{
  "@context": "https://spdx.org/rdf/3.0.1/spdx-context.jsonld",
  "@graph": [
    {
      "type": "CreationInfo",
      "@id": "_:creationInfo",
      "specVersion": "3.0.1",
      "created": "2026-11-04T00:00:00Z",
      "createdBy": [
        "https://jesseahawkins.com/vendors/xai/aibom/tool"
      ]
    },
    {
      "type": "Tool",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/tool",
      "creationInfo": "_:creationInfo",
      "name": "jesseahawkins.com vendor record"
    },
    {
      "type": "SpdxDocument",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/document",
      "creationInfo": "_:creationInfo",
      "name": "AI BOM for xAI: xAI API",
      "profileConformance": [
        "core",
        "software",
        "ai"
      ],
      "rootElement": [
        "https://jesseahawkins.com/vendors/xai/aibom/ai-package"
      ]
    },
    {
      "type": "ai_AIPackage",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "creationInfo": "_:creationInfo",
      "name": "xAI: xAI API"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/ai_subprocessors",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors = A published list; new names 15 days in advance. Evidence snapshot sha256:d932580a20340627ba7ac1ac70ae6ec6f710a99ef5c060e3e2ba7b3ff5e1e429; recorded 2026-11-03T00:00:00Z; valid from 2026-11-03. Responsive to (not compliant with): dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/certifications",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "certifications = SOC 2 Type 2. Evidence snapshot sha256:30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/customer_data_retention_period",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period = 30 days. Evidence snapshot sha256:30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24. Responsive to (not compliant with): iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/data_residency",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency = US only on the US regional endpoint, for two models, with listed exclusions. Evidence snapshot sha256:30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/dpa",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa = Incorporated into the enterprise terms; personal data only through the ZDR-Enabled API. Evidence snapshot sha256:d932580a20340627ba7ac1ac70ae6ec6f710a99ef5c060e3e2ba7b3ff5e1e429; recorded 2026-11-03T00:00:00Z; valid from 2026-11-03."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/trains_on_customer_data",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data = Not without permission. Evidence snapshot sha256:30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24. Responsive to (not compliant with): eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/trains_on_free_use",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_free_use = Listed as a use of personal information. Evidence snapshot sha256:17d51a8463735c94cddbabee411c750b5ae36e9b761d5c6a806aed870c48dd04; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/usage_limits",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits = Per-model limits on requests per second and tokens per minute, by spend tier; voice and audio by requests and concurrent sessions. Evidence snapshot sha256:9b4d45abfec062caef6af1999c8f2d8150f70d33b4d20d68bc914db75157f2a2; recorded 2026-11-03T00:00:00Z; valid from 2026-11-03."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/zero_data_retention",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention = Zero Data Retention, a team setting where self-serve is available. Evidence snapshot sha256:30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/ai_subprocessors/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors, in xAI's own words: \"SpaceXSI will notify you if we add or replace Subprocessors at least fifteen (15) days before such changes take effect.\" Source: https://x.ai/legal/data-processing-addendum"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/certifications/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "certifications, in xAI's own words: \"We are SOC 2 Type 2 compliant. Customers with a signed NDA can refer to our Trust Center for up-to-date information on our certifications and data governance.\" Source: https://docs.x.ai/developers/faq/security"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/customer_data_retention_period/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period, in xAI's own words: \"By default, all API requests and responses are stored on our servers (encrypted at rest) for 30 days\" Source: https://docs.x.ai/developers/faq/security"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/data_residency/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency, in xAI's own words: \"To keep API request handling, model inference, moderation, and retained request data in the United States, use the US regional endpoint, https://us.api.x.ai/v1.\" Source: https://docs.x.ai/developers/faq/security"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/dpa/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa, in xAI's own words: \"This Data Processing Addendum, including its two Appendices (collectively, the \"DPA\"), is incorporated into and forms a part of the Terms of Service - Enterprise (“Agreement”) between Customer (a.k.a. “you”) and SpaceXSI.\" Source: https://x.ai/legal/data-processing-addendum"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/trains_on_customer_data/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data, in xAI's own words: \"SpaceXSI never trains on your API inputs or outputs without your explicit permission.\" Source: https://docs.x.ai/developers/faq/security"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/trains_on_free_use/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_free_use, in xAI's own words: \"To develop and improve our Service and to conduct research: For example to develop new product features, to train our models\" Source: https://x.ai/legal/privacy-policy"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/usage_limits/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits, in xAI's own words: \"Every xAI API team has per-model rate limits on two dimensions: requests per second (RPS) and tokens per minute (TPM).\" Source: https://docs.x.ai/developers/rate-limits"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/zero_data_retention/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention, in xAI's own words: \"Where available, a team admin can turn it on or off directly from the xAI Console.\" Source: https://docs.x.ai/developers/faq/security"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/notice",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/document",
      "contentType": "text/plain",
      "statement": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/xai/aibom/annotation/signature",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/xai/aibom/document",
      "contentType": "text/plain",
      "statement": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}