{
  "@context": "https://spdx.org/rdf/3.0.1/spdx-context.jsonld",
  "@graph": [
    {
      "type": "CreationInfo",
      "@id": "_:creationInfo",
      "specVersion": "3.0.1",
      "created": "2026-11-04T00:00:00Z",
      "createdBy": [
        "https://jesseahawkins.com/vendors/zai/aibom/tool"
      ]
    },
    {
      "type": "Tool",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/tool",
      "creationInfo": "_:creationInfo",
      "name": "jesseahawkins.com vendor record"
    },
    {
      "type": "SpdxDocument",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/document",
      "creationInfo": "_:creationInfo",
      "name": "AI BOM for Z.ai: Z.ai API Services (GLM models)",
      "profileConformance": [
        "core",
        "software",
        "ai"
      ],
      "rootElement": [
        "https://jesseahawkins.com/vendors/zai/aibom/ai-package"
      ]
    },
    {
      "type": "ai_AIPackage",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/ai-package",
      "creationInfo": "_:creationInfo",
      "name": "Z.ai: Z.ai API Services (GLM models)"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/annotation/ai_subprocessors",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/zai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors = Group companies and service providers, typically in Singapore; no list. Evidence snapshot sha256:a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26. Responsive to (not compliant with): dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/annotation/customer_data_retention_period",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/zai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period = API content not stored; other customer data kept until the terms end, with listed exceptions. Evidence snapshot sha256:a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26. Responsive to (not compliant with): iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/annotation/data_residency",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/zai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency = Generally processed in Singapore. Evidence snapshot sha256:a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/annotation/dpa",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/zai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa = A Data Processing Addendum for API Services, incorporated into the Additional Terms for API Services. Evidence snapshot sha256:a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/annotation/zero_data_retention",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/zai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention = API content is not stored, the addendum says. Evidence snapshot sha256:a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/annotation/certifications",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/zai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "certifications is recorded with no value (fact zai/certifications@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/annotation/trains_on_customer_data",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/zai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data is recorded with no value (fact zai/trains_on_customer_data@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/annotation/usage_limits",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/zai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits is recorded with no value (fact zai/usage_limits@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/annotation/ai_subprocessors/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/zai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors, in Z.ai's own words: \"Company generally provide the Services from Singapore, and our group companies and their designated service providers are typically located in Singapore.\" Source: https://docs.z.ai/legal-agreement/privacy-policy"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/annotation/customer_data_retention_period/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/zai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period, in Z.ai's own words: \"This information is processed in real-time to provide the Customer and End Users with the API Service and is not saved on our servers.\" Source: https://docs.z.ai/legal-agreement/privacy-policy"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/annotation/data_residency/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/zai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency, in Z.ai's own words: \"Company generally provide the Services from Singapore, and our group companies and their designated service providers are typically located in Singapore. As a result, Customer Data is generally processed in Singapore.\" Source: https://docs.z.ai/legal-agreement/privacy-policy"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/annotation/dpa/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/zai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa, in Z.ai's own words: \"If you are enterprises or developers using the API Services (“API Services”) available on Z.ai, please refer to the Data Processing Addendum for API Services.\" Source: https://docs.z.ai/legal-agreement/privacy-policy"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/annotation/zero_data_retention/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/zai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention, in Z.ai's own words: \"The Company do not store any of the content the Customer or its End Users provide or generate while using our Services.\" Source: https://docs.z.ai/legal-agreement/privacy-policy"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/annotation/notice",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/zai/aibom/document",
      "contentType": "text/plain",
      "statement": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/zai/aibom/annotation/signature",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/zai/aibom/document",
      "contentType": "text/plain",
      "statement": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}