{
  "@context": "https://spdx.org/rdf/3.0.1/spdx-context.jsonld",
  "@graph": [
    {
      "type": "CreationInfo",
      "@id": "_:creationInfo",
      "specVersion": "3.0.1",
      "created": "2026-11-04T00:00:00Z",
      "createdBy": [
        "https://jesseahawkins.com/vendors/google/aibom/tool"
      ]
    },
    {
      "type": "Tool",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/tool",
      "creationInfo": "_:creationInfo",
      "name": "jesseahawkins.com vendor record"
    },
    {
      "type": "SpdxDocument",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/document",
      "creationInfo": "_:creationInfo",
      "name": "AI BOM for Google: Gemini API and Gemini models on Google Cloud",
      "profileConformance": [
        "core",
        "software",
        "ai"
      ],
      "rootElement": [
        "https://jesseahawkins.com/vendors/google/aibom/ai-package"
      ]
    },
    {
      "type": "ai_AIPackage",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "creationInfo": "_:creationInfo",
      "name": "Google: Gemini API and Gemini models on Google Cloud"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/ai_subprocessors",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors = A published list for Google Cloud, AI services included. Evidence snapshot sha256:a6ed1984ff40698b2be48013e848b0eea59c98994ce442ecc48211e699a547d6; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26. Responsive to (not compliant with): dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/customer_data_retention_period",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period = A limited period, for abuse detection and legal disclosures, on paid use. Evidence snapshot sha256:0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24. Responsive to (not compliant with): iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/data_residency",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency = On Google Cloud: at rest in the chosen location; global endpoints carry no guarantee. Evidence snapshot sha256:dbd4fd892d3f15210d9d553cb2e6920be55a339c3fe9ec124cc6501551d0040b; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/dpa",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa = Prompts and responses on paid use processed under Google’s Data Processing Addendum. Evidence snapshot sha256:0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/trains_on_customer_data",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data = Not used to improve products, on paid use. Evidence snapshot sha256:0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24. Responsive to (not compliant with): eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/trains_on_free_use",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_free_use = Used to improve products, on unpaid use outside the EEA, Switzerland and the UK. Evidence snapshot sha256:0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/usage_limits",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits = Quotas by Google Cloud project, with default values that can typically be adjusted on request; fixed system limits. Evidence snapshot sha256:6185f73bdf51ac2bfd828e872aed6e5509eeaf398295c6b36b9b0960a04ffa2f; recorded 2026-11-03T00:00:00Z; valid from 2026-11-03."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/zero_data_retention",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention = Zero data retention on Google Cloud, with customer actions; not possible with some features. Evidence snapshot sha256:dca5cdf5c2adfdd633ad5d1a6f3cabc94ce13e9cff0daacccd29d591ee853056; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/certifications",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "certifications is recorded with no value (fact google/certifications@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/ai_subprocessors/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors, in Google's own words: \"Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Cloud Platform Services.\" Source: https://cloud.google.com/terms/subprocessors"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/customer_data_retention_period/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period, in Google's own words: \"For Paid Services, Google logs prompts and responses for a limited period of time, solely for detecting and preventing violations of the Prohibited Use Policy to maintain the safety and security of the Services, and any required legal or regulatory disclosures.\" Source: https://ai.google.dev/gemini-api/terms?hl=en"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/data_residency/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency, in Google's own words: \"Data stored at rest in the customer selected location remains at rest in that location, independent of the Gemini Enterprise Agent Platform endpoint called by that customer's request.\" Source: https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/data-residency"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/dpa/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa, in Google's own words: \"will process your prompts and responses in accordance with the Data Processing Addendum for Products Where Google is a Data Processor.\" Source: https://ai.google.dev/gemini-api/terms?hl=en"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/trains_on_customer_data/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data, in Google's own words: \"When you use Paid Services, including, for example, the paid quota of the Gemini API, Google doesn't use your prompts (including associated system instructions, cached content, and files such as images, videos, or documents) or responses to improve our products\" Source: https://ai.google.dev/gemini-api/terms?hl=en"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/trains_on_free_use/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_free_use, in Google's own words: \"When you use Unpaid Services, including, for example, Google AI Studio and the unpaid quota on Gemini API, Google uses the content you submit to the Services and any generated responses to provide, improve, and develop Google products and services and machine learning technologies\" Source: https://ai.google.dev/gemini-api/terms?hl=en"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/usage_limits/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits, in Google's own words: \"Quotas have default values, but you can typically request adjustments. System limits are fixed values that can't be changed.\" Source: https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/quotas"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/zero_data_retention/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention, in Google's own words: \"To achieve zero data retention, customers must take specific actions within each of these areas:\" Source: https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/zero-data-retention"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/notice",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/document",
      "contentType": "text/plain",
      "statement": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/google/aibom/annotation/signature",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/google/aibom/document",
      "contentType": "text/plain",
      "statement": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}