{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:cd3f85a6-887a-5842-ac44-f7ebf081655c",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-04T00:00:00Z"
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "https://jesseahawkins.com/vendors/xai/aibom/component",
      "name": "xAI: xAI API",
      "properties": [
        {
          "name": "com.jesseahawkins:fact:ai_subprocessors",
          "value": "A published list; new names 15 days in advance"
        },
        {
          "name": "com.jesseahawkins:evidence:ai_subprocessors",
          "value": "snapshot:sha256:d932580a20340627ba7ac1ac70ae6ec6f710a99ef5c060e3e2ba7b3ff5e1e429"
        },
        {
          "name": "com.jesseahawkins:recorded-at:ai_subprocessors",
          "value": "2026-11-03T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:ai_subprocessors",
          "value": "2026-11-03"
        },
        {
          "name": "com.jesseahawkins:responsive-to:ai_subprocessors",
          "value": "dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1"
        },
        {
          "name": "com.jesseahawkins:fact:certifications",
          "value": "SOC 2 Type 2"
        },
        {
          "name": "com.jesseahawkins:evidence:certifications",
          "value": "snapshot:sha256:30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1"
        },
        {
          "name": "com.jesseahawkins:recorded-at:certifications",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:certifications",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:fact:customer_data_retention_period",
          "value": "30 days"
        },
        {
          "name": "com.jesseahawkins:evidence:customer_data_retention_period",
          "value": "snapshot:sha256:30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1"
        },
        {
          "name": "com.jesseahawkins:recorded-at:customer_data_retention_period",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:customer_data_retention_period",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:responsive-to:customer_data_retention_period",
          "value": "iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:data_residency",
          "value": "US only on the US regional endpoint, for two models, with listed exclusions"
        },
        {
          "name": "com.jesseahawkins:evidence:data_residency",
          "value": "snapshot:sha256:30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1"
        },
        {
          "name": "com.jesseahawkins:recorded-at:data_residency",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:data_residency",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:fact:dpa",
          "value": "Incorporated into the enterprise terms; personal data only through the ZDR-Enabled API"
        },
        {
          "name": "com.jesseahawkins:evidence:dpa",
          "value": "snapshot:sha256:d932580a20340627ba7ac1ac70ae6ec6f710a99ef5c060e3e2ba7b3ff5e1e429"
        },
        {
          "name": "com.jesseahawkins:recorded-at:dpa",
          "value": "2026-11-03T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:dpa",
          "value": "2026-11-03"
        },
        {
          "name": "com.jesseahawkins:fact:trains_on_customer_data",
          "value": "Not without permission"
        },
        {
          "name": "com.jesseahawkins:evidence:trains_on_customer_data",
          "value": "snapshot:sha256:30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1"
        },
        {
          "name": "com.jesseahawkins:recorded-at:trains_on_customer_data",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:trains_on_customer_data",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:responsive-to:trains_on_customer_data",
          "value": "eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:trains_on_free_use",
          "value": "Listed as a use of personal information"
        },
        {
          "name": "com.jesseahawkins:evidence:trains_on_free_use",
          "value": "snapshot:sha256:17d51a8463735c94cddbabee411c750b5ae36e9b761d5c6a806aed870c48dd04"
        },
        {
          "name": "com.jesseahawkins:recorded-at:trains_on_free_use",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:trains_on_free_use",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:fact:usage_limits",
          "value": "Per-model limits on requests per second and tokens per minute, by spend tier; voice and audio by requests and concurrent sessions"
        },
        {
          "name": "com.jesseahawkins:evidence:usage_limits",
          "value": "snapshot:sha256:9b4d45abfec062caef6af1999c8f2d8150f70d33b4d20d68bc914db75157f2a2"
        },
        {
          "name": "com.jesseahawkins:recorded-at:usage_limits",
          "value": "2026-11-03T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:usage_limits",
          "value": "2026-11-03"
        },
        {
          "name": "com.jesseahawkins:fact:zero_data_retention",
          "value": "Zero Data Retention, a team setting where self-serve is available"
        },
        {
          "name": "com.jesseahawkins:evidence:zero_data_retention",
          "value": "snapshot:sha256:30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1"
        },
        {
          "name": "com.jesseahawkins:recorded-at:zero_data_retention",
          "value": "2026-10-24T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:zero_data_retention",
          "value": "2026-10-24"
        },
        {
          "name": "com.jesseahawkins:quote:ai_subprocessors",
          "value": "SpaceXSI will notify you if we add or replace Subprocessors at least fifteen (15) days before such changes take effect."
        },
        {
          "name": "com.jesseahawkins:source:ai_subprocessors",
          "value": "https://x.ai/legal/data-processing-addendum"
        },
        {
          "name": "com.jesseahawkins:quote:certifications",
          "value": "We are SOC 2 Type 2 compliant. Customers with a signed NDA can refer to our Trust Center for up-to-date information on our certifications and data governance."
        },
        {
          "name": "com.jesseahawkins:source:certifications",
          "value": "https://docs.x.ai/developers/faq/security"
        },
        {
          "name": "com.jesseahawkins:quote:customer_data_retention_period",
          "value": "By default, all API requests and responses are stored on our servers (encrypted at rest) for 30 days"
        },
        {
          "name": "com.jesseahawkins:source:customer_data_retention_period",
          "value": "https://docs.x.ai/developers/faq/security"
        },
        {
          "name": "com.jesseahawkins:quote:data_residency",
          "value": "To keep API request handling, model inference, moderation, and retained request data in the United States, use the US regional endpoint, https://us.api.x.ai/v1."
        },
        {
          "name": "com.jesseahawkins:source:data_residency",
          "value": "https://docs.x.ai/developers/faq/security"
        },
        {
          "name": "com.jesseahawkins:quote:dpa",
          "value": "This Data Processing Addendum, including its two Appendices (collectively, the \"DPA\"), is incorporated into and forms a part of the Terms of Service - Enterprise (“Agreement”) between Customer (a.k.a. “you”) and SpaceXSI."
        },
        {
          "name": "com.jesseahawkins:source:dpa",
          "value": "https://x.ai/legal/data-processing-addendum"
        },
        {
          "name": "com.jesseahawkins:quote:trains_on_customer_data",
          "value": "SpaceXSI never trains on your API inputs or outputs without your explicit permission."
        },
        {
          "name": "com.jesseahawkins:source:trains_on_customer_data",
          "value": "https://docs.x.ai/developers/faq/security"
        },
        {
          "name": "com.jesseahawkins:quote:trains_on_free_use",
          "value": "To develop and improve our Service and to conduct research: For example to develop new product features, to train our models"
        },
        {
          "name": "com.jesseahawkins:source:trains_on_free_use",
          "value": "https://x.ai/legal/privacy-policy"
        },
        {
          "name": "com.jesseahawkins:quote:usage_limits",
          "value": "Every xAI API team has per-model rate limits on two dimensions: requests per second (RPS) and tokens per minute (TPM)."
        },
        {
          "name": "com.jesseahawkins:source:usage_limits",
          "value": "https://docs.x.ai/developers/rate-limits"
        },
        {
          "name": "com.jesseahawkins:quote:zero_data_retention",
          "value": "Where available, a team admin can turn it on or off directly from the xAI Console."
        },
        {
          "name": "com.jesseahawkins:source:zero_data_retention",
          "value": "https://docs.x.ai/developers/faq/security"
        }
      ]
    }
  ],
  "properties": [
    {
      "name": "com.jesseahawkins:vendor",
      "value": "xai"
    },
    {
      "name": "com.jesseahawkins:record",
      "value": "https://jesseahawkins.com/vendors/xai/"
    },
    {
      "name": "com.jesseahawkins:notice",
      "value": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "name": "com.jesseahawkins:signed",
      "value": "false"
    },
    {
      "name": "com.jesseahawkins:signature-note",
      "value": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}