Vendors · Model makers · xAI
xAI says it never trains on API data without permission
xAI API. Each line below quotes xAI’s own pages as kept on 3 Nov 2026. Its pages name the company SpaceXSI.
xAI’s questionnaire: nine buyer questions, each answered from these pages.
xAI’s record as an AI bill of materials: CycloneDX · SPDX. Not signed.
xAI’s status history: every incident on its status page, kept from its own feed.
What the pages say
each value, then the words it is read from- Training on business and API data
- Not without permission
-
SpaceXSI never trains on your API inputs or outputs without your explicit permission.
FAQ: API security, kept 24 Oct 2026 · sha256
30d858f37eb6 - Training on free and consumer use
- Listed as a use of personal information
-
To develop and improve our Service and to conduct research: For example to develop new product features, to train our models
Privacy Policy, kept 24 Oct 2026 · sha256
17d51a846373 - How long API data is kept
- 30 days
-
By default, all API requests and responses are stored on our servers (encrypted at rest) for 30 days
FAQ: API security, kept 24 Oct 2026 · sha256
30d858f37eb6 - Option to keep no data
- Zero Data Retention, a team setting where self-serve is available
-
Where available, a team admin can turn it on or off directly from the xAI Console.
Under “What is Zero Data Retention (ZDR)?”, item “Self-serve”. Under “How to enable ZDR” the page says “self-serve ZDR may not be enabled for your environment yet”; teams on a negotiated Enterprise Customer Agreement are told to contact sales. FAQ: API security, kept 24 Oct 2026 · sha256
30d858f37eb6 - Where data is processed and stored
- US only on the US regional endpoint, for two models, with listed exclusions
-
To keep API request handling, model inference, moderation, and retained request data in the United States, use the US regional endpoint, https://us.api.x.ai/v1.
The same answer begins: “The default endpoint, https://api.x.ai, does not guarantee a processing region.” It adds: “It currently serves only grok-4.7 and grok-4.6” and “Files, Collections, server-side tools, and the network path from your systems to the endpoint are outside the guarantee.” FAQ: API security, kept 24 Oct 2026 · sha256
30d858f37eb6 - Sub-processors
- A published list; new names 15 days in advance
-
SpaceXSI will notify you if we add or replace Subprocessors at least fifteen (15) days before such changes take effect.
The DPA says: “SpaceXSI's list of general Subprocessors is available at https://x.ai/legal/subprocessor-list”. The record does not keep that list. Data Processing Addendum, kept 3 Nov 2026 · sha256
d932580a2034 - Certifications and audits
- SOC 2 Type 2
-
We are SOC 2 Type 2 compliant. Customers with a signed NDA can refer to our Trust Center for up-to-date information on our certifications and data governance.
FAQ: API security, kept 24 Oct 2026 · sha256
30d858f37eb6 - Data processing agreement
- Incorporated into the enterprise terms; personal data only through the ZDR-Enabled API
-
This Data Processing Addendum, including its two Appendices (collectively, the "DPA"), is incorporated into and forms a part of the Terms of Service - Enterprise (“Agreement”) between Customer (a.k.a. “you”) and SpaceXSI.
The DPA says: “Customer agrees that it will process Personal Data through the Services only using SpaceXSI’s ZDR-Enabled API (as such term is defined in the Agreement).” Data Processing Addendum, kept 3 Nov 2026 · sha256
d932580a2034 - Published usage limits
- Per-model limits on requests per second and tokens per minute, by spend tier; voice and audio by requests and concurrent sessions
-
Every xAI API team has per-model rate limits on two dimensions: requests per second (RPS) and tokens per minute (TPM).
The page says: “Your tier is based on cumulative spend on the xAI API since January 1, 2026.” It also says that increases to Imagine API limits go through xAI sales. Rate Limits, kept 3 Nov 2026 · sha256
9b4d45abfec0
Pages kept
each copy is held with the sha256 of its bytes as served| Page | The page’s date | Newest copy | Checks |
|---|---|---|---|
| FAQ: API securityTraining, retention and zero data retention for the API | Last updated: October 10, 2026 | 24 Oct 2026, 428 KBsha256 30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1 |
|
| Terms of Service - EnterpriseThe contract for business customers | Last Updated: August 14, 2026 | 24 Oct 2026, 237 KBsha256 0143afb3e9e1b668621719098826996241a4380e772df7bf5588813a0e55079a |
|
| Privacy PolicyUse and retention of personal data | Last Updated: October 11, 2026 (previous version) | 24 Oct 2026, 185 KBsha256 17d51a8463735c94cddbabee411c750b5ae36e9b761d5c6a806aed870c48dd04 |
|
| Rate LimitsRate limit tiers and per-model limits | Last updated: October 5, 2026 | 3 Nov 2026, 424 KBsha256 9b4d45abfec062caef6af1999c8f2d8150f70d33b4d20d68bc914db75157f2a2 |
|
| Data Processing AddendumThe data processing addendum | Effective: September 22, 2026 (previous version) | 3 Nov 2026, 175 KBsha256 d932580a20340627ba7ac1ac70ae6ec6f710a99ef5c060e3e2ba7b3ff5e1e429 |
|
No kept page of xAI has changed
first kept on 24 Oct 2026Sources
vendors.csv Every dataset → Status → Glossary →- xAI, FAQ: API security, kept 24 Oct 2026.
- xAI, Terms of Service - Enterprise, kept 24 Oct 2026.
- xAI, Privacy Policy, kept 24 Oct 2026.
- xAI, Rate Limits, kept 3 Nov 2026.
- xAI, Data Processing Addendum, kept 3 Nov 2026.