- Deployment
- hosted
- Hq Country
- United States
- Hq City
- Palo Alto
- Ownership
- private
- Founded
- 2023
- Training Default
- never
- Residency Options
- US (no EU/regional residency evidenced)
- Gov Access Exposure
- us-cloud-act
- Eu Ai Act Role
- gpai-systemic
- Certs
- SOC 2 Type II, HIPAA BAA (with ZDR)
- DPA available
- yes
- Zero Retention Available
- Yes
- Retention Default
- API inputs/outputs stored encrypted for 30 days for auditing, then auto-deleted; ZDR available.
- Retention Exceptions
- Longer if agreed in an Order Form; legal hold; AUP-flagged content. Separately, Grok trains on X users' PUBLIC posts + interactions BY DEFAULT (web-only, buried opt-out) — the consumer side, not the API.
- Subprocessors
- AWS (US), Google Cloud (US), Oracle (US), Cloudflare (US), Axiom (US), Chronosphere (US), ClickHouse (US), Elasticsearch (US), GrowthBook (US), Hive (US), HubSpot (US), LiveKit (US), MongoDB (US), Okta (US), PayPal/Braintree (US), Sentry (US), Stripe (US), Twilio (US), Vercel (US), Wiz (US), WorkOS (US), Zendesk (US), xAI Affiliates (US), xAI Subsidiary (UK)
- Subprocessor Count
- 24
- Transfer Mechanism
- sccs
- Eu Procurement Ready
- fail
- Eu Procurement Reason
- The Grok API itself is protective (contractual no-training, 30-day retention, ZDR, DPA, SOC 2 II). But no EU data residency, ISO/DPF unverified (trust center NDA-gated), and an active Irish DPC statutory inquiry (opened ~2025-04-11) into Grok training on EU public posts casts procurement risk. The consumer opt-out-buried default is the reputational red flag.
- Last Policy Change
- 2025-04-11T00:00:00.000Z
- Change Summary
- Irish DPC opened a new statutory inquiry into Grok LLM training on EU/EEA public posts.
- Prior Value
- 2024 DPC undertaking permanently limited processing of EU public-post data for Grok (concluded Sep 2024); new inquiry reopens the question.
- Training Claim Basis
- stated
- Training Confidence
- high
- Residency Claim Basis
- inferred
- Residency Confidence
- medium
- Retention Claim Basis
- stated
- Retention Confidence
- high
- Subprocessors Claim Basis
- stated
- Subprocessors Confidence
- high
- Residency Class
- non-eu-only
- Portability / Exit Path
- open-api-standard
- Subprocessor Jurisdiction
- non-eu
