Grok
Grok (SpaceXSI / xAI: API and grok.com)
Provider: SpaceXAI LLC · Based in: SpaceXAI LLC, 1450 Page Mill Rd, Palo Alto, CA 94304, USA · Provider website
- Plans
- 6
- Sources
- 14
- As of
- 18 Oct
As of 18 Oct 2026. Based on our research on this date and the process described in the methodology. No guarantee of accuracy, not legal advice. The provider’s current documents take precedence. Found an error? Report a correction.
Incomplete. 4 points could not be verified in any provider source (see open points). This does not mean the matter is unproblematic; it means we have not checked it.
At a glance
- Hosting
- US only: Free, Plus / Premium / Super / Ultramixed: Grok Teams, Grok Enterprise, API, API with Zero Data Retention
- Training on inputs
- opt-out available: Free, Plus / Premium / Super / Ultrano: Grok Teams, Grok Enterprise, API, API with Zero Data Retention
- DPA
- no: Free, Plus / Premium / Super / Ultrayes: Grok Teams, Grok Enterprise, API, API with Zero Data Retention
- Provider
- SpaceXAI LLC (brand 'SpaceXSI'; documentation metadata: 'SpaceX Super Intelligence'; privacy contact names 'x.AI LLC')
- Based in
- SpaceXAI LLC, 1450 Page Mill Rd, Palo Alto, CA 94304, USA (Public Summary of Training Content Grok 4.7, q12); Europe Addendum: 'based in the USA' (q8). Enterprise terms: law of Texas, place of jurisdiction Wichita County, Texas (q9)
Values from 6 plans, each listed with the plans it applies to. Details and evidence are in the plan table.
Compare Grok
Compare with another toolCompared plan by plan with other tools in the category AI assistants & search:
Details per plan
Short values per plan. Click a feature to open the evidence and notes for all plans; sources with retrieval dates are under “Evidence”.
| Feature | Free (consumer: grok.com, apps, X)Compare Grok Free (consumer: grok.com, apps, X) with another tool | Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription)Compare Grok Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription) with another tool | Grok Teams (grok.com; documentation: 'Grok Business')Compare Grok Grok Teams (grok.com; documentation: 'Grok Business') with another tool | Grok EnterpriseCompare Grok Grok Enterprise with another tool | API (usage-based, global endpoint)Compare Grok API (usage-based, global endpoint) with another tool |
|---|---|---|---|---|---|
| differs by plan | 0 USD | several tiers | from 30 USD/user/mo | custom | per token |
| Details: Price | 0 USD (pricing page) | Plus 8 USD; Premium 30 USD; Super 100 USD; Ultra 200 USD per month, each excl. taxes; subscriptions are sold via X Subscription Corp. and include X features (pricing page). The Consumer FAQ still names 'SuperGrok' and 'SuperGrok Heavy'. | from 30 USD per user per month ('$30+/user/month'; seat types combinable), excl. taxes (pricing page) | Custom (pricing page: 'Custom', contact sales; payment by invoice/bank transfer only in the Enterprise plan) | Per 1M tokens, in USD, below / from 200k prompt tokens (pricing page): grok-4.7 and grok-4.6 input 2.00 USD / 4.00 USD, cache 0.50 USD / 1.00 USD, output 6.00 USD / 12.00 USD; grok-4.5 input 2.00 USD / 4.00 USD, cache 0.30 USD / 0.60 USD, output 6.00 USD / 12.00 USD; grok-4.3 and grok-4.20 variants input 1.25 USD / 2.50 USD, cache 0.20 USD / 0.40 USD, output 2.50 USD / 5.00 USD; grok-build-0.1 input 1.00 USD / 2.00 USD, cache 0.20 USD / 0.40 USD, output 2.00 USD / 4.00 USD. Tools: web search, code execution, file search 5 USD per 1,000 calls each; X search 5 USD per 1,000 posts or 10 USD per 1,000 profiles; Collections search 2.50 USD per 1,000 calls. US endpoint 10 % surcharge. |
| yes | yes | yes | yes | yes | |
| Details: AI features included | yes (limited chat, agent, image and Build usage according to the pricing page) | yes (from Plus: Grok Chat, Voice, Imagine, Build, API access and Cursor; from Premium: Grok Bot, latest models, video and image generation, 4x usage compared with Plus; Super/Ultra with 15x and 50x usage respectively compared with Plus) | yes (according to the Teams comparison table: Grok Chat, Imagine, video generation, Build, API access, Grok Bot, Cursor agent, pooled usage, team management, central billing, team-wide privacy settings, custom chat retention, SAML/OIDC SSO, combinable seat types; self-service by card. Business guide: connectors to Google Drive, Outlook, SharePoint, Teams, Salesforce, among others) | yes (as Teams; additionally, according to the pricing page, SCIM, audit logs and service accounts, spend controls, group settings, purchase on invoice, custom rate limits, dedicated infrastructure, 'Data residency', among others) | yes (models grok-4.7, grok-4.6, grok-4.5, grok-4.3, grok-4.20, grok-build-0.1; tools such as web and X search, code execution; image, video and voice APIs) |
| differs by plan | no | no | yes | yes | yes |
| Details: DPA | no (DPA is part of the Enterprise terms for business customers; consumer use is subject to the Consumer terms) | no (DPA is part of the Enterprise terms for business customers; consumer use is subject to the Consumer terms) | yes: Enterprise FAQ: 'if you submit personal data to our Services, our Data Processing Addendum (DPA) applies and is automatically incorporated into our Enterprise Terms of Service'; the Grok Business guide refers, for team workspaces, to the 'Terms of Service - Enterprise', which according to their preamble also apply to purchases by 'online purchase confirmation'. The DPA (effective 2026-09-22) provides for the processing of personal data only via the ZDR API. Provider’s DPA | yes: Data Processing Addendum (effective 2026-09-22) is part of the Enterprise terms for business services; the DPA provides for the processing of personal data only via the ZDR API. Provider’s DPA | yes: Data Processing Addendum (effective 2026-09-22) is part of the 'Terms of Service - Enterprise', which according to a notice apply to business customers of the API and other business services; SCCs Module Two/Three. The DPA requires personal data to be processed only via the ZDR API; no personal data is to be transmitted to non-ZDR services. Provider’s DPA |
| differs by plan | opt-out available | opt-out available | no | no | no |
| Details: Training on inputs | Privacy policy (as of 2026-10-11) and Europe Addendum (effective 2026-08-24): User Content and feedback are used for training and improving the models on the basis of legitimate interests; objection possible in the settings (reference to the Consumer FAQ). Security FAQ: 'improve the model' toggle in the data controls. Training summary Grok 4.7: interactions with Grok may be used for training 'subject to privacy settings, controls, user requests, opt-outs'. | Privacy policy (as of 2026-10-11) and Europe Addendum (effective 2026-08-24): User Content and feedback are used for training and improving the models on the basis of legitimate interests; objection possible in the settings (reference to the Consumer FAQ). Security FAQ: 'improve the model' toggle in the data controls. Training summary Grok 4.7: interactions with Grok may be used for training 'subject to privacy settings, controls, user requests, opt-outs'. | Enterprise terms (as of 2026-08-14): SpaceXSI does not use User Content to train foundation models, LLMs or other AI systems, 'subject to disclosures to Customer and Customer-controlled user settings'; SpaceXSI may use de-identified or aggregated data except with ZDR. Business guide (as of 2026-10-10): team workspaces with 'Privacy guarantees as outlined in SpaceXSI's terms of service' (link to the Enterprise terms). Enterprise FAQ: 'we do not use your business data, including inputs (prompts) or outputs (answers), for training our models'; in some cases SpaceXSI offers free credits in exchange for permission to train. | Enterprise terms (as of 2026-08-14): SpaceXSI does not use User Content to train foundation models, LLMs or other AI systems, 'subject to disclosures to Customer and Customer-controlled user settings'; SpaceXSI may use de-identified or aggregated data except with ZDR. Business guide: team workspaces with 'Privacy guarantees as outlined in SpaceXSI's terms of service'. Enterprise FAQ: 'we do not use your business data, including inputs (prompts) or outputs (answers), for training our models'; in some cases SpaceXSI offers free credits in exchange for permission to train. | API documentation (Security FAQ): 'SpaceXSI never trains on your API inputs or outputs without your explicit permission.' Enterprise terms (as of 2026-08-14): SpaceXSI does not use User Content to train foundation models, LLMs or other AI systems, 'subject to disclosures to Customer and Customer-controlled user settings'. Except with ZDR, SpaceXSI may use de-identified or aggregated data for any lawful purposes. |
| differs by plan | Privacy policy | Privacy policy | Enterprise terms: User Content is deleted… | Enterprise terms: User Content is deleted… | Security FAQ: requests and responses are… |
| Details: Data retention | Privacy policy (as of 2026-10-11): retention for as long as a legitimate business interest exists; with Private Chat, conversations are deleted within 30 days; deleted conversations or deleted accounts are deleted within 30 days, except for legal, compliance or security reasons. Consumer FAQ: deleted chats and files are removed 'within standard retention windows'; account recoverable within 30 days. | Privacy policy (as of 2026-10-11): retention for as long as a legitimate business interest exists; with Private Chat, conversations are deleted within 30 days; deleted conversations or deleted accounts are deleted within 30 days, except for legal, compliance or security reasons. Consumer FAQ: deleted chats and files are removed 'within standard retention windows'; account recoverable within 30 days. | Enterprise terms: User Content is deleted no later than 30 days after the end of the interaction, unless otherwise specified in the Order Form, by self-service setting or by law. Pricing page: Teams with 'Custom Chat data retention'. | Enterprise terms: User Content is deleted no later than 30 days after the end of the interaction, unless otherwise specified in the Order Form, by self-service setting or by law. Pricing page: 'Custom Chat data retention'. Business guide: Enterprise with custom retention rules. | Security FAQ: requests and responses are stored encrypted for 30 days (audit/abuse review) and then automatically deleted; Files and Collections remain until deleted. Enterprise terms: User Content is deleted no later than 30 days after the end of the interaction, unless otherwise agreed, required by law or necessary for security/compliance reasons. DPA Annex 2: following a deletion request, deletion typically within 30 days. |
| differs by plan | US only | US only | mixed | mixed | mixed |
| Details: Hosting | Europe Addendum (13.3): 'We process all of your personal information in the United States, where we maintain our primary data centers.' | Europe Addendum (13.3): 'We process all of your personal information in the United States, where we maintain our primary data centers.' | The privacy policy does not apply to data processed for business customers. DPA (q10): processing 'on a global basis outside Europe', including in the USA; sub-processors in the US, one subsidiary in the UK. The pricing page mentions data residency only in the Enterprise section; EU region not documented. | The privacy policy does not apply to data processed for business customers. DPA (q10): processing 'on a global basis outside Europe', including in the USA; sub-processors in the US, one subsidiary in the UK. Pricing page (Enterprise): 'Data residency: Control where your data lives' without a region specified; EU region not documented. | Regions documentation (q3): the standard endpoint api.x.ai does not guarantee a processing region; requests may be routed between regions. Optional US endpoint us.api.x.ai: request handling, inference, moderation and stored request data in the USA (only grok-4.7 and grok-4.6, without image, video and voice APIs; Files, Collections and server-side tools may be processed outside the USA; token prices +10 %). DPA (q10): processing 'on a global basis outside Europe', including in the USA. Sub-processors in the US, one subsidiary in the UK. An EU region is not documented. |
| list available | list available | list available | list available | list available | |
| Details: Sub-processors |
|
|
|
|
|
| differs by plan | 7 sources | 7 sources | 6 sources | 6 sources | 6 sources |
| Details: Sources with retrieval date |
|
|
|
|
|
Compare Grok Free (consumer: grok.com, apps, X) with another tool
Price and scope
- differs by plan
- 0 USD
0 USD (pricing page)
- yes
yes (limited chat, agent, image and Build usage according to the pricing page)
Contract and data use
- differs by plan
- no
no (DPA is part of the Enterprise terms for business customers; consumer use is subject to the Consumer terms)
- differs by plan
- opt-out available
Privacy policy (as of 2026-10-11) and Europe Addendum (effective 2026-08-24): User Content and feedback are used for training and improving the models on the basis of legitimate interests; objection possible in the settings (reference to the Consumer FAQ). Security FAQ: 'improve the model' toggle in the data controls. Training summary Grok 4.7: interactions with Grok may be used for training 'subject to privacy settings, controls, user requests, opt-outs'.
- differs by plan
- Privacy policy
- Privacy policy (as of 2026-10-11): retention for as long as a legitimate business interest exists; with Private Chat, conversations are deleted within 30 days; deleted conversations or deleted accounts are deleted within 30 days, except for legal, compliance or security reasons. Consumer FAQ: deleted chats and files are removed 'within standard retention windows'; account recoverable within 30 days.
Hosting and sharing
- differs by plan
- US only
Europe Addendum (13.3): 'We process all of your personal information in the United States, where we maintain our primary data centers.'
- list available
- Europe Addendum (q8): service providers as per the sub-processor page (q11, see API plan); Brave Software, Inc. receives parts of the inputs for search results; payment processing by Google Payments, Apple Pay and Stripe
Evidence
- differs by plan
- 7 sources
- FAQ: SecurityDocumentation, retrieved 14 Oct 2026
- FAQ: Grok Website / AppsDocumentation, retrieved 18 Oct 2026
- Pricing: Compare PlansPricing page, retrieved 18 Oct 2026
- SpaceXSI Privacy Policy (Last Updated 2026-10-11)Privacy notice, retrieved 18 Oct 2026
- Europe Privacy Policy Addendum (effective 2026-08-24)Privacy notice, retrieved 18 Oct 2026
- SpaceXSI Subprocessor ListSub-processor list, retrieved 14 Oct 2026
- Public Summary of Training Content for Grok 4.7 (V1, 2026-09-21)Documentation, retrieved 14 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
Third-country transfers
Europe Addendum (effective 2026-08-24): the controller is SpaceXAI LLC (USA); all personal data is processed in the USA. Service providers participate in the EU-U.S. Data Privacy Framework (incl. UK Extension, Swiss-U.S. DPF), or standard contractual clauses are in place. DPA for business customers: SCCs 2021/914 Module Two/Three, Irish law, courts of Ireland; UK Addendum and Swiss adjustments. Privacy policy: representatives Lionheart Squared (Europe) Ltd, Dublin (EU), Lionheart Squared Limited (UK), Lionheart Squared Switzerland SarL (CH); data protection officer privacy@x.ai. API documentation: US endpoint optional, global endpoint without a region guarantee.
- Regional Endpoints (Documentation), retrieved 18 Oct 2026
- SpaceXSI Privacy Policy (Last Updated 2026-10-11) (Privacy notice), retrieved 18 Oct 2026
- Europe Privacy Policy Addendum (effective 2026-08-24) (Privacy notice), retrieved 18 Oct 2026
- SpaceXSI Data Processing Addendum (effective 2026-09-22) (DPA), retrieved 14 Oct 2026
Certifications (as stated by the provider)
Security FAQ: 'We are SOC 2 Type 2 compliant.' Trust Center only for customers with an NDA. DPA Annex 2: NIST 800-171 Rev.3 as the basis of internal security standards, annual third-party penetration test; certificates and audit reports on written request under confidentiality. HIPAA: BAA can be requested via questionnaire. ISO 27001: not publicly documented.
- FAQ: Security (Documentation), retrieved 14 Oct 2026
- SpaceXSI Data Processing Addendum (effective 2026-09-22) (DPA), retrieved 14 Oct 2026
AI Act
Functions: AI assistant with text generation, tool use (web and X search, code execution), image, video and voice generation (Grok Imagine, Voice), agents (Grok Build, Grok Bot) (pricing page, documentation).
Provider’s statement: On x.ai/legal the provider publishes a 'Public Summary of Training Content' for Grok 4.5, Grok 4.7, Grok Voice Think Fast 2.0 and Grok Imagine Image 2.0. Grok 4.7 (V1, 2026-09-21): 'Date of placement of the model on the Union market: 21 September 2026'; EDSR, Tallinn, Estonia is named as 'Authorised representative'. No other express statement on the EU AI Act was found. Consumer FAQ: generated images and videos carry a Grok watermark indicating AI generation; there is no setting to remove it.
Classification (for review, not legal advice): For review: customer typically deployer (Art. 3(4) AI Act); when using the image and video functions, check labelling obligations (Art. 50). Not legal advice.
- FAQ: Security (Documentation), retrieved 14 Oct 2026
- FAQ: Grok Website / Apps (Documentation), retrieved 18 Oct 2026
- Public Summary of Training Content for Grok 4.7 (V1, 2026-09-21) (Documentation), retrieved 14 Oct 2026
- SpaceXSI Legal (overview incl. Public Summaries of Training Content) (Documentation), retrieved 18 Oct 2026
Current notes 2026
In 2026 the provider operates as 'SpaceXSI' (company SpaceXAI LLC); the API is available at api.x.ai. According to the pricing page, consumer plans are bundled subscriptions with X features (Free, Plus, Premium, Super, Ultra; sold only via X Subscription Corp.), Teams from 30 USD per user. Current flagship model grok-4.7 (on the Union market since 2026-09-21 according to the training summary). US regional endpoint with a 10 % surcharge. The DPA requires the ZDR API for personal data. The consumer FAQ and the Grok Business guide (as of 2026-10-10) still use the names 'SuperGrok' and 'SuperGrok Heavy', which the pricing page no longer uses.
Open points of the review
- No EU hosting region documented: besides the global endpoint, the regions documentation names only the US endpoint; Enterprise 'Data residency' without stating a region.
- Trust Portal (trust.x.ai) shows only a 'Request access' form without access; SOC 2 report not viewable; ISO 27001 not evidenced.
- Apart from Private Chat and deletion (30 days each), the privacy policy states no fixed retention periods for consumer data; the consumer FAQ only refers to 'standard retention windows'.
- Apart from the training summaries, no express AI Act statement found.
Frequently asked questions
Where does Grok store data?
US only (plans: Free (consumer: grok.com, apps, X), Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription)); mixed (plans: Grok Teams (grok.com; documentation: 'Grok Business'), Grok Enterprise, API (usage-based, global endpoint), API with Zero Data Retention (team setting)). According to the provider, as of 18 Oct 2026.
Is there a DPA for Grok?
no in: Free (consumer: grok.com, apps, X), Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription); yes in: Grok Teams (grok.com; documentation: 'Grok Business'), Grok Enterprise, API (usage-based, global endpoint), API with Zero Data Retention (team setting). According to the provider, as of 18 Oct 2026.
Does Grok use inputs for AI training?
opt-out available in: Free (consumer: grok.com, apps, X), Plus / Premium / Super / Ultra (consumer: grok.com, apps, X subscription); no in: Grok Teams (grok.com; documentation: 'Grok Business'), Grok Enterprise, API (usage-based, global endpoint), API with Zero Data Retention (team setting). According to the provider, as of 18 Oct 2026.
Where is the provider based?
SpaceXAI LLC, 1450 Page Mill Rd, Palo Alto, CA 94304, USA; Europe Addendum: 'based in the USA'. Enterprise terms: law of Texas, place of jurisdiction Wichita County, Texas. According to the provider, as of 18 Oct 2026.
All sources
- 01Pricing (developer documentation)Pricing page · retrieved 14 Oct 2026
- 02FAQ: SecurityDocumentation · retrieved 14 Oct 2026
- 03Regional EndpointsDocumentation · retrieved 18 Oct 2026
- 04FAQ: Grok Website / AppsDocumentation · retrieved 18 Oct 2026
- 05Grok Business / Enterprise User GuideDocumentation · retrieved 18 Oct 2026
- 06Pricing: Compare PlansPricing page · retrieved 18 Oct 2026
- 07SpaceXSI Privacy Policy (Last Updated 2026-10-11)Privacy notice · retrieved 18 Oct 2026
- 08Europe Privacy Policy Addendum (effective 2026-08-24)Privacy notice · retrieved 18 Oct 2026
- 09Terms of Service - Enterprise (Last Updated 2026-08-14)Terms and conditions · retrieved 18 Oct 2026
- 10SpaceXSI Data Processing Addendum (effective 2026-09-22)DPA · retrieved 14 Oct 2026
- 11SpaceXSI Subprocessor ListSub-processor list · retrieved 14 Oct 2026
- 12Public Summary of Training Content for Grok 4.7 (V1, 2026-09-21)Documentation · retrieved 14 Oct 2026
- 13SpaceXSI Legal (overview incl. Public Summaries of Training Content)Documentation · retrieved 18 Oct 2026
- 14FAQ - EnterpriseDocumentation · retrieved 18 Oct 2026
More tools in AI assistants & search with an EU hosting option (in at least one plan)
- Aleph Alpha · Based in: Speyerer Straße 14, 69115 Heidelberg, Germany
- ChatGPT · Based in: According to the privacy policy
- DeutschlandGPT · Based in: DeutschlandGPT GmbH, Gabriele-Münter-Straße 3, 82110 Germering, Germany
- Gemini Notebook · Based in: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
All tools in AI assistants & search · Tools with an EU hosting option
Further reading
All tools in the category: AI assistants & search. Figures across all tools: Data report.