Sign in
← AI PulseAug 20, 2026

Policy · news · Single-source brief

xAI Details API Security and Data Retention Policies

xAI outlines its default 30-day data retention policy for API requests and responses, alongside options for Zero Data Retention (ZDR) and specific data handling for Grok Build CLI and grok.com.

By Illumora Editorial

Source · Aug 20, 2026, 3:13 PM · On Illumora · Aug 20, 2026, 3:38 PM

Media from the primary source — shown here so you can stay on Illumora.

Rewritten from one allowlisted primary — not independent enterprise reporting. Lanes →

Brief drafted by Illumora’s editorial model from the linked primary source. Ops desk reviews flagged pieces. How we write →

Read the source →xAI Docs — FAQ - API Security | SpaceXAI Docs
Save

xAI has published details regarding its API security and data retention practices, including information on Zero Data Retention (ZDR) and how customer data is handled across its services. The company states it does not train on customer API inputs or outputs without explicit permission.

By default, all API requests and responses are stored on xAI's servers, encrypted at rest, for 30 days. This retention is for auditing purposes in cases of suspected abuse or misuse, and the data is automatically deleted after this period. xAI confirms it does not use this data for training purposes.

Key Points

  • xAI does not train on customer API inputs or outputs without explicit permission.
  • Default API requests and responses are stored encrypted for 30 days for auditing, then automatically deleted.
  • Zero Data Retention (ZDR) is available for teams with stricter compliance needs, disabling data storage.
  • Enabling ZDR disables API features that rely on stored data, such as the stateful Responses API, Files and Collections, and the Batch API.
  • Team admins can enable or disable ZDR from the xAI Console, applying it to all API requests made with that team's API keys.
  • For the Grok Build CLI with ZDR enabled, no trace or code data is retained.
  • Without ZDR, Grok Build CLI users can disable code data retention via /privacy or /settings commands.
  • Chats and build sessions in Grok Build mode on grok.com and mobile apps are retained for product functionality.
  • If the "improve the model" toggle is enabled on grok.com or mobile, data from Build mode chats and sessions may be used for product and model improvements.
  • xAI is SOC 2 Type 2 compliant.

Context

According to xAI, the default 30-day data retention period is suitable for most customers. However, for organizations with stringent compliance requirements, Zero Data Retention (ZDR) offers an option to prevent data storage, though this comes with the trade-off of disabling certain API functionalities. The company also provides specific data retention controls for its Grok Build CLI and Grok Build mode on grok.com and mobile applications.

Why It Matters

These policies directly impact how developers and organizations manage sensitive data when interacting with xAI's APIs and services. Understanding the default retention, the implications of ZDR, and the specific controls for Grok Build allows builders to align their data handling practices with their compliance obligations and operational needs.

What To Do

  • Review the default 30-day data retention policy to ensure it aligns with your team's data governance requirements.
  • Evaluate whether Zero Data Retention (ZDR) is necessary for your compliance needs, noting the API features it disables.
  • If ZDR is required, team admins should enable it via the xAI Console.
  • For Grok Build CLI users, explore the /privacy and /settings commands to manage code data retention, even if ZDR is not enabled.
  • If using Grok Build mode on grok.com or mobile, check the "improve the model" toggle settings to control data usage for product and model improvements.