{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d5d55a13-0832-5d0d-9610-74690855803b",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-04T00:00:00Z"
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "https://jesseahawkins.com/vendors/stepfun/aibom/component",
      "name": "StepFun: StepFun Open Platform, international site",
      "properties": [
        {
          "name": "com.jesseahawkins:fact:ai_subprocessors",
          "value": "The customer gives StepFun general authorization to engage subprocessors"
        },
        {
          "name": "com.jesseahawkins:evidence:ai_subprocessors",
          "value": "snapshot:sha256:4f6547754c82d04d002040a48dfc7dbf15434cb0a9549f97ade574eae9dd2f6b"
        },
        {
          "name": "com.jesseahawkins:recorded-at:ai_subprocessors",
          "value": "2026-11-04T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:ai_subprocessors",
          "value": "2026-11-04"
        },
        {
          "name": "com.jesseahawkins:responsive-to:ai_subprocessors",
          "value": "dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1"
        },
        {
          "name": "com.jesseahawkins:fact:customer_data_retention_period",
          "value": "Customer Data is deleted within 30 days after the agreement ends, with exceptions"
        },
        {
          "name": "com.jesseahawkins:evidence:customer_data_retention_period",
          "value": "snapshot:sha256:4f6547754c82d04d002040a48dfc7dbf15434cb0a9549f97ade574eae9dd2f6b"
        },
        {
          "name": "com.jesseahawkins:recorded-at:customer_data_retention_period",
          "value": "2026-11-04T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:customer_data_retention_period",
          "value": "2026-11-04"
        },
        {
          "name": "com.jesseahawkins:responsive-to:customer_data_retention_period",
          "value": "iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:data_residency",
          "value": "Privacy policy: servers in the United States; affiliates and providers elsewhere may access data"
        },
        {
          "name": "com.jesseahawkins:evidence:data_residency",
          "value": "snapshot:sha256:cb0c3efb4fe3cc776ece0969f1ac1cf47d99cebbf969c607a92e06d70be35380"
        },
        {
          "name": "com.jesseahawkins:recorded-at:data_residency",
          "value": "2026-11-04T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:data_residency",
          "value": "2026-11-04"
        },
        {
          "name": "com.jesseahawkins:fact:dpa",
          "value": "A DPA forms part of the Terms of Service and applies to StepFun’s processing of Customer Data"
        },
        {
          "name": "com.jesseahawkins:evidence:dpa",
          "value": "snapshot:sha256:4f6547754c82d04d002040a48dfc7dbf15434cb0a9549f97ade574eae9dd2f6b"
        },
        {
          "name": "com.jesseahawkins:recorded-at:dpa",
          "value": "2026-11-04T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:dpa",
          "value": "2026-11-04"
        },
        {
          "name": "com.jesseahawkins:fact:trains_on_customer_data",
          "value": "May train: the terms license prompts, outputs and API call logs to StepFun for any purpose"
        },
        {
          "name": "com.jesseahawkins:evidence:trains_on_customer_data",
          "value": "snapshot:sha256:ba64e4507c3fe00741365f5c316e28df82af866a3e7de8b2915bd3bd29cbebb2"
        },
        {
          "name": "com.jesseahawkins:recorded-at:trains_on_customer_data",
          "value": "2026-11-04T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:trains_on_customer_data",
          "value": "2026-11-04"
        },
        {
          "name": "com.jesseahawkins:responsive-to:trains_on_customer_data",
          "value": "eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:usage_limits",
          "value": "Pay-as-you-go rate limits by tier of cash top-up; enterprise tiers through sales"
        },
        {
          "name": "com.jesseahawkins:evidence:usage_limits",
          "value": "snapshot:sha256:392dc4e5afc265b83d9894e987e187d5fbca4833942bb9f4b861320aae32bb0c"
        },
        {
          "name": "com.jesseahawkins:recorded-at:usage_limits",
          "value": "2026-11-04T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:usage_limits",
          "value": "2026-11-04"
        },
        {
          "name": "com.jesseahawkins:withheld:certifications",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:withheld:zero_data_retention",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:quote:ai_subprocessors",
          "value": "Customer grants StepFun general authorization to engage subprocessors."
        },
        {
          "name": "com.jesseahawkins:source:ai_subprocessors",
          "value": "https://platform.stepfun.ai/docs/en/agreement/dataprocess"
        },
        {
          "name": "com.jesseahawkins:quote:customer_data_retention_period",
          "value": "Within 30 days of termination or expiration of the Agreement, StepFun will:"
        },
        {
          "name": "com.jesseahawkins:source:customer_data_retention_period",
          "value": "https://platform.stepfun.ai/docs/en/agreement/dataprocess"
        },
        {
          "name": "com.jesseahawkins:quote:data_residency",
          "value": "Our servers are located in the United States. Meanwhile, due to the international nature of our business, your personal information may also be accessed by our affiliates or be transferred to third-party service providers and business partners, in connection with the purposes set out in this Policy."
        },
        {
          "name": "com.jesseahawkins:source:data_residency",
          "value": "https://platform.stepfun.ai/docs/en/agreement/userprivacy"
        },
        {
          "name": "com.jesseahawkins:quote:dpa",
          "value": "This Data Processing Agreement (“DPA”) is incorporated into and forms part of the Terms of Service or other agreement between Customer and StepFun that references this DPA and governs Customer’s use of the Services (the “Agreement”). It applies to StepFun’s processing of Customer Data as defined below."
        },
        {
          "name": "com.jesseahawkins:source:dpa",
          "value": "https://platform.stepfun.ai/docs/en/agreement/dataprocess"
        },
        {
          "name": "com.jesseahawkins:quote:trains_on_customer_data",
          "value": "When you use the Services in accordance with these Terms, you grant us, to the fullest extent permitted under the applicable law, a nonexclusive, worldwide, royalty-free, fully paid up, transferable, sublicensable, perpetual, irrevocable license to copy, display, upload, perform, distribute, transmit, make available, store, access, modify, exploit, commercialize and otherwise use all Output, Prompts and associated API call logs (“Usage Data”) elicited by you for any purpose in any form, medium or technology now known or later developed, including but not limited to (i) facilitating other users’ ability to elicit Output, and (ii) promoting the Services."
        },
        {
          "name": "com.jesseahawkins:source:trains_on_customer_data",
          "value": "https://platform.stepfun.ai/docs/en/agreement/userservice"
        },
        {
          "name": "com.jesseahawkins:quote:usage_limits",
          "value": "Pay-as-you-go calls to the standard Open Platform API are rate limited by tier according to the cumulative top-up amount on your account. Only cash top-ups count toward that amount; vouchers do not."
        },
        {
          "name": "com.jesseahawkins:source:usage_limits",
          "value": "https://platform.stepfun.ai/docs/en/guides/pricing/details"
        }
      ]
    }
  ],
  "properties": [
    {
      "name": "com.jesseahawkins:vendor",
      "value": "stepfun"
    },
    {
      "name": "com.jesseahawkins:record",
      "value": "https://jesseahawkins.com/vendors/stepfun/"
    },
    {
      "name": "com.jesseahawkins:notice",
      "value": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "name": "com.jesseahawkins:signed",
      "value": "false"
    },
    {
      "name": "com.jesseahawkins:signature-note",
      "value": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}