{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3b7ba5cd-1528-5b8c-b9df-e6ffbb44aa2b",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-04T00:00:00Z"
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "https://jesseahawkins.com/vendors/microsoft/aibom/component",
      "name": "Microsoft: Azure OpenAI and other models sold by Azure in Microsoft Foundry",
      "properties": [
        {
          "name": "com.jesseahawkins:fact:data_residency",
          "value": "In the customer’s chosen geography, except Global and DataZone deployments"
        },
        {
          "name": "com.jesseahawkins:evidence:data_residency",
          "value": "snapshot:sha256:cb7f0b5243c1a1e30e5074c37119277a1f985a202df84c4f208cc881f9f23a54"
        },
        {
          "name": "com.jesseahawkins:recorded-at:data_residency",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:data_residency",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:fact:dpa",
          "value": "The Microsoft data protection addendum, part of the Product Terms"
        },
        {
          "name": "com.jesseahawkins:evidence:dpa",
          "value": "snapshot:sha256:7bf9a5c835832217c1460f4d1a6b908d5d5b887304dd7744d7152f07f61f1b92"
        },
        {
          "name": "com.jesseahawkins:recorded-at:dpa",
          "value": "2026-11-03T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:dpa",
          "value": "2026-11-03"
        },
        {
          "name": "com.jesseahawkins:fact:trains_on_customer_data",
          "value": "Not without permission"
        },
        {
          "name": "com.jesseahawkins:evidence:trains_on_customer_data",
          "value": "snapshot:sha256:cb7f0b5243c1a1e30e5074c37119277a1f985a202df84c4f208cc881f9f23a54"
        },
        {
          "name": "com.jesseahawkins:recorded-at:trains_on_customer_data",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:trains_on_customer_data",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:responsive-to:trains_on_customer_data",
          "value": "eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:usage_limits",
          "value": "Quotas by Azure subscription and quota tier; tiers rise with usage unless the customer opts out"
        },
        {
          "name": "com.jesseahawkins:evidence:usage_limits",
          "value": "snapshot:sha256:0765f2922a09a1576510fa1111377199c0945476b2066bb55bedad78cb91deaa"
        },
        {
          "name": "com.jesseahawkins:recorded-at:usage_limits",
          "value": "2026-11-03T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:usage_limits",
          "value": "2026-11-03"
        },
        {
          "name": "com.jesseahawkins:fact:zero_data_retention",
          "value": "Modified abuse monitoring, by application"
        },
        {
          "name": "com.jesseahawkins:evidence:zero_data_retention",
          "value": "snapshot:sha256:8ccd372f07b1ff5025f76ee926a327ed635d65e8bc318ac3d3a498f194d57f6f"
        },
        {
          "name": "com.jesseahawkins:recorded-at:zero_data_retention",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:zero_data_retention",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:withheld:ai_subprocessors",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:withheld:certifications",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:withheld:customer_data_retention_period",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:quote:data_residency",
          "value": "Prompts and responses are processed within the customer-specified geography (unless you are using a Global or DataZone deployment type), but may be processed between regions within the geography for operational purposes (including performance and capacity management)."
        },
        {
          "name": "com.jesseahawkins:source:data_residency",
          "value": "https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy"
        },
        {
          "name": "com.jesseahawkins:quote:dpa",
          "value": "When you subscribe to a Product under the terms of the Product Terms site, the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA). The DPA is an addendum to the Product Terms site (and formerly OST)."
        },
        {
          "name": "com.jesseahawkins:source:dpa",
          "value": "https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA"
        },
        {
          "name": "com.jesseahawkins:quote:trains_on_customer_data",
          "value": "Your prompts (inputs) and completions (outputs), your embeddings, and your training data: are NOT available to other customers. are NOT available to OpenAI or other providers of Models sold by Azure. are NOT used by providers of Models sold by Azure to improve their models or services. are NOT used to train any generative AI foundation models without your permission or instruction."
        },
        {
          "name": "com.jesseahawkins:source:trains_on_customer_data",
          "value": "https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy"
        },
        {
          "name": "com.jesseahawkins:quote:usage_limits",
          "value": "Quotas now increase automatically with usage, helping avoid rate limit errors while also creating a fairer environment for all users."
        },
        {
          "name": "com.jesseahawkins:source:usage_limits",
          "value": "https://learn.microsoft.com/en-us/azure/foundry/openai/quotas-limits"
        },
        {
          "name": "com.jesseahawkins:quote:zero_data_retention",
          "value": "Microsoft allows customers who meet additional Limited Access eligibility criteria to apply to modify abuse monitoring by completing this form."
        },
        {
          "name": "com.jesseahawkins:source:zero_data_retention",
          "value": "https://learn.microsoft.com/en-us/azure/foundry/openai/concepts/abuse-monitoring"
        }
      ]
    }
  ],
  "properties": [
    {
      "name": "com.jesseahawkins:vendor",
      "value": "microsoft"
    },
    {
      "name": "com.jesseahawkins:record",
      "value": "https://jesseahawkins.com/vendors/microsoft/"
    },
    {
      "name": "com.jesseahawkins:notice",
      "value": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "name": "com.jesseahawkins:signed",
      "value": "false"
    },
    {
      "name": "com.jesseahawkins:signature-note",
      "value": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}