UncoverAIFollow
AI Platforms

Model API

xAI (Enterprise API)

The enterprise FAQ says business inputs and outputs are not used to train models, and that free credits are sometimes offered in exchange for permission to train. The API page says the enterprise API adds SSO, audit logging, invoicing, data residency, and dedicated support, and it states SOC 2 Type II and that a BAA is available. The FAQ says the DPA applies and is incorporated into the Enterprise Terms if personal data is submitted. The security page links a status page for health and current uptime and does not publish an uptime percentage.

Checked 21 Oct 2026https://x.ai/legal/faq-enterprise

Strengths

  • The API page states SOC 2 Type II and that a BAA is available.
  • Team admins can enable Zero Data Retention so prompts and outputs are not persisted.
  • The enterprise API adds SSO, audit logging, and data residency.

Checked 21 Oct 2026https://x.ai/api

SOC 2

SOC 2 Type II. Audited controls for security, availability, and confidentiality.

Checked 21 Oct 2026https://x.ai/api

HIPAA

HIPAA eligible. A BAA is available. The FAQ says support is under some circumstances and points at the BAA questionnaire.

Checked 21 Oct 2026https://x.ai/api

Data-training terms

The enterprise FAQ says business data, including inputs and outputs, is not used to train models. It also says free credits are sometimes offered in exchange for permission to train. Team admins can enable Zero Data Retention so API prompts and outputs are not persisted.

Checked 21 Oct 2026https://x.ai/legal/faq-enterprise

Training note

Business inputs and outputs are not used to train models unless you agree, including the free-credits case on the FAQ.

Checked 21 Oct 2026https://x.ai/legal/faq-enterprise

Data residency

The API page says the enterprise API adds data residency and regional processing options. A published region list: Not published on that page.

Checked 21 Oct 2026https://x.ai/api

Native models

  • The API page sample request uses grok-4.7.
  • The same page says the API serves grok-4.7, grok-4.6, and grok-4.5, plus the Grok Imagine and Grok Voice families.
  • Access to all Grok models is stated on the page. A full model list: Not published on the API page.

Checked 21 Oct 2026https://x.ai/api

Inference SLA

Not published. The security page says a status page shows health and current uptime, and it does not state a percentage.

Checked 21 Oct 2026https://x.ai/security

Core sub-processor scope

Cloud infrastructure, services, and support: AWS; Google Cloud; Oracle.|Content delivery: Cloudflare; Hive.|Other named processors include Axiom, Chronosphere, ClickHouse, Elasticsearch, GrowthBook, Hubspot, LiveKit, MongoDB, Inc., Okta, Paypal (Braintree), Sentry, Stripe, Twilio, Vercel, Wiz, WorkOS, and Zendesk.|xAI Affiliates are listed in the United States for cloud infrastructure, services, and support. An xAI subsidiary is listed in the United Kingdom for services and support.

Checked 21 Oct 2026https://x.ai/legal/subprocessor-list

Sub-processor notes

The notice cell quotes the two fifteen-day periods from the DPA. A fixed longer lead time: Not published.|Affiliate rows are labeled xAI Affiliates and xAI Subsidiary. The HTML returned for this check rewrote the vendor name, so that rewritten string is not stored here.

Checked 21 Oct 2026https://x.ai/legal/subprocessor-list

Notice and objection

The DPA says the vendor will notify the customer if it adds or replaces subprocessors "at least fifteen (15) days before such changes take effect." The customer may object "within fifteen (15) days after receiving notice."

Checked 21 Oct 2026https://x.ai/legal/data-processing-addendum