Vendors · Questionnaire · xAI
Read xAI’s own answers to nine buyer questions
xAI API. Each answer quotes xAI’s own page or feed as kept on the day shown. Each question cites the NIST text that asks it. The answers are not a score and not a verdict.
Q1
Does the vendor train its models on business and API customers’ data?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not without permission
SpaceXSI never trains on your API inputs or outputs without your explicit permission.
FAQ: API security, kept 24 Oct 2026 · sha256 30d858f37eb6
Q2
Does the vendor train its models on free and consumer use of its products?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Listed as a use of personal information
To develop and improve our Service and to conduct research: For example to develop new product features, to train our models
Privacy Policy, kept 24 Oct 2026 · sha256 17d51a846373
Q3
How long does the vendor keep the data that customers send?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
30 days
By default, all API requests and responses are stored on our servers (encrypted at rest) for 30 days
FAQ: API security, kept 24 Oct 2026 · sha256 30d858f37eb6
Q4
Can a customer have the vendor keep none of its data?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Zero Data Retention, a team setting where self-serve is available
Where available, a team admin can turn it on or off directly from the xAI Console.
Under “What is Zero Data Retention (ZDR)?”, item “Self-serve”. Under “How to enable ZDR” the page says “self-serve ZDR may not be enabled for your environment yet”; teams on a negotiated Enterprise Customer Agreement are told to contact sales. FAQ: API security, kept 24 Oct 2026 · sha256 30d858f37eb6
Q5
Where does the vendor process and store customer data?
NIST AI 600-1, action GV-6.1-009: “Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy …”
NIST AI RMF 1.0, GOVERN 6.1
US only on the US regional endpoint, for two models, with listed exclusions
To keep API request handling, model inference, moderation, and retained request data in the United States, use the US regional endpoint, https://us.api.x.ai/v1.
The same answer begins: “The default endpoint, https://api.x.ai, does not guarantee a processing region.” It adds: “It currently serves only grok-4.7 and grok-4.6” and “Files, Collections, server-side tools, and the network path from your systems to the endpoint are outside the guarantee.” FAQ: API security, kept 24 Oct 2026 · sha256 30d858f37eb6
Q6
Which other companies process customer data for the vendor?
NIST AI 600-1, action GV-6.1-007: “Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.”
NIST AI RMF 1.0, GOVERN 6.1; NIST AI RMF 1.0, MANAGE 3.1
A published list; new names 15 days in advance
SpaceXSI will notify you if we add or replace Subprocessors at least fifteen (15) days before such changes take effect.
The DPA says: “SpaceXSI's list of general Subprocessors is available at https://x.ai/legal/subprocessor-list”. The record does not keep that list. Data Processing Addendum, kept 3 Nov 2026 · sha256 d932580a2034
Q7
Which independent audits or certifications does the vendor name?
NIST AI 600-1, Appendix A.1.3: “statement on standards for attestation engagement (SSAE) reports to help with third-party transparency and risk management for GAI systems”
NIST AI RMF 1.0, GOVERN 6.1
SOC 2 Type 2
We are SOC 2 Type 2 compliant. Customers with a signed NDA can refer to our Trust Center for up-to-date information on our certifications and data governance.
FAQ: API security, kept 24 Oct 2026 · sha256 30d858f37eb6
Q8
Does the vendor publish a history of its service incidents?
NIST AI 600-1, action GV-6.2-007: “Service Level Agreements (SLAs) in vendor contracts that address incident response, response times, and availability of critical support.”
NIST AI RMF 1.0, GOVERN 6.2
Yes: a status history feed, with 97 incidents kept since 2026-08-17
Status history feed, kept 1 Nov 2026 · sha256 d6ccd699fcdf. The record.
Q9
Does the vendor publish the dates on which it retires its models?
NIST AI 600-1, action GV-6.2-007: “Review vendor contracts and avoid arbitrary or capricious termination of critical GAI technologies or vendor services …”
NIST AI RMF 1.0, GOVERN 6.2
No answer kept
The models page holds no table in its HTML. Its retirement dates are in the page’s script, which this record does not run. The page.
- xAI, FAQ: API security, kept 24 Oct 2026.
- xAI, Privacy Policy, kept 24 Oct 2026.
- xAI, Data Processing Addendum, kept 3 Nov 2026.
- xAI, Status history feed, kept 1 Nov 2026.
- NIST, NIST AI 600-1, 2024-07. Republished courtesy of the National Institute of Standards and Technology.