The Grok API and enterprise platform

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

AVD-2026-0017

Kind

API and platform

Jurisdiction

United States

Last verified

15 September 2026

Added

15 September 2026

• The enterprise FAQ states the vendor does not use business data, including inputs or outputs, to train its models.
• Free credits may be offered in exchange for permission to train on business data, so the exclusion is a default that can be traded away.
• Inputs and outputs are automatically deleted within 30 days unless otherwise agreed in writing or retention is legally required.
• The data processing addendum applies automatically and its security measures sit in an appendix to that addendum.

Used for training by default, Retention period, Deletion on request, Storage region and residency, Subprocessor list published, Human review of content, Opt out available, DPA available, Persistent memory across sessions, Last change to the terms. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

Used for training by defaultStated

No by default, and tradeable. The FAQ says business inputs and outputs are not used for training, and that free credits may be offered in exchange for permission.SpaceXAI enterprise FAQs, published at x.ai, primary source, 25 February 2025.

Retention periodStated

Inputs and outputs are automatically deleted within 30 days unless otherwise agreed in writing or the vendor is legally required to keep them, for example where content is flagged.SpaceXAI enterprise FAQs, published at x.ai, primary source, 25 February 2025.

Deletion on requestStated

Deletion is automatic at the 30 day mark rather than a request you file, with the flagged content and legal carve outs named.SpaceXAI enterprise FAQs, published at x.ai, primary source, 25 February 2025.

Storage region and residencySilent

The enterprise FAQ prints no storage region. The consumer privacy policy identifies a United States company and expressly excludes the business offerings from its scope.SpaceXAI privacy policy, published at x.ai, primary source, 24 August 2026.

Subprocessor list publishedStated

A subprocessor list is published and linked from the site's own trust section, and the DPA operates on a general written authorisation with change notice.SpaceXAI enterprise FAQs, published at x.ai, primary source, 25 February 2025.

Human review of contentStated

Automated classifiers and safety tools run by default, and a limited number of authorised personnel may review business data when legally required or to investigate incidents and misuse.SpaceXAI enterprise FAQs, published at x.ai, primary source, 25 February 2025.

Opt out availableStated

Nothing to opt out of on training. The controls are the 30 day deletion default and whatever is agreed in writing on top of it.SpaceXAI enterprise FAQs, published at x.ai, primary source, 25 February 2025.

DPA availableStated

Yes. The data processing addendum applies automatically and is incorporated into the enterprise terms where personal data is submitted.SpaceXAI enterprise FAQs, published at x.ai, primary source, 25 February 2025.

Persistent memory across sessionsSilent

No memory product is described for the API. The FAQ covers ownership, retention and review, and names no persistent memory feature.SpaceXAI enterprise FAQs, published at x.ai, primary source, 25 February 2025.

Last change to the termsStated

The enterprise FAQ prints Last updated 25 February 2025 and the privacy policy prints Effective 24 August 2026.SpaceXAI enterprise FAQs, published at x.ai, primary source, 25 February 2025.

1. 30 days

   Automatic deletion of business inputs and outputs

   SpaceXAI enterprise FAQs, published at x.ai, primary source, as of 25 February 2025.

Read the free credits clause before you treat the no training line as settled. The exclusion is a default the vendor will trade for commercial consideration, which means a team that accepted promotional credits may already be outside it. If you are answering a customer questionnaire about this vendor, the accurate answer names your contract and any credits arrangement, not the general statement on the FAQ.

1. SpaceXAI enterprise FAQs, published at x.aiPrimary · 25 February 2025
2. SpaceXAI privacy policy, published at x.aiPrimary · 24 August 2026

• VerifiedConsumer tierAVD-2026-0016

  Grok on the consumer app and website

  United States · verified 15 September 2026

  The consumer FAQ states the vendor may use your content and interactions with Grok, along with Grok's responses, to train its models, and that you control whether it does.

• VerifiedAPI and platformAVD-2026-0004

  The OpenAI API and platform

  United States · verified 15 September 2026

  The platform guide states that as of 1 March 2023, data sent to the OpenAI API is not used to train or improve OpenAI models.

• Open questionOpen questionAVD-2026-0029

  Is a subprocessor change notice period actually enforceable?

  European Union · verified 15 September 2026

  Article 28 of the General Data Protection Regulation states that the processor shall not engage another processor without prior specific or general written authorisation of the controller.

• VerifiedAPI and platformAVD-2026-0026

  Amazon Bedrock

  United States · verified 15 September 2026

  Amazon Bedrock uses a zero data retention security model, so by default it does not store model inputs or outputs.

• VerifiedBusiness tierAVD-2026-0025

  GitHub Copilot Business and Enterprise

  United States · verified 15 September 2026

  GitHub states it does not use Copilot Business or Copilot Enterprise customer data to train AI models.

• VerifiedBusiness tierAVD-2026-0024

  Cursor and its privacy mode

  United States · verified 15 September 2026

  The terms of service state that Cursor will not use content to train any AI models unless you have explicitly agreed.