Grok vs. You.com: data protection per plan
Grok (6 plans) and You.com (3 plans) side by side: DPA, training on inputs, hosting and data retention per plan, based on the providers’ public documents. Without rating.
Last updated: (latest review date of the tools shown)
At a glance
Each value is listed with the plans it applies to. Pick a tier to see only plans of that tier; if plans are chosen in the plan comparison below, the table shows exactly those.
All plans: each value is listed with the plans it applies to.
| Feature | Grok | You.com |
|---|---|---|
| Provider based in | SpaceXAI LLC, 1450 Page Mill Rd, Palo Alto, CA 94304, USA | SuSea, Inc., 417 Montgomery Street, Suite 800, San Francisco, CA 94104, USA |
| Plans recorded | 6 | 3 |
| Hosting | US only: Free, Plus / Premium / Super / Ultramixed: Grok Teams, Grok Enterprise, API, API with Zero Data Retention | US only: all 3 plans |
| Training on inputs | opt-out available: Free, Plus / Premium / Super / Ultrano: Grok Teams, Grok Enterprise, API, API with Zero Data Retention | no: all 3 plans |
| DPA | no: Free, Plus / Premium / Super / Ultrayes: Grok Teams, Grok Enterprise, API, API with Zero Data Retention | not documented: Free, Pay as you goyes: Enterprise |
| As of | 18 Oct 2026 | 18 Oct 2026 |
Plans compared
Comparing: Grok Grok Enterprise vs. You.com Enterprise
| Feature | GrokGrok Enterprise | You.comEnterprise (custom) |
|---|---|---|
| yes | yes | |
| Details: DPA available | yes: Data Processing Addendum (effective 2026-09-22) is part of the Enterprise terms for business services; the DPA provides for the processing of personal data only via the ZDR API. Provider’s DPA | yes: public 'SuSea, Inc. Data Processing Addendum' (you.com/dpa, 'Last updated: December 12, 2025', linked in the footer of the pricing page); in the Trust Center, 'You.com DPA - March 2025' and 'You.com DPA - Security Addendum' are also available to view. According to its text, the DPA becomes part of the Master Subscription Agreement or another written/electronic agreement. Pricing page: 'DPA-ready'. Provider’s DPA |
| no | no | |
| Details: Training on inputs | Enterprise terms (as of 2026-08-14): SpaceXSI does not use User Content to train foundation models, LLMs or other AI systems, 'subject to disclosures to Customer and Customer-controlled user settings'; SpaceXSI may use de-identified or aggregated data except with ZDR. Business guide: team workspaces with 'Privacy guarantees as outlined in SpaceXSI's terms of service'. Enterprise FAQ: 'we do not use your business data, including inputs (prompts) or outputs (answers), for training our models'; in some cases SpaceXSI offers free credits in exchange for permission to train. | Privacy notice (as of 2026-09-22): You.com does not use the content of prompts, files or generated outputs for training or fine-tuning its own models; contracts with the providers of the integrated language models prohibit them from training on this content, 'except where you have separately opted in'. De-identified and aggregated content may be used for other purposes. Zero Data Retention documentation: requests are not used for training. The statements are not differentiated by plan. Additionally with ZDR: requests are not used for training, not sold to third parties and not sent to Google or Bing (documentation). MSA (Online, December 2025) 3.4.3: You.com uses Customer Data (Prompts and Output) only 'as necessary to provide Customer with the Services, comply with applicable law, and for safety purposes'; Platform Analyses (statistical usage data without identifying Customer Data) may be used for product development (6.5). |
| differs by plan | mixed | US only |
| Details: Data residency | The privacy policy does not apply to data processed for business customers. DPA (q10): processing 'on a global basis outside Europe', including in the USA; sub-processors in the US, one subsidiary in the UK. Pricing page (Enterprise): 'Data residency: Control where your data lives' without a region specified; EU region not documented. | Terms of use (as of 2024-08-27, Section 2.3): 'We are based in the United States and the Services are provided from the United States.' Privacy notice (as of 2026-09-22): 'We use Amazon Web Services for various content hosting'. Trust Center (sub-processor list): all cloud/hosting providers (AWS, Google Cloud, Microsoft Azure, Vercel, MongoDB Atlas) with location 'United States'. EU option: not publicly documented. |
| list available | list available | |
| Details: List published |
|
|
| differs by plan | Enterprise terms: User Content is deleted… | Privacy notice: account and profile data… |
| Details: Data retention | Enterprise terms: User Content is deleted no later than 30 days after the end of the interaction, unless otherwise specified in the Order Form, by self-service setting or by law. Pricing page: 'Custom Chat data retention'. Business guide: Enterprise with custom retention rules. | Privacy notice: account and profile data are stored for as long as the account is active, user content and usage data for as long as necessary for provision and security; data subject to a deletion request until that request has been processed; the notice does not state fixed periods. Different periods or Zero Data Retention under the Enterprise contract take precedence. With ZDR (Enterprise, on request), requests and responses are processed only briefly for handling and are not stored permanently; pricing page: 'All queries and responses are automatically purged and never stored.' According to the documentation, ZDR applies to the Web Search API and Answer API and is activated by You.com on request (no self-service switch). MSA (Online) 11.4: after the end of the contract, 30 calendar days of access to retrieve Customer Data upon written notice, after which You.com will 'promptly delete Customer Data'. |
| custom | custom | |
| Details: Price | Custom (pricing page: 'Custom', contact sales; payment by invoice/bank transfer only in the Enterprise plan) | Custom (pricing page: 'Custom, Talk to our humans') |
| yes | yes | |
| Details: AI features included | yes (as Teams; additionally, according to the pricing page, SCIM, audit logs and service accounts, spend controls, group settings, purchase on invoice, custom rate limits, dedicated infrastructure, 'Data residency', among others) | yes (all APIs; according to the pricing page, custom load capacity and SLA support) |
| 6 sources | 8 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- Grok Grok Enterpriseyes
- You.com Enterpriseyes
- Grok Grok Enterprise
yes: Data Processing Addendum (effective 2026-09-22) is part of the Enterprise terms for business services; the DPA provides for the processing of personal data only via the ZDR API.
Provider’s DPAYou.com Enterpriseyes: public 'SuSea, Inc. Data Processing Addendum' (you.com/dpa, 'Last updated: December 12, 2025', linked in the footer of the pricing page); in the Trust Center, 'You.com DPA - March 2025' and 'You.com DPA - Security Addendum' are also available to view. According to its text, the DPA becomes part of the Master Subscription Agreement or another written/electronic agreement. Pricing page: 'DPA-ready'.
Provider’s DPA
Training
- Grok Grok Enterpriseno
- You.com Enterpriseno
- Grok Grok Enterprise
Enterprise terms (as of 2026-08-14): SpaceXSI does not use User Content to train foundation models, LLMs or other AI systems, 'subject to disclosures to Customer and Customer-controlled user settings'; SpaceXSI may use de-identified or aggregated data except with ZDR. Business guide: team workspaces with 'Privacy guarantees as outlined in SpaceXSI's terms of service'. Enterprise FAQ: 'we do not use your business data, including inputs (prompts) or outputs (answers), for training our models'; in some cases SpaceXSI offers free credits in exchange for permission to train.
You.com EnterprisePrivacy notice (as of 2026-09-22): You.com does not use the content of prompts, files or generated outputs for training or fine-tuning its own models; contracts with the providers of the integrated language models prohibit them from training on this content, 'except where you have separately opted in'. De-identified and aggregated content may be used for other purposes. Zero Data Retention documentation: requests are not used for training. The statements are not differentiated by plan. Additionally with ZDR: requests are not used for training, not sold to third parties and not sent to Google or Bing (documentation). MSA (Online, December 2025) 3.4.3: You.com uses Customer Data (Prompts and Output) only 'as necessary to provide Customer with the Services, comply with applicable law, and for safety purposes'; Platform Analyses (statistical usage data without identifying Customer Data) may be used for product development (6.5).
Hosting
- differs by plan
- Grok Grok Enterprisemixed
- You.com EnterpriseUS only
- Grok Grok Enterprise
The privacy policy does not apply to data processed for business customers. DPA (q10): processing 'on a global basis outside Europe', including in the USA; sub-processors in the US, one subsidiary in the UK. Pricing page (Enterprise): 'Data residency: Control where your data lives' without a region specified; EU region not documented.
You.com EnterpriseTerms of use (as of 2024-08-27, Section 2.3): 'We are based in the United States and the Services are provided from the United States.' Privacy notice (as of 2026-09-22): 'We use Amazon Web Services for various content hosting'. Trust Center (sub-processor list): all cloud/hosting providers (AWS, Google Cloud, Microsoft Azure, Vercel, MongoDB Atlas) with location 'United States'. EU option: not publicly documented.
Sub-processors
- Grok Grok Enterpriselist available
- You.com Enterpriselist available
- Grok Grok Enterprise
- According to the sub-processor list (q11): AWS, Google Cloud, Oracle (cloud infrastructure), Vercel (web hosting), MongoDB, Inc. (cloud database), Cloudflare and Hive (content delivery), LiveKit (real-time media), Axiom, Chronosphere, ClickHouse, Elasticsearch, GrowthBook, Hubspot, Okta, Twilio, Wiz, WorkOS, Zendesk (services and support), Sentry (error monitoring), Stripe and PayPal (Braintree) (payments), SpaceXSI affiliates (cloud infrastructure), each located in the US
- SpaceXSI subsidiary (services and support): located in the UK (q11)
You.com Enterprise- According to the Trust Center (sub-processor list, 24 entries; location 'United States' in each case, no location for Coralogix and Gong): cloud/infrastructure: Amazon Web Services, Google Cloud Platform (also LLM provider, according to the list 'with Zero Data Retention and Zero Data Training'), Microsoft Azure, Vercel, MongoDB Atlas (database), Confluent (Kafka infrastructure for user events), Cloudflare (CDN, security, DNS)
- LLM/model providers according to the Trust Center: Anthropic, OpenAI, Together.ai, Fireworks.AI (each 'Zero Data Retention and Zero Data Training'), Cohere (without this addition), Baseten (model serving), Modal (sandbox), Anchor Browser
- Others according to the Trust Center: Osano (privacy operations), Descope (identity/accounts), Moesif (billing analytics), Coralogix (observability/logs), Tableau (product analytics), Stripe (payments), Braze and HubSpot (marketing/CRM), Gong (sales)
- Privacy notice: AWS 'for various content hosting'; Google Analytics and Google Tag Manager for analytics; Stripe for payment processing
- In addition, 'Supplemental Subprocessors.xlsx' in the Trust Center only on access request; content not publicly documented
Retention
- differs by plan
- Grok Grok EnterpriseEnterprise terms: User Content is deleted…
- You.com EnterprisePrivacy notice: account and profile data…
- Grok Grok EnterpriseEnterprise terms: User Content is deleted no later than 30 days after the end of the interaction, unless otherwise specified in the Order Form, by self-service setting or by law. Pricing page: 'Custom Chat data retention'. Business guide: Enterprise with custom retention rules.You.com EnterprisePrivacy notice: account and profile data are stored for as long as the account is active, user content and usage data for as long as necessary for provision and security; data subject to a deletion request until that request has been processed; the notice does not state fixed periods. Different periods or Zero Data Retention under the Enterprise contract take precedence. With ZDR (Enterprise, on request), requests and responses are processed only briefly for handling and are not stored permanently; pricing page: 'All queries and responses are automatically purged and never stored.' According to the documentation, ZDR applies to the Web Search API and Answer API and is activated by You.com on request (no self-service switch). MSA (Online) 11.4: after the end of the contract, 30 calendar days of access to retrieve Customer Data upon written notice, after which You.com will 'promptly delete Customer Data'.
Price
- Grok Grok Enterprisecustom
- You.com Enterprisecustom
- Grok Grok Enterprise
Custom (pricing page: 'Custom', contact sales; payment by invoice/bank transfer only in the Enterprise plan)
You.com EnterpriseCustom (pricing page: 'Custom, Talk to our humans')
- Grok Grok Enterpriseyes
- You.com Enterpriseyes
- Grok Grok Enterprise
yes (as Teams; additionally, according to the pricing page, SCIM, audit logs and service accounts, spend controls, group settings, purchase on invoice, custom rate limits, dedicated infrastructure, 'Data residency', among others)
You.com Enterpriseyes (all APIs; according to the pricing page, custom load capacity and SLA support)
Evidence
- Grok Grok Enterprise6 sources
- You.com Enterprise8 sources
- Grok Grok Enterprise
- Grok Business / Enterprise User GuideDocumentation, retrieved 18 Oct 2026
- Pricing: Compare PlansPricing page, retrieved 18 Oct 2026
- Terms of Service - Enterprise (Last Updated 2026-08-14)Terms and conditions, retrieved 18 Oct 2026
- SpaceXSI Data Processing Addendum (effective 2026-09-22)DPA, retrieved 14 Oct 2026
- SpaceXSI Subprocessor ListSub-processor list, retrieved 14 Oct 2026
- FAQ - EnterpriseDocumentation, retrieved 18 Oct 2026
You.com Enterprise- PricingPricing page, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-09-22)Privacy notice, retrieved 18 Oct 2026
- Terms & Conditions (as of 2024-08-27)Terms and conditions, retrieved 18 Oct 2026
- Zero Data Retention (ZDR)Documentation, retrieved 14 Oct 2026
- You.com Trust Center – Resources (DPA, SOC 2 Type 2 Report)Trust Center, retrieved 14 Oct 2026
- You.com Trust Center – SubprocessorsSub-processor list, retrieved 14 Oct 2026
- SuSea, Inc. Data Processing Addendum (as of 2025-12-12)DPA, retrieved 14 Oct 2026
- You.com Master Services Agreement (Online), MSA v.121525 (December 2025)Terms and conditions, retrieved 18 Oct 2026
| Feature | Grok | You.com |
|---|---|---|
| differs by tool |
|
|
| Details: DPA available |
|
|
| differs by tool |
| noall 3 plans |
| Details: Training on inputs |
|
|
| differs by tool |
| US onlyall 3 plans |
| Details: Data residency |
|
|
| list availableall 6 plans | list availableall 3 plans | |
| Details: List published |
|
|
| differs by tool |
| Privacy notice: account and profile data…all 3 plans |
| Details: Data retention |
|
|
| differs by tool |
|
|
| Details: Price |
|
|
| yesall 6 plans | yesall 3 plans | |
| Details: AI features included |
|
|
| 13 sources | 8 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- differs by tool
- Grok
- noFree (consumer: grok.com, apps, X), Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription)
- yesGrok Teams (grok.com; documentation: 'Grok Business'), Grok Enterprise, API (usage-based, global endpoint), API with Zero Data Retention (team setting)
- You.com
- not publicly documentedFree (Web Search API via MCP), Pay as you go (API)
- yesEnterprise (custom)
- Grok
- Free (consumer: grok.com, apps, X)
no (DPA is part of the Enterprise terms for business customers; consumer use is subject to the Consumer terms)
- Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription)
no (DPA is part of the Enterprise terms for business customers; consumer use is subject to the Consumer terms)
- Grok Teams (grok.com; documentation: 'Grok Business')
yes: Enterprise FAQ: 'if you submit personal data to our Services, our Data Processing Addendum (DPA) applies and is automatically incorporated into our Enterprise Terms of Service'; the Grok Business guide refers, for team workspaces, to the 'Terms of Service - Enterprise', which according to their preamble also apply to purchases by 'online purchase confirmation'. The DPA (effective 2026-09-22) provides for the processing of personal data only via the ZDR API.
Provider’s DPA - Grok Enterprise
yes: Data Processing Addendum (effective 2026-09-22) is part of the Enterprise terms for business services; the DPA provides for the processing of personal data only via the ZDR API.
Provider’s DPA - API (usage-based, global endpoint)
yes: Data Processing Addendum (effective 2026-09-22) is part of the 'Terms of Service - Enterprise', which according to a notice apply to business customers of the API and other business services; SCCs Module Two/Three. The DPA requires personal data to be processed only via the ZDR API; no personal data is to be transmitted to non-ZDR services.
Provider’s DPA - API with Zero Data Retention (team setting)
yes: Data Processing Addendum (effective 2026-09-22) as part of the Enterprise terms; the DPA expressly provides for the processing of personal data only via the ZDR API. SCCs Module Two/Three (Irish law).
Provider’s DPA
You.com- Free (Web Search API via MCP)
not publicly documented whether a DPA applies to this plan. According to its text, the public DPA (you.com/dpa, as of 2025-12-12) becomes part of the 'Master Subscription Agreement or other written electronic agreements' with the signing customer; the 'You.com MSA (Online)' linked on the pricing page (version December 2025), which is accepted by clicking or by using the platform, does not refer to the DPA.
- Enterprise (custom)
yes: public 'SuSea, Inc. Data Processing Addendum' (you.com/dpa, 'Last updated: December 12, 2025', linked in the footer of the pricing page); in the Trust Center, 'You.com DPA - March 2025' and 'You.com DPA - Security Addendum' are also available to view. According to its text, the DPA becomes part of the Master Subscription Agreement or another written/electronic agreement. Pricing page: 'DPA-ready'.
Provider’s DPA - Pay as you go (API)
not publicly documented whether a DPA applies to this plan. According to its text, the public DPA (you.com/dpa, as of 2025-12-12) becomes part of the 'Master Subscription Agreement or other written electronic agreements' with the signing customer; the 'You.com MSA (Online)' linked on the pricing page (version December 2025), which is accepted by clicking or by using the platform, does not refer to the DPA.
- Free (consumer: grok.com, apps, X)
Training
- differs by tool
- Grok
- opt-out availableFree (consumer: grok.com, apps, X), Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription)
- noGrok Teams (grok.com; documentation: 'Grok Business'), Grok Enterprise, API (usage-based, global endpoint), API with Zero Data Retention (team setting)
- You.comnoall 3 plans
- Grok
- Free (consumer: grok.com, apps, X)
Privacy policy (as of 2026-10-11) and Europe Addendum (effective 2026-08-24): User Content and feedback are used for training and improving the models on the basis of legitimate interests; objection possible in the settings (reference to the Consumer FAQ). Security FAQ: 'improve the model' toggle in the data controls. Training summary Grok 4.7: interactions with Grok may be used for training 'subject to privacy settings, controls, user requests, opt-outs'.
- Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription)
Privacy policy (as of 2026-10-11) and Europe Addendum (effective 2026-08-24): User Content and feedback are used for training and improving the models on the basis of legitimate interests; objection possible in the settings (reference to the Consumer FAQ). Security FAQ: 'improve the model' toggle in the data controls. Training summary Grok 4.7: interactions with Grok may be used for training 'subject to privacy settings, controls, user requests, opt-outs'.
- Grok Teams (grok.com; documentation: 'Grok Business')
Enterprise terms (as of 2026-08-14): SpaceXSI does not use User Content to train foundation models, LLMs or other AI systems, 'subject to disclosures to Customer and Customer-controlled user settings'; SpaceXSI may use de-identified or aggregated data except with ZDR. Business guide (as of 2026-10-10): team workspaces with 'Privacy guarantees as outlined in SpaceXSI's terms of service' (link to the Enterprise terms). Enterprise FAQ: 'we do not use your business data, including inputs (prompts) or outputs (answers), for training our models'; in some cases SpaceXSI offers free credits in exchange for permission to train.
- Grok Enterprise
Enterprise terms (as of 2026-08-14): SpaceXSI does not use User Content to train foundation models, LLMs or other AI systems, 'subject to disclosures to Customer and Customer-controlled user settings'; SpaceXSI may use de-identified or aggregated data except with ZDR. Business guide: team workspaces with 'Privacy guarantees as outlined in SpaceXSI's terms of service'. Enterprise FAQ: 'we do not use your business data, including inputs (prompts) or outputs (answers), for training our models'; in some cases SpaceXSI offers free credits in exchange for permission to train.
- API (usage-based, global endpoint)
API documentation (Security FAQ): 'SpaceXSI never trains on your API inputs or outputs without your explicit permission.' Enterprise terms (as of 2026-08-14): SpaceXSI does not use User Content to train foundation models, LLMs or other AI systems, 'subject to disclosures to Customer and Customer-controlled user settings'. Except with ZDR, SpaceXSI may use de-identified or aggregated data for any lawful purposes.
- API with Zero Data Retention (team setting)
API documentation (Security FAQ): 'SpaceXSI never trains on your API inputs or outputs without your explicit permission.' Enterprise terms: no training on User Content; with ZDR also no creation of de-identified data. With ZDR the 30-day storage does not apply; inputs and outputs are not written to disk. The documentation points out that ZDR is not recommended for most customers.
You.com- Free (Web Search API via MCP)
Privacy notice (as of 2026-09-22): You.com does not use the content of prompts, files or generated outputs for training or fine-tuning its own models; contracts with the providers of the integrated language models prohibit them from training on this content, 'except where you have separately opted in'. De-identified and aggregated content may be used for other purposes. Zero Data Retention documentation: requests are not used for training. The statements are not differentiated by plan. By contrast, section 4.5 of the terms of use (as of 2024-08-27) permits the use of Content 'to: (a) provide, maintain, train and improve the Services'; the privacy notice governs which rule prevails in the event of a conflict only for Enterprise customers and 'Paid Subscriber's subscription terms'.
- Enterprise (custom)
Privacy notice (as of 2026-09-22): You.com does not use the content of prompts, files or generated outputs for training or fine-tuning its own models; contracts with the providers of the integrated language models prohibit them from training on this content, 'except where you have separately opted in'. De-identified and aggregated content may be used for other purposes. Zero Data Retention documentation: requests are not used for training. The statements are not differentiated by plan. Additionally with ZDR: requests are not used for training, not sold to third parties and not sent to Google or Bing (documentation). MSA (Online, December 2025) 3.4.3: You.com uses Customer Data (Prompts and Output) only 'as necessary to provide Customer with the Services, comply with applicable law, and for safety purposes'; Platform Analyses (statistical usage data without identifying Customer Data) may be used for product development (6.5).
- Pay as you go (API)
Privacy notice (as of 2026-09-22): You.com does not use the content of prompts, files or generated outputs for training or fine-tuning its own models; contracts with the providers of the integrated language models prohibit them from training on this content, 'except where you have separately opted in'. De-identified and aggregated content may be used for other purposes. Zero Data Retention documentation: requests are not used for training. The statements are not differentiated by plan. MSA (Online, December 2025) 3.4.3: You.com uses Customer Data (Prompts and Output) only 'as necessary to provide Customer with the Services, comply with applicable law, and for safety purposes'; Platform Analyses (statistical usage data without identifying Customer Data) may be used for product development (6.5). By contrast, section 4.5 of the terms of use (as of 2024-08-27) permits the use of Content 'to: (a) provide, maintain, train and improve the Services'; the privacy notice governs which rule prevails in the event of a conflict only for Enterprise customers and 'Paid Subscriber's subscription terms'.
- Free (consumer: grok.com, apps, X)
Hosting
- differs by tool
- Grok
- US onlyFree (consumer: grok.com, apps, X), Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription)
- mixedGrok Teams (grok.com; documentation: 'Grok Business'), Grok Enterprise, API (usage-based, global endpoint), API with Zero Data Retention (team setting)
- You.comUS onlyall 3 plans
- Grok
- Free (consumer: grok.com, apps, X)
Europe Addendum (13.3): 'We process all of your personal information in the United States, where we maintain our primary data centers.'
- Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription)
Europe Addendum (13.3): 'We process all of your personal information in the United States, where we maintain our primary data centers.'
- Grok Teams (grok.com; documentation: 'Grok Business')
The privacy policy does not apply to data processed for business customers. DPA (q10): processing 'on a global basis outside Europe', including in the USA; sub-processors in the US, one subsidiary in the UK. The pricing page mentions data residency only in the Enterprise section; EU region not documented.
- Grok Enterprise
The privacy policy does not apply to data processed for business customers. DPA (q10): processing 'on a global basis outside Europe', including in the USA; sub-processors in the US, one subsidiary in the UK. Pricing page (Enterprise): 'Data residency: Control where your data lives' without a region specified; EU region not documented.
- API (usage-based, global endpoint)
Regions documentation (q3): the standard endpoint api.x.ai does not guarantee a processing region; requests may be routed between regions. Optional US endpoint us.api.x.ai: request handling, inference, moderation and stored request data in the USA (only grok-4.7 and grok-4.6, without image, video and voice APIs; Files, Collections and server-side tools may be processed outside the USA; token prices +10 %). DPA (q10): processing 'on a global basis outside Europe', including in the USA. Sub-processors in the US, one subsidiary in the UK. An EU region is not documented.
- API with Zero Data Retention (team setting)
As API: global endpoint without a region guarantee, US endpoint optional (ZDR also applies there). No EU region documented.
You.com- Free (Web Search API via MCP)
Terms of use (as of 2024-08-27, Section 2.3): 'We are based in the United States and the Services are provided from the United States.' Privacy notice (as of 2026-09-22): 'We use Amazon Web Services for various content hosting'. Trust Center (sub-processor list): all cloud/hosting providers (AWS, Google Cloud, Microsoft Azure, Vercel, MongoDB Atlas) with location 'United States'. EU option: not publicly documented.
- Enterprise (custom)
Terms of use (as of 2024-08-27, Section 2.3): 'We are based in the United States and the Services are provided from the United States.' Privacy notice (as of 2026-09-22): 'We use Amazon Web Services for various content hosting'. Trust Center (sub-processor list): all cloud/hosting providers (AWS, Google Cloud, Microsoft Azure, Vercel, MongoDB Atlas) with location 'United States'. EU option: not publicly documented.
- Pay as you go (API)
Terms of use (as of 2024-08-27, Section 2.3): 'We are based in the United States and the Services are provided from the United States.' Privacy notice (as of 2026-09-22): 'We use Amazon Web Services for various content hosting'. Trust Center (sub-processor list): all cloud/hosting providers (AWS, Google Cloud, Microsoft Azure, Vercel, MongoDB Atlas) with location 'United States'. EU option: not publicly documented.
- Free (consumer: grok.com, apps, X)
Sub-processors
- Groklist availableall 6 plans
- You.comlist availableall 3 plans
- Grok
- Free (consumer: grok.com, apps, X)
- Europe Addendum (q8): service providers as per the sub-processor page (q11, see API plan); Brave Software, Inc. receives parts of the inputs for search results; payment processing by Google Payments, Apple Pay and Stripe
- Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription)
- Europe Addendum (q8): service providers as per the sub-processor page (q11, see API plan); Brave Software, Inc. receives parts of the inputs for search results; payment processing by Google Payments, Apple Pay and Stripe
- Grok Teams (grok.com; documentation: 'Grok Business')
- According to the sub-processor list (q11): AWS, Google Cloud, Oracle (cloud infrastructure), Vercel (web hosting), MongoDB, Inc. (cloud database), Cloudflare and Hive (content delivery), LiveKit (real-time media), Axiom, Chronosphere, ClickHouse, Elasticsearch, GrowthBook, Hubspot, Okta, Twilio, Wiz, WorkOS, Zendesk (services and support), Sentry (error monitoring), Stripe and PayPal (Braintree) (payments), SpaceXSI affiliates (cloud infrastructure), each located in the US
- SpaceXSI subsidiary (services and support): located in the UK (q11)
- Grok Enterprise
- According to the sub-processor list (q11): AWS, Google Cloud, Oracle (cloud infrastructure), Vercel (web hosting), MongoDB, Inc. (cloud database), Cloudflare and Hive (content delivery), LiveKit (real-time media), Axiom, Chronosphere, ClickHouse, Elasticsearch, GrowthBook, Hubspot, Okta, Twilio, Wiz, WorkOS, Zendesk (services and support), Sentry (error monitoring), Stripe and PayPal (Braintree) (payments), SpaceXSI affiliates (cloud infrastructure), each located in the US
- SpaceXSI subsidiary (services and support): located in the UK (q11)
- API (usage-based, global endpoint)
- According to the sub-processor list (q11): AWS, Google Cloud, Oracle (cloud infrastructure), Vercel (web hosting), MongoDB, Inc. (cloud database), Cloudflare and Hive (content delivery), LiveKit (real-time media), Axiom, Chronosphere, ClickHouse, Elasticsearch, GrowthBook, Hubspot, Okta, Twilio, Wiz, WorkOS, Zendesk (services and support), Sentry (error monitoring), Stripe and PayPal (Braintree) (payments), SpaceXSI affiliates (cloud infrastructure), each located in the US
- SpaceXSI subsidiary (services and support): located in the UK (q11)
- API with Zero Data Retention (team setting)
- According to the sub-processor list (q11): AWS, Google Cloud, Oracle (cloud infrastructure), Vercel (web hosting), MongoDB, Inc. (cloud database), Cloudflare and Hive (content delivery), LiveKit (real-time media), Axiom, Chronosphere, ClickHouse, Elasticsearch, GrowthBook, Hubspot, Okta, Twilio, Wiz, WorkOS, Zendesk (services and support), Sentry (error monitoring), Stripe and PayPal (Braintree) (payments), SpaceXSI affiliates (cloud infrastructure), each located in the US
- SpaceXSI subsidiary (services and support): located in the UK (q11)
You.com- Free (Web Search API via MCP)
- According to the Trust Center (sub-processor list, 24 entries; location 'United States' in each case, no location for Coralogix and Gong): cloud/infrastructure: Amazon Web Services, Google Cloud Platform (also LLM provider, according to the list 'with Zero Data Retention and Zero Data Training'), Microsoft Azure, Vercel, MongoDB Atlas (database), Confluent (Kafka infrastructure for user events), Cloudflare (CDN, security, DNS)
- LLM/model providers according to the Trust Center: Anthropic, OpenAI, Together.ai, Fireworks.AI (each 'Zero Data Retention and Zero Data Training'), Cohere (without this addition), Baseten (model serving), Modal (sandbox), Anchor Browser
- Others according to the Trust Center: Osano (privacy operations), Descope (identity/accounts), Moesif (billing analytics), Coralogix (observability/logs), Tableau (product analytics), Stripe (payments), Braze and HubSpot (marketing/CRM), Gong (sales)
- Privacy notice: AWS 'for various content hosting'; Google Analytics and Google Tag Manager for analytics; Stripe for payment processing
- In addition, 'Supplemental Subprocessors.xlsx' in the Trust Center only on access request; content not publicly documented
- Enterprise (custom)
- According to the Trust Center (sub-processor list, 24 entries; location 'United States' in each case, no location for Coralogix and Gong): cloud/infrastructure: Amazon Web Services, Google Cloud Platform (also LLM provider, according to the list 'with Zero Data Retention and Zero Data Training'), Microsoft Azure, Vercel, MongoDB Atlas (database), Confluent (Kafka infrastructure for user events), Cloudflare (CDN, security, DNS)
- LLM/model providers according to the Trust Center: Anthropic, OpenAI, Together.ai, Fireworks.AI (each 'Zero Data Retention and Zero Data Training'), Cohere (without this addition), Baseten (model serving), Modal (sandbox), Anchor Browser
- Others according to the Trust Center: Osano (privacy operations), Descope (identity/accounts), Moesif (billing analytics), Coralogix (observability/logs), Tableau (product analytics), Stripe (payments), Braze and HubSpot (marketing/CRM), Gong (sales)
- Privacy notice: AWS 'for various content hosting'; Google Analytics and Google Tag Manager for analytics; Stripe for payment processing
- In addition, 'Supplemental Subprocessors.xlsx' in the Trust Center only on access request; content not publicly documented
- Pay as you go (API)
- According to the Trust Center (sub-processor list, 24 entries; location 'United States' in each case, no location for Coralogix and Gong): cloud/infrastructure: Amazon Web Services, Google Cloud Platform (also LLM provider, according to the list 'with Zero Data Retention and Zero Data Training'), Microsoft Azure, Vercel, MongoDB Atlas (database), Confluent (Kafka infrastructure for user events), Cloudflare (CDN, security, DNS)
- LLM/model providers according to the Trust Center: Anthropic, OpenAI, Together.ai, Fireworks.AI (each 'Zero Data Retention and Zero Data Training'), Cohere (without this addition), Baseten (model serving), Modal (sandbox), Anchor Browser
- Others according to the Trust Center: Osano (privacy operations), Descope (identity/accounts), Moesif (billing analytics), Coralogix (observability/logs), Tableau (product analytics), Stripe (payments), Braze and HubSpot (marketing/CRM), Gong (sales)
- Privacy notice: AWS 'for various content hosting'; Google Analytics and Google Tag Manager for analytics; Stripe for payment processing
- In addition, 'Supplemental Subprocessors.xlsx' in the Trust Center only on access request; content not publicly documented
- Free (consumer: grok.com, apps, X)
Retention
- differs by tool
- Grok
- Privacy policyFree (consumer: grok.com, apps, X), Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription)
- Enterprise terms: User Content is deleted…Grok Teams (grok.com; documentation: 'Grok Business'), Grok Enterprise
- Security FAQ: requests and responses are…API (usage-based, global endpoint)
- No storage of prompts and outputsAPI with Zero Data Retention (team setting)
- You.comPrivacy notice: account and profile data…all 3 plans
- Grok
- Free (consumer: grok.com, apps, X)Privacy policy (as of 2026-10-11): retention for as long as a legitimate business interest exists; with Private Chat, conversations are deleted within 30 days; deleted conversations or deleted accounts are deleted within 30 days, except for legal, compliance or security reasons. Consumer FAQ: deleted chats and files are removed 'within standard retention windows'; account recoverable within 30 days.
- Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription)Privacy policy (as of 2026-10-11): retention for as long as a legitimate business interest exists; with Private Chat, conversations are deleted within 30 days; deleted conversations or deleted accounts are deleted within 30 days, except for legal, compliance or security reasons. Consumer FAQ: deleted chats and files are removed 'within standard retention windows'; account recoverable within 30 days.
- Grok Teams (grok.com; documentation: 'Grok Business')Enterprise terms: User Content is deleted no later than 30 days after the end of the interaction, unless otherwise specified in the Order Form, by self-service setting or by law. Pricing page: Teams with 'Custom Chat data retention'.
- Grok EnterpriseEnterprise terms: User Content is deleted no later than 30 days after the end of the interaction, unless otherwise specified in the Order Form, by self-service setting or by law. Pricing page: 'Custom Chat data retention'. Business guide: Enterprise with custom retention rules.
- API (usage-based, global endpoint)Security FAQ: requests and responses are stored encrypted for 30 days (audit/abuse review) and then automatically deleted; Files and Collections remain until deleted. Enterprise terms: User Content is deleted no later than 30 days after the end of the interaction, unless otherwise agreed, required by law or necessary for security/compliance reasons. DPA Annex 2: following a deletion request, deletion typically within 30 days.
- API with Zero Data Retention (team setting)No storage of prompts and outputs (ZDR, team-wide); according to the documentation, activation by team admins themselves in the console, where available; with an Enterprise contract, the contract governs retention. When activating, the Enterprise terms and the privacy policy must be accepted. Enterprise terms: with ZDR, User Content exists 'only transiently' to generate the response and is deleted afterwards; DPA: with the ZDR API, only the customer retains personal data.
You.com- Free (Web Search API via MCP)Privacy notice: account and profile data are stored for as long as the account is active, user content and usage data for as long as necessary for provision and security; data subject to a deletion request until that request has been processed; the notice does not state fixed periods. Different periods or Zero Data Retention under the Enterprise contract take precedence. With ZDR (Enterprise, on request), requests and responses are processed only briefly for handling and are not stored permanently; pricing page: 'All queries and responses are automatically purged and never stored.'
- Enterprise (custom)Privacy notice: account and profile data are stored for as long as the account is active, user content and usage data for as long as necessary for provision and security; data subject to a deletion request until that request has been processed; the notice does not state fixed periods. Different periods or Zero Data Retention under the Enterprise contract take precedence. With ZDR (Enterprise, on request), requests and responses are processed only briefly for handling and are not stored permanently; pricing page: 'All queries and responses are automatically purged and never stored.' According to the documentation, ZDR applies to the Web Search API and Answer API and is activated by You.com on request (no self-service switch). MSA (Online) 11.4: after the end of the contract, 30 calendar days of access to retrieve Customer Data upon written notice, after which You.com will 'promptly delete Customer Data'.
- Pay as you go (API)Privacy notice: account and profile data are stored for as long as the account is active, user content and usage data for as long as necessary for provision and security; data subject to a deletion request until that request has been processed; the notice does not state fixed periods. Different periods or Zero Data Retention under the Enterprise contract take precedence. With ZDR (Enterprise, on request), requests and responses are processed only briefly for handling and are not stored permanently; pricing page: 'All queries and responses are automatically purged and never stored.' MSA (Online) 11.4: after the end of the contract, 30 calendar days of access to retrieve Customer Data upon written notice, after which You.com will 'promptly delete Customer Data'.
Price
- differs by tool
- Grok
- 0 USDFree (consumer: grok.com, apps, X)
- several tiersPlus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription)
- from 30 USD/user/moGrok Teams (grok.com; documentation: 'Grok Business')
- customGrok Enterprise
- per tokenAPI (usage-based, global endpoint)
- As APIAPI with Zero Data Retention (team setting)
- You.com
- freeFree (Web Search API via MCP)
- customEnterprise (custom)
- several tiersPay as you go (API)
- Grok
- Free (consumer: grok.com, apps, X)
0 USD (pricing page)
- Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription)
Plus 8 USD; Premium 30 USD; Super 100 USD; Ultra 200 USD per month, each excl. taxes; subscriptions are sold via X Subscription Corp. and include X features (pricing page). The Consumer FAQ still names 'SuperGrok' and 'SuperGrok Heavy'.
- Grok Teams (grok.com; documentation: 'Grok Business')
from 30 USD per user per month ('$30+/user/month'; seat types combinable), excl. taxes (pricing page)
- Grok Enterprise
Custom (pricing page: 'Custom', contact sales; payment by invoice/bank transfer only in the Enterprise plan)
- API (usage-based, global endpoint)
Per 1M tokens, in USD, below / from 200k prompt tokens (pricing page): grok-4.7 and grok-4.6 input 2.00 USD / 4.00 USD, cache 0.50 USD / 1.00 USD, output 6.00 USD / 12.00 USD; grok-4.5 input 2.00 USD / 4.00 USD, cache 0.30 USD / 0.60 USD, output 6.00 USD / 12.00 USD; grok-4.3 and grok-4.20 variants input 1.25 USD / 2.50 USD, cache 0.20 USD / 0.40 USD, output 2.50 USD / 5.00 USD; grok-build-0.1 input 1.00 USD / 2.00 USD, cache 0.20 USD / 0.40 USD, output 2.00 USD / 4.00 USD. Tools: web search, code execution, file search 5 USD per 1,000 calls each; X search 5 USD per 1,000 posts or 10 USD per 1,000 profiles; Collections search 2.50 USD per 1,000 calls. US endpoint 10 % surcharge.
- API with Zero Data Retention (team setting)
As API (ZDR surcharge not stated in the documentation)
You.com- Free (Web Search API via MCP)
Free (pricing page)
- Enterprise (custom)
Custom (pricing page: 'Custom, Talk to our humans')
- Pay as you go (API)
Web Search API 5 USD per 1,000 calls; Contents API 1 USD per 1,000 pages; Answer API 5 USD per 1,000 calls; Research API per 1,000 calls: Lite 12 USD, Standard 50 USD, Deep 100 USD, Exhaustive 450 USD, Frontier 1,200 USD; Finance Research Deep 110 USD, Exhaustive 500 USD per 1,000 calls; no minimum purchase, no platform fee (pricing page, in USD); according to MSA (Online) 5.8, the fees do not include any taxes, including value-added tax ('value-added')
- Free (consumer: grok.com, apps, X)
- Grokyesall 6 plans
- You.comyesall 3 plans
- Grok
- Free (consumer: grok.com, apps, X)
yes (limited chat, agent, image and Build usage according to the pricing page)
- Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription)
yes (from Plus: Grok Chat, Voice, Imagine, Build, API access and Cursor; from Premium: Grok Bot, latest models, video and image generation, 4x usage compared with Plus; Super/Ultra with 15x and 50x usage respectively compared with Plus)
- Grok Teams (grok.com; documentation: 'Grok Business')
yes (according to the Teams comparison table: Grok Chat, Imagine, video generation, Build, API access, Grok Bot, Cursor agent, pooled usage, team management, central billing, team-wide privacy settings, custom chat retention, SAML/OIDC SSO, combinable seat types; self-service by card. Business guide: connectors to Google Drive, Outlook, SharePoint, Teams, Salesforce, among others)
- Grok Enterprise
yes (as Teams; additionally, according to the pricing page, SCIM, audit logs and service accounts, spend controls, group settings, purchase on invoice, custom rate limits, dedicated infrastructure, 'Data residency', among others)
- API (usage-based, global endpoint)
yes (models grok-4.7, grok-4.6, grok-4.5, grok-4.3, grok-4.20, grok-build-0.1; tools such as web and X search, code execution; image, video and voice APIs)
- API with Zero Data Retention (team setting)
yes (as API; without functions that require storage: Files, Collections, Batch API, stateful Responses API, among others)
You.com- Free (Web Search API via MCP)
yes (Web Search via MCP server, up to 100 requests per day, without API key or account)
- Enterprise (custom)
yes (all APIs; according to the pricing page, custom load capacity and SLA support)
- Pay as you go (API)
yes (Web Search, Contents, Answer, Research and Finance Research API; all endpoints, SDKs and MCP)
- Free (consumer: grok.com, apps, X)
Evidence
- Grok13 sources
- You.com8 sources
- Grok
- Pricing (developer documentation)Pricing page, retrieved 14 Oct 2026
- FAQ: SecurityDocumentation, retrieved 14 Oct 2026
- Regional EndpointsDocumentation, retrieved 18 Oct 2026
- FAQ: Grok Website / AppsDocumentation, retrieved 18 Oct 2026
- Grok Business / Enterprise User GuideDocumentation, retrieved 18 Oct 2026
- Pricing: Compare PlansPricing page, retrieved 18 Oct 2026
- SpaceXSI Privacy Policy (Last Updated 2026-10-11)Privacy notice, retrieved 18 Oct 2026
- Europe Privacy Policy Addendum (effective 2026-08-24)Privacy notice, retrieved 18 Oct 2026
- Terms of Service - Enterprise (Last Updated 2026-08-14)Terms and conditions, retrieved 18 Oct 2026
- SpaceXSI Data Processing Addendum (effective 2026-09-22)DPA, retrieved 14 Oct 2026
- SpaceXSI Subprocessor ListSub-processor list, retrieved 14 Oct 2026
- Public Summary of Training Content for Grok 4.7 (V1, 2026-09-21)Documentation, retrieved 14 Oct 2026
- FAQ - EnterpriseDocumentation, retrieved 18 Oct 2026
You.com- PricingPricing page, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-09-22)Privacy notice, retrieved 18 Oct 2026
- Terms & Conditions (as of 2024-08-27)Terms and conditions, retrieved 18 Oct 2026
- Zero Data Retention (ZDR)Documentation, retrieved 14 Oct 2026
- You.com Trust Center – Resources (DPA, SOC 2 Type 2 Report)Trust Center, retrieved 14 Oct 2026
- You.com Trust Center – SubprocessorsSub-processor list, retrieved 14 Oct 2026
- SuSea, Inc. Data Processing Addendum (as of 2025-12-12)DPA, retrieved 14 Oct 2026
- You.com Master Services Agreement (Online), MSA v.121525 (December 2025)Terms and conditions, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
No guarantee of accuracy, not legal advice. Each entry is valid as of the date shown. Open points are listed on the detail pages.
More comparisons
Grok compared with
Individual pages: Grok, You.com. All tools in the category: AI assistants & search.