{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6802945f-7896-5f28-a61c-27fe99f6c5c2",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-04T00:00:00Z"
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "https://jesseahawkins.com/vendors/google/aibom/component",
      "name": "Google: Gemini API and Gemini models on Google Cloud",
      "properties": [
        {
          "name": "com.jesseahawkins:fact:ai_subprocessors",
          "value": "A published list for Google Cloud, AI services included"
        },
        {
          "name": "com.jesseahawkins:evidence:ai_subprocessors",
          "value": "snapshot:sha256:a6ed1984ff40698b2be48013e848b0eea59c98994ce442ecc48211e699a547d6"
        },
        {
          "name": "com.jesseahawkins:recorded-at:ai_subprocessors",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:ai_subprocessors",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:responsive-to:ai_subprocessors",
          "value": "dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1"
        },
        {
          "name": "com.jesseahawkins:fact:customer_data_retention_period",
          "value": "A limited period, for abuse detection and legal disclosures, on paid use"
        },
        {
          "name": "com.jesseahawkins:evidence:customer_data_retention_period",
          "value": "snapshot:sha256:0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e"
        },
        {
          "name": "com.jesseahawkins:recorded-at:customer_data_retention_period",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:customer_data_retention_period",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:responsive-to:customer_data_retention_period",
          "value": "iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:data_residency",
          "value": "On Google Cloud: at rest in the chosen location; global endpoints carry no guarantee"
        },
        {
          "name": "com.jesseahawkins:evidence:data_residency",
          "value": "snapshot:sha256:dbd4fd892d3f15210d9d553cb2e6920be55a339c3fe9ec124cc6501551d0040b"
        },
        {
          "name": "com.jesseahawkins:recorded-at:data_residency",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:data_residency",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:fact:dpa",
          "value": "Prompts and responses on paid use processed under Google’s Data Processing Addendum"
        },
        {
          "name": "com.jesseahawkins:evidence:dpa",
          "value": "snapshot:sha256:0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e"
        },
        {
          "name": "com.jesseahawkins:recorded-at:dpa",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:dpa",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:fact:trains_on_customer_data",
          "value": "Not used to improve products, on paid use"
        },
        {
          "name": "com.jesseahawkins:evidence:trains_on_customer_data",
          "value": "snapshot:sha256:0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e"
        },
        {
          "name": "com.jesseahawkins:recorded-at:trains_on_customer_data",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:trains_on_customer_data",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:responsive-to:trains_on_customer_data",
          "value": "eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:trains_on_free_use",
          "value": "Used to improve products, on unpaid use outside the EEA, Switzerland and the UK"
        },
        {
          "name": "com.jesseahawkins:evidence:trains_on_free_use",
          "value": "snapshot:sha256:0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e"
        },
        {
          "name": "com.jesseahawkins:recorded-at:trains_on_free_use",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:trains_on_free_use",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:fact:usage_limits",
          "value": "Quotas by Google Cloud project, with default values that can typically be adjusted on request; fixed system limits"
        },
        {
          "name": "com.jesseahawkins:evidence:usage_limits",
          "value": "snapshot:sha256:6185f73bdf51ac2bfd828e872aed6e5509eeaf398295c6b36b9b0960a04ffa2f"
        },
        {
          "name": "com.jesseahawkins:recorded-at:usage_limits",
          "value": "2026-11-03T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:usage_limits",
          "value": "2026-11-03"
        },
        {
          "name": "com.jesseahawkins:fact:zero_data_retention",
          "value": "Zero data retention on Google Cloud, with customer actions; not possible with some features"
        },
        {
          "name": "com.jesseahawkins:evidence:zero_data_retention",
          "value": "snapshot:sha256:dca5cdf5c2adfdd633ad5d1a6f3cabc94ce13e9cff0daacccd29d591ee853056"
        },
        {
          "name": "com.jesseahawkins:recorded-at:zero_data_retention",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:zero_data_retention",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:withheld:certifications",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:quote:ai_subprocessors",
          "value": "Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Cloud Platform Services."
        },
        {
          "name": "com.jesseahawkins:source:ai_subprocessors",
          "value": "https://cloud.google.com/terms/subprocessors"
        },
        {
          "name": "com.jesseahawkins:quote:customer_data_retention_period",
          "value": "For Paid Services, Google logs prompts and responses for a limited period of time, solely for detecting and preventing violations of the Prohibited Use Policy to maintain the safety and security of the Services, and any required legal or regulatory disclosures."
        },
        {
          "name": "com.jesseahawkins:source:customer_data_retention_period",
          "value": "https://ai.google.dev/gemini-api/terms?hl=en"
        },
        {
          "name": "com.jesseahawkins:quote:data_residency",
          "value": "Data stored at rest in the customer selected location remains at rest in that location, independent of the Gemini Enterprise Agent Platform endpoint called by that customer's request."
        },
        {
          "name": "com.jesseahawkins:source:data_residency",
          "value": "https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/data-residency"
        },
        {
          "name": "com.jesseahawkins:quote:dpa",
          "value": "will process your prompts and responses in accordance with the Data Processing Addendum for Products Where Google is a Data Processor."
        },
        {
          "name": "com.jesseahawkins:source:dpa",
          "value": "https://ai.google.dev/gemini-api/terms?hl=en"
        },
        {
          "name": "com.jesseahawkins:quote:trains_on_customer_data",
          "value": "When you use Paid Services, including, for example, the paid quota of the Gemini API, Google doesn't use your prompts (including associated system instructions, cached content, and files such as images, videos, or documents) or responses to improve our products"
        },
        {
          "name": "com.jesseahawkins:source:trains_on_customer_data",
          "value": "https://ai.google.dev/gemini-api/terms?hl=en"
        },
        {
          "name": "com.jesseahawkins:quote:trains_on_free_use",
          "value": "When you use Unpaid Services, including, for example, Google AI Studio and the unpaid quota on Gemini API, Google uses the content you submit to the Services and any generated responses to provide, improve, and develop Google products and services and machine learning technologies"
        },
        {
          "name": "com.jesseahawkins:source:trains_on_free_use",
          "value": "https://ai.google.dev/gemini-api/terms?hl=en"
        },
        {
          "name": "com.jesseahawkins:quote:usage_limits",
          "value": "Quotas have default values, but you can typically request adjustments. System limits are fixed values that can't be changed."
        },
        {
          "name": "com.jesseahawkins:source:usage_limits",
          "value": "https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/quotas"
        },
        {
          "name": "com.jesseahawkins:quote:zero_data_retention",
          "value": "To achieve zero data retention, customers must take specific actions within each of these areas:"
        },
        {
          "name": "com.jesseahawkins:source:zero_data_retention",
          "value": "https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/zero-data-retention"
        }
      ]
    }
  ],
  "properties": [
    {
      "name": "com.jesseahawkins:vendor",
      "value": "google"
    },
    {
      "name": "com.jesseahawkins:record",
      "value": "https://jesseahawkins.com/vendors/google/"
    },
    {
      "name": "com.jesseahawkins:notice",
      "value": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "name": "com.jesseahawkins:signed",
      "value": "false"
    },
    {
      "name": "com.jesseahawkins:signature-note",
      "value": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}