{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fc7594ee-02e8-5e7b-b709-5b832c16849a",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-04T00:00:00Z"
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "https://jesseahawkins.com/vendors/openai/aibom/component",
      "name": "OpenAI: OpenAI API",
      "properties": [
        {
          "name": "com.jesseahawkins:fact:ai_subprocessors",
          "value": "Uses sub-processors; names Cloudflare for the US and EU endpoints"
        },
        {
          "name": "com.jesseahawkins:evidence:ai_subprocessors",
          "value": "snapshot:sha256:d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95"
        },
        {
          "name": "com.jesseahawkins:recorded-at:ai_subprocessors",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:ai_subprocessors",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:responsive-to:ai_subprocessors",
          "value": "dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1"
        },
        {
          "name": "com.jesseahawkins:fact:customer_data_retention_period",
          "value": "Up to 30 days in abuse monitoring logs, with listed exceptions"
        },
        {
          "name": "com.jesseahawkins:evidence:customer_data_retention_period",
          "value": "snapshot:sha256:d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95"
        },
        {
          "name": "com.jesseahawkins:recorded-at:customer_data_retention_period",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:customer_data_retention_period",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:responsive-to:customer_data_retention_period",
          "value": "iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:data_residency",
          "value": "Data residency controls, for eligible customers"
        },
        {
          "name": "com.jesseahawkins:evidence:data_residency",
          "value": "snapshot:sha256:d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95"
        },
        {
          "name": "com.jesseahawkins:recorded-at:data_residency",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:data_residency",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:fact:trains_on_customer_data",
          "value": "Not by default"
        },
        {
          "name": "com.jesseahawkins:evidence:trains_on_customer_data",
          "value": "snapshot:sha256:d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95"
        },
        {
          "name": "com.jesseahawkins:recorded-at:trains_on_customer_data",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:trains_on_customer_data",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:responsive-to:trains_on_customer_data",
          "value": "eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:usage_limits",
          "value": "Rate limits by model, organization and project; usage tiers rise with credit purchases"
        },
        {
          "name": "com.jesseahawkins:evidence:usage_limits",
          "value": "snapshot:sha256:850e5704abd712706740bd40223a26958bc4579dcb2fc0e361250d2b1a0ad81a"
        },
        {
          "name": "com.jesseahawkins:recorded-at:usage_limits",
          "value": "2026-11-03T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:usage_limits",
          "value": "2026-11-03"
        },
        {
          "name": "com.jesseahawkins:fact:zero_data_retention",
          "value": "Zero Data Retention, on approval"
        },
        {
          "name": "com.jesseahawkins:evidence:zero_data_retention",
          "value": "snapshot:sha256:d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95"
        },
        {
          "name": "com.jesseahawkins:recorded-at:zero_data_retention",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:zero_data_retention",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:withheld:certifications",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:withheld:dpa",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:quote:ai_subprocessors",
          "value": "OpenAI uses sub-processors to provide its services. For requests sent to us.api.openai.com or eu.api.openai.com, OpenAI uses Cloudflare Regional Services so that TLS termination and HTTPS decryption occur within the selected processing region."
        },
        {
          "name": "com.jesseahawkins:source:ai_subprocessors",
          "value": "https://developers.openai.com/api/docs/guides/your-data"
        },
        {
          "name": "com.jesseahawkins:quote:customer_data_retention_period",
          "value": "By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm."
        },
        {
          "name": "com.jesseahawkins:source:customer_data_retention_period",
          "value": "https://developers.openai.com/api/docs/guides/your-data"
        },
        {
          "name": "com.jesseahawkins:quote:data_residency",
          "value": "Data residency controls are a project configuration option that allow you to configure the location of infrastructure OpenAI uses to provide services."
        },
        {
          "name": "com.jesseahawkins:source:data_residency",
          "value": "https://developers.openai.com/api/docs/guides/your-data"
        },
        {
          "name": "com.jesseahawkins:quote:trains_on_customer_data",
          "value": "As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)."
        },
        {
          "name": "com.jesseahawkins:source:trains_on_customer_data",
          "value": "https://developers.openai.com/api/docs/guides/your-data"
        },
        {
          "name": "com.jesseahawkins:quote:usage_limits",
          "value": "The three paid usage tiers are Build, Launch, and Grow. Your organization’s usage tier upgrades automatically as its total credit purchases reach each threshold."
        },
        {
          "name": "com.jesseahawkins:source:usage_limits",
          "value": "https://developers.openai.com/api/docs/guides/rate-limits"
        },
        {
          "name": "com.jesseahawkins:quote:zero_data_retention",
          "value": "Eligible customers may have their customer content excluded from these abuse monitoring logs, subject to the limitations below, by getting approved for the Zero Data Retention or Modified Abuse Monitoring controls."
        },
        {
          "name": "com.jesseahawkins:source:zero_data_retention",
          "value": "https://developers.openai.com/api/docs/guides/your-data"
        }
      ]
    }
  ],
  "properties": [
    {
      "name": "com.jesseahawkins:vendor",
      "value": "openai"
    },
    {
      "name": "com.jesseahawkins:record",
      "value": "https://jesseahawkins.com/vendors/openai/"
    },
    {
      "name": "com.jesseahawkins:notice",
      "value": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "name": "com.jesseahawkins:signed",
      "value": "false"
    },
    {
      "name": "com.jesseahawkins:signature-note",
      "value": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}