Not legal advice · Summaries of vendors' public pages, which change often. Verify with the vendor and your contract before relying on anything here.

Does Grok Business / Enterprise & xAI API train on your data?

Business plan xAI · Assistant · Last verified

Doesn't train by default

Doesn't train on business data by default.

Short answer: No

Enterprise terms cover Grok Business/Enterprise and the API. xAI may still create de-identified aggregated data unless you use ZDR. x.ai pages now name the operating company "SpaceXSI"; quotes keep that wording.

Why this matters: "De-identified" removes names, not the substance of what was said or written. What "de-identified" covers →

4/7 assurances found·6 of 9 fields confirmed from vendor pages

Below: retention, SOC 2, ISO 27001/42001, DPA, BAA, data residency and zero-retention for Grok Business / Enterprise & xAI API, each linked to xAI's own page.

Summary of xAI's public pages as of Oct 18, 2026. Not legal advice: terms vary by plan and contract and can change. Confirm with xAI before relying on it.

Trains on your data by default

No

Enterprise terms cover Grok Business/Enterprise and the API. xAI may still create de-identified aggregated data unless you use ZDR. x.ai pages now name the operating company "SpaceXSI"; quotes keep that wording.

Source:
  • x.ai/legal/terms-of-service-enterprise · checked Oct 18, 2026
    “SpaceXSI will not use any User Content to train any foundation models, large language models, or other artificial intelligence systems or to develop any new products, services, or features, subject to disclosures to Customer and Customer-controlled user settings.”
  • x.ai/legal/faq · checked Oct 18, 2026
    “Similarly, we do not use content from our business and enterprise customers to improve our models.”
  • x.ai/grok/business · checked Oct 18, 2026
    “No training”

Data retention

Deleted within 30 days of the session (custom retention available)

Longer retention possible if agreed, legally required, or needed for safety/abuse investigation.

Source:
  • x.ai/legal/terms-of-service-enterprise · checked Oct 18, 2026
    “All User Content will be automatically and permanently deleted no later than 30 days after the end of the interaction or session in which it was submitted unless a different retention period is:”
  • x.ai/grok/business · checked Oct 18, 2026
    “Custom data retention”

SOC 2 Type II

Yes
Source:

ISO/IEC 27001

Unknown

No ISO/IEC 27001 claim found on the x.ai pages checked (trust portal at trust.x.ai did not render).

ISO/IEC 42001

Unknown

No ISO/IEC 42001 claim found on the x.ai pages checked.

DPA available

Yes

DPA is incorporated into the enterprise terms. It asks customers to send personal data only through the ZDR-enabled API.

Source:
  • x.ai/legal/terms-of-service-enterprise · checked Oct 18, 2026
    “SpaceXSI will process such data as a processor on Customer’s behalf, and SpaceXSI’s Data Processing Addendum located at”

BAA / HIPAA

Yes

PHI requires a signed BAA and use of the ZDR-enabled API.

Source:

Data residency options

Unknown

No customer region choice found. The DPA says data may be processed in the US and other countries.

Pages checked:
  • x.ai/legal/data-processing-addendum · checked Oct 18, 2026
    “You acknowledge and agree that SpaceXSI may transfer and process Personal Data on a global basis outside Europe as necessary to provide the Services, including in the United States and other countries where SpaceXSI and its Subprocessors maintain data processing operations.”

Zero-retention option

Yes

ZDR-enabled API: content deleted within an hour of the request or on delivery, with no logs or backups.

Source:
  • x.ai/legal/terms-of-service-enterprise · checked Oct 18, 2026
    “when and to the extent Customer elects to use ZDR, User Content will exist in SpaceXSI systems only transiently and solely to the extent required to generate and return the real-time response;”
  • x.ai/legal/data-processing-addendum · checked Oct 18, 2026
    “Customer acknowledges and agrees that, when using ZDR, SpaceXSI will not retain any User Content (including Personal Data) after processing.”

Vendor pages we monitor for this tool

We save a fingerprint (SHA-256 of the page's visible text) on every check so we can spot when a vendor edits its terms.

PageCheckedFingerprint
https://x.ai/legal/terms-of-service-enterpriseOct 18, 202611389b389b50…
https://x.ai/legal/faqOct 18, 2026c0b9807b5bbb…
https://x.ai/grok/businessOct 18, 2026919501c95bd3…
https://x.ai/legal/data-processing-addendumOct 18, 2026f027b36cae93…