- Deployment
- hosted
- Hq Country
- United States
- Hq City
- Palo Alto
- Ownership
- private
- Founded
- 2023
- Trust Center Url
- https://trust.x.ai
- Training Default
- never
- Residency Options
- US (no EU/regional residency evidenced)
- Gov Access Exposure
- us-cloud-act
- Eu Ai Act Role
- gpai-systemic
- Certs
- SOC 2 Type II, HIPAA BAA (with ZDR)
- Dpa Available
- Yes
- Zero Retention Available
- Yes
- Retention Default
- API inputs/outputs stored encrypted for 30 days for auditing, then auto-deleted; ZDR available.
- Retention Exceptions
- Longer if agreed in an Order Form; legal hold; AUP-flagged content. Separately, Grok trains on X users' PUBLIC posts + interactions BY DEFAULT (web-only, buried opt-out) — the consumer side, not the API.
- Transfer Mechanism
- sccs
- Eu Procurement Ready
- conditional
- Eu Procurement Reason
- The Grok API itself is protective (contractual no-training, 30-day retention, ZDR, DPA, SOC 2 II). But no EU data residency, ISO/DPF unverified (trust center NDA-gated), and an active Irish DPC statutory inquiry (opened ~2025-04-11) into Grok training on EU public posts casts procurement risk. The consumer opt-out-buried default is the reputational red flag.
- Last Policy Change
- 2025-04-11T00:00:00.000Z
- Change Summary
- Irish DPC opened a new statutory inquiry into Grok LLM training on EU/EEA public posts.
- Prior Value
- 2024 DPC undertaking permanently limited processing of EU public-post data for Grok (concluded Sep 2024); new inquiry reopens the question.
- Training Evidence Url
- https://docs.x.ai/developers/faq/security
- Training Claim Basis
- stated
- Training Confidence
- high
- Residency Evidence Url
- https://docs.x.ai/developers/faq/security
- Residency Claim Basis
- inferred
- Residency Confidence
- medium
- Retention Evidence Url
- https://docs.x.ai/developers/faq/security
- Retention Claim Basis
- stated
- Retention Confidence
- high
- Subprocessors Evidence Url
- https://trust.x.ai
- Subprocessors Claim Basis
- inferred
- Subprocessors Confidence
- low
