According to the official spec, a service can contain an attribute called 'trustZone' (different than the x-trust-boundary).

However, the Service class in v9.0.4 of cyclonedx-core-java, does not contain this attribute.