "value": "Trial keys (and prod keys on newer Chat model variants) are limited to 1,000 API calls a month."
        },
        {
          "name": "com.jesseahawkins:source:usage_limits",
          "value": "https://docs.cohere.com/docs/rate-limits"
        },
        {
          "name": "com.jesseahawkins:quote:zero_data_retention",
          "value": "we only allow ZDR for enterprise customers who can make additional commitments about their usage of the Cohere Services"
        },
        {
          "name": "com.jesseahawkins:source:zero_data_retention",
          "value": "https://cohere.com/enterprise-data-commitments"
        }
      ]
    }
  ],
  "properties": [
    {
      "name": "com.jesseahawkins:vendor",
      "value": "cohere"
    },
    {
      "name": "com.jesseahawkins:record",
      "value": "https://jesseahawkins.com/vendors/cohere/"
    },
    {
      "name": "com.jesseahawkins:notice",
      "value": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "name": "com.jesseahawkins:signed",
      "value": "false"
    },
    {
      "name": "com.jesseahawkins:signature-note",
      "value": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}