{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3f593eb0-528e-5770-a784-742a72d16356",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-04T00:00:00Z"
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "https://jesseahawkins.com/vendors/zai/aibom/component",
      "name": "Z.ai: Z.ai API Services (GLM models)",
      "properties": [
        {
          "name": "com.jesseahawkins:fact:ai_subprocessors",
          "value": "Group companies and service providers, typically in Singapore; no list"
        },
        {
          "name": "com.jesseahawkins:evidence:ai_subprocessors",
          "value": "snapshot:sha256:a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0"
        },
        {
          "name": "com.jesseahawkins:recorded-at:ai_subprocessors",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:ai_subprocessors",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:responsive-to:ai_subprocessors",
          "value": "dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1"
        },
        {
          "name": "com.jesseahawkins:fact:customer_data_retention_period",
          "value": "API content not stored; other customer data kept until the terms end, with listed exceptions"
        },
        {
          "name": "com.jesseahawkins:evidence:customer_data_retention_period",
          "value": "snapshot:sha256:a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0"
        },
        {
          "name": "com.jesseahawkins:recorded-at:customer_data_retention_period",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:customer_data_retention_period",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:responsive-to:customer_data_retention_period",
          "value": "iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:data_residency",
          "value": "Generally processed in Singapore"
        },
        {
          "name": "com.jesseahawkins:evidence:data_residency",
          "value": "snapshot:sha256:a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0"
        },
        {
          "name": "com.jesseahawkins:recorded-at:data_residency",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:data_residency",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:fact:dpa",
          "value": "A Data Processing Addendum for API Services, incorporated into the Additional Terms for API Services"
        },
        {
          "name": "com.jesseahawkins:evidence:dpa",
          "value": "snapshot:sha256:a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0"
        },
        {
          "name": "com.jesseahawkins:recorded-at:dpa",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:dpa",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:fact:zero_data_retention",
          "value": "API content is not stored, the addendum says"
        },
        {
          "name": "com.jesseahawkins:evidence:zero_data_retention",
          "value": "snapshot:sha256:a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0"
        },
        {
          "name": "com.jesseahawkins:recorded-at:zero_data_retention",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:zero_data_retention",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:withheld:certifications",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:withheld:trains_on_customer_data",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:withheld:usage_limits",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:quote:ai_subprocessors",
          "value": "Company generally provide the Services from Singapore, and our group companies and their designated service providers are typically located in Singapore."
        },
        {
          "name": "com.jesseahawkins:source:ai_subprocessors",
          "value": "https://docs.z.ai/legal-agreement/privacy-policy"
        },
        {
          "name": "com.jesseahawkins:quote:customer_data_retention_period",
          "value": "This information is processed in real-time to provide the Customer and End Users with the API Service and is not saved on our servers."
        },
        {
          "name": "com.jesseahawkins:source:customer_data_retention_period",
          "value": "https://docs.z.ai/legal-agreement/privacy-policy"
        },
        {
          "name": "com.jesseahawkins:quote:data_residency",
          "value": "Company generally provide the Services from Singapore, and our group companies and their designated service providers are typically located in Singapore. As a result, Customer Data is generally processed in Singapore."
        },
        {
          "name": "com.jesseahawkins:source:data_residency",
          "value": "https://docs.z.ai/legal-agreement/privacy-policy"
        },
        {
          "name": "com.jesseahawkins:quote:dpa",
          "value": "If you are enterprises or developers using the API Services (“API Services”) available on Z.ai, please refer to the Data Processing Addendum for API Services."
        },
        {
          "name": "com.jesseahawkins:source:dpa",
          "value": "https://docs.z.ai/legal-agreement/privacy-policy"
        },
        {
          "name": "com.jesseahawkins:quote:zero_data_retention",
          "value": "The Company do not store any of the content the Customer or its End Users provide or generate while using our Services."
        },
        {
          "name": "com.jesseahawkins:source:zero_data_retention",
          "value": "https://docs.z.ai/legal-agreement/privacy-policy"
        }
      ]
    }
  ],
  "properties": [
    {
      "name": "com.jesseahawkins:vendor",
      "value": "zai"
    },
    {
      "name": "com.jesseahawkins:record",
      "value": "https://jesseahawkins.com/vendors/zai/"
    },
    {
      "name": "com.jesseahawkins:notice",
      "value": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "name": "com.jesseahawkins:signed",
      "value": "false"
    },
    {
      "name": "com.jesseahawkins:signature-note",
      "value": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}