{
  "@context": "https://spdx.org/rdf/3.0.1/spdx-context.jsonld",
  "@graph": [
    {
      "type": "CreationInfo",
      "@id": "_:creationInfo",
      "specVersion": "3.0.1",
      "created": "2026-11-04T00:00:00Z",
      "createdBy": [
        "https://jesseahawkins.com/vendors/github-copilot/aibom/tool"
      ]
    },
    {
      "type": "Tool",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/tool",
      "creationInfo": "_:creationInfo",
      "name": "jesseahawkins.com vendor record"
    },
    {
      "type": "SpdxDocument",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/document",
      "creationInfo": "_:creationInfo",
      "name": "AI BOM for GitHub Copilot: GitHub Copilot Business and Enterprise",
      "profileConformance": [
        "core",
        "software",
        "ai"
      ],
      "rootElement": [
        "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package"
      ]
    },
    {
      "type": "ai_AIPackage",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "creationInfo": "_:creationInfo",
      "name": "GitHub Copilot: GitHub Copilot Business and Enterprise"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/ai_subprocessors",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors = A published list; new names 30 days in advance. Evidence snapshot sha256:fafcdb7003b578650b127a8fab76f9970f860fb04ea0e0cc28f50c4ff0f81407; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26. Responsive to (not compliant with): dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/customer_data_retention_period",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period = Not kept in the IDE; 28 days for other use, with listed exceptions. Evidence snapshot sha256:30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26. Responsive to (not compliant with): iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/data_residency",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency = Listed for each sub-processor; AI inference in the US and other countries. Evidence snapshot sha256:fafcdb7003b578650b127a8fab76f9970f860fb04ea0e0cc28f50c4ff0f81407; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/dpa",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa = GitHub’s Data Protection Agreement, for business customers. Evidence snapshot sha256:30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/trains_on_customer_data",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data = No. Evidence snapshot sha256:30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26. Responsive to (not compliant with): eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/trains_on_free_use",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_free_use = Yes on Free, Pro and Pro+, unless the user opts out. Evidence snapshot sha256:30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/usage_limits",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits = A monthly allowance of AI credits per plan; on Business and Enterprise, admins set limits on paid usage beyond it; GitHub’s own rate limits have no published numbers. Evidence snapshot sha256:30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/certifications",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "certifications is recorded with no value (fact github-copilot/certifications@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/zero_data_retention",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention is recorded with no value (fact github-copilot/zero_data_retention@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/ai_subprocessors/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors, in GitHub Copilot's own words: \"GitHub publishes the names of any new subprocessors for its online services at least 30 days in advance of the subprocessor’s authorization to perform services that may involve access to customer data or personal data.\" Source: https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/customer_data_retention_period/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period, in GitHub Copilot's own words: \"Access through IDE for Chat and Code Completions: Prompts and Suggestions: Not retained User Engagement Data: Kept for two years. Feedback Data: Stored for as long as needed for its intended purpose. All other GitHub Copilot access and use: Prompts and Suggestions: Retained for 28 days.\" Source: https://github.com/features/copilot"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/data_residency/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency, in GitHub Copilot's own words: \"Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore\" Source: https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/dpa/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa, in GitHub Copilot's own words: \"These practices are outlined in GitHub’s Data Protection Agreement (DPA), which details our data handling commitments to our data controller customers.\" Source: https://github.com/features/copilot"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/trains_on_customer_data/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data, in GitHub Copilot's own words: \"No. GitHub does not use either Copilot Business or Enterprise data to train its models.\" Source: https://github.com/features/copilot"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/trains_on_free_use/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_free_use, in GitHub Copilot's own words: \"Starting on April 24, GitHub may also use interactions from users with a Copilot Free, Copilot Pro, and Copilot Pro+ subscription - including inputs, outputs, code snippets, and associated context - to train and improve our AI models unless they have opted out.\" Source: https://github.com/features/copilot"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/usage_limits/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits, in GitHub Copilot's own words: \"On GitHub Copilot Business and GitHub Copilot Enterprise, admins set usage limits and decide whether additional paid usage is allowed. If it isn't, Copilot pauses until the next cycle.\" Source: https://github.com/features/copilot"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/notice",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/document",
      "contentType": "text/plain",
      "statement": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/github-copilot/aibom/annotation/signature",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/github-copilot/aibom/document",
      "contentType": "text/plain",
      "statement": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}