{
  "@context": "https://spdx.org/rdf/3.0.1/spdx-context.jsonld",
  "@graph": [
    {
      "type": "CreationInfo",
      "@id": "_:creationInfo",
      "specVersion": "3.0.1",
      "created": "2026-11-04T00:00:00Z",
      "createdBy": [
        "https://jesseahawkins.com/vendors/cohere/aibom/tool"
      ]
    },
    {
      "type": "Tool",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/tool",
      "creationInfo": "_:creationInfo",
      "name": "jesseahawkins.com vendor record"
    },
    {
      "type": "SpdxDocument",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/document",
      "creationInfo": "_:creationInfo",
      "name": "AI BOM for Cohere: Cohere SaaS platform",
      "profileConformance": [
        "core",
        "software",
        "ai"
      ],
      "rootElement": [
        "https://jesseahawkins.com/vendors/cohere/aibom/ai-package"
      ]
    },
    {
      "type": "ai_AIPackage",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "creationInfo": "_:creationInfo",
      "name": "Cohere: Cohere SaaS platform"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/ai_subprocessors",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors = Listed on its Trust Center. Evidence snapshot sha256:efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24. Responsive to (not compliant with): dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/certifications",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "certifications = ISO 27001, ISO 42001 and a SOC 2 Type II report, on request. Evidence snapshot sha256:efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/customer_data_retention_period",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period = Deleted after 30 days, with listed exceptions. Evidence snapshot sha256:efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24. Responsive to (not compliant with): iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/dpa",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa = On request, for SaaS Platform customers. Evidence snapshot sha256:efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/trains_on_customer_data",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data = Opt-out offered. Evidence snapshot sha256:efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24. Responsive to (not compliant with): eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/usage_limits",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits = Per-model rates for trial and production keys, some by contact with sales; 1,000 calls a month on trial keys and on production keys for newer Chat models. Evidence snapshot sha256:0aa2efdb3c0f298467bf5c8f028ee86a49feb09ae07a5065441a22fb63fb2f5a; recorded 2026-11-03T00:00:00Z; valid from 2026-11-03."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/zero_data_retention",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention = Zero data retention, on request, for enterprise customers who make additional usage commitments. Evidence snapshot sha256:efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/data_residency",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency is recorded with no value (fact cohere/data_residency@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/ai_subprocessors/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors, in Cohere's own words: \"You can view a list of sub-processors by visiting Cohere’s Trust Center.\" Source: https://cohere.com/enterprise-data-commitments"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/certifications/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "certifications, in Cohere's own words: \"Seamlessly complete your privacy and security compliance reviews by visiting Cohere’s Trust Center where you can request a copy of our certifications (including ISO 27001 and ISO 42001) or of our SOC 2 Type II Report or review our other compliance resources.\" Source: https://cohere.com/enterprise-data-commitments"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/customer_data_retention_period/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period, in Cohere's own words: \"For the SaaS Platform, we automatically delete logged prompts and generations after 30 days, unless we need to retain them to comply with a legal requirement or a customer contract, or unless your usage is flagged as potentially violating our terms, including our Usage Policy (e.g. abuse or misuse of our services).\" Source: https://cohere.com/enterprise-data-commitments"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/dpa/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa, in Cohere's own words: \"Yes, we can provide our DPA to potential customers of the Cohere SaaS Platform for review.\" Source: https://cohere.com/enterprise-data-commitments"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/trains_on_customer_data/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data, in Cohere's own words: \"Enterprise customers can access opt out toggle in the Cohere dashboard settings. If you are opted out, prompts and generations will not be used to train Cohere models.\" Source: https://cohere.com/enterprise-data-commitments"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/usage_limits/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits, in Cohere's own words: \"Trial keys (and prod keys on newer Chat model variants) are limited to 1,000 API calls a month.\" Source: https://docs.cohere.com/docs/rate-limits"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/zero_data_retention/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention, in Cohere's own words: \"we only allow ZDR for enterprise customers who can make additional commitments about their usage of the Cohere Services\" Source: https://cohere.com/enterprise-data-commitments"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/notice",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/document",
      "contentType": "text/plain",
      "statement": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/cohere/aibom/annotation/signature",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/cohere/aibom/document",
      "contentType": "text/plain",
      "statement": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}