Trust Center · AI-SBOM
AI Software Bill of Materials
Full inventory of foundation models, AI services, infrastructure, and data dependencies powering the SummitBridge Horizon platform. Aligned with G7 AI SBOM guidance (May 2026) and EU AI Act Article 25 (downstream provider) transparency obligations.
Last updated: 18 May 2026|Version: 1.0|Format: CycloneDX 1.5
Machine-readable SBOM
CycloneDX 1.5 JSON — for procurement tooling, vendor due-diligence platforms, AI risk registers.
Why this matters
- G7 AI SBOM (May 2026) — G7 nations (US/Canada/Japan/Germany/France/Italy/UK + EU) published joint guidance recommending CycloneDX/SPDX inventories of AI components for any AI-enabled product. This page is our public response.
- EU AI Act Article 25 — As a downstream deployer of foundation models (Anthropic), SBH is obliged to maintain awareness of upstream provider obligations and pass relevant information to customers when needed.
- DORA Art. 28 Register of Information — Financial-entity customers can reuse this SBOM as input to their own DORA ICT third-party register. The DORA Addendum to our MSA covers Art. 28–30 mandatory provisions.
- ISO 27001 / SOC 2 vendor management — Procurement teams can map each row to their vendor risk register.
Foundation Models (LLM)
| Component | Supplier | Role | Region |
|---|---|---|---|
| Claude Opus 4.7 (1M context) Foundation model GPAI (Art. 53+). SBH downstream deployer. | Anthropic, PBC | Strategy / deep assessment / Twin (operator-facing) | US (SCCs + UK IDTA) |
| Claude Sonnet 4.6 Foundation model GPAI (Art. 53+). SBH downstream deployer. | Anthropic, PBC | Routine assessment, content drafts, customer chat (SBH AI Advisor) | US (SCCs + UK IDTA) |
| Claude Haiku 4.5 | Anthropic, PBC | Classification, summarisation, routing (low-cost path) | US (SCCs + UK IDTA) |
AI Services
| Component | Supplier | Role | Region |
|---|---|---|---|
| Tavily Search API Search provider — out of GPAI scope | Tavily AI, Inc. | Web search for fact-checking and regulatory research | US |
| AssemblyAI Speech-to-Text Limited-risk (Art. 50); biometric-categorisation note for voice | AssemblyAI, Inc. | Voice transcription (opt-in) | US |
| Affinda Document Parser Annex III recruitment AI — Customer is deployer; SBH provides tooling | Affinda Pty Ltd | CV/document parsing (HumanBaseIQ) | EU (eu1.affinda.com) |
Infrastructure
| Component | Supplier | Role | Region |
|---|---|---|---|
| Hostinger VPS | Hostinger International Ltd | Primary VPS — platform, agents, database | Frankfurt, Germany (EU) |
| Cloudflare | Cloudflare, Inc. | CDN, WAF, DDoS, DNS | Global (EU+UK edge preferred) |
Payment & Banking
| Component | Supplier | Role | Region |
|---|---|---|---|
| Stripe | Stripe Payments Europe Ltd | Payment processing, subscription billing | Ireland (EU) / US |
| Wise Business | Wise Payments Ltd | Multi-currency banking (GBP/USD/EUR) | UK / Belgium |
Email Delivery
| Component | Supplier | Role | Region |
|---|---|---|---|
| Resend | Resend, Inc. | Outbound transactional + marketing email | US |
Public-Data Lookup APIs
| Component | Supplier | Role | Region |
|---|---|---|---|
| Companies House API | UK Government | UK company registry — AML/KYC/supplier risk | UK |
| Leak-Lookup | Leak-Lookup | Email/domain breach exposure checks | US |
| HMRC MTD VAT API | UK Government | UK VAT submission (customer OAuth) | UK |
| IPinfo | IPinfo.io | IP geolocation for fraud-risk scoring | US |
| exchangerate.host | exchangerate.host | Daily FX rates for multi-currency invoicing | EU |
Application Framework
| Component | Supplier | Role | Region |
|---|---|---|---|
| Next.js 15.5.18 | Vercel, Inc. | React App Router framework (MIT) | — |
Software Libraries
| Component | Supplier | Role | Region |
|---|---|---|---|
| Prisma 5.22 | Prisma Data, Inc. | Database ORM (Apache-2.0) | — |
| @anthropic-ai/sdk | Anthropic, PBC | Official Anthropic Node SDK (MIT) | — |
Database
| Component | Supplier | Role | Region |
|---|---|---|---|
| PostgreSQL 16 | PostgreSQL Global Development Group | Primary application database (PostgreSQL licence) | — |
Alternative formats & updates
- SPDX 2.3 — available on request to [email protected].
- Subscribe to changes — sub-processor and component updates are also reflected in the sub-processors register; subscribe via the email listed there.
- Review cycle — quarterly + on material sub-processor change.
Related
SummitBridge Horizon Ltd · Companies House: 16419201 · ICO Reg: ZC112810 · 71-75 Shelton St, London WC2H 9JQ