xAI API
From AI API data terms: training, retention and zero retention: What does each AI provider say happens to data sent to its commercial API: is it used for training, how long is it kept, and can zero retention be had?
Provider: xAI
The company offering the API, as named on its own page.
Is the xAI API HIPAA compliant?
Source: https://docs.x.ai/developers/faq/security. Read 2026-11-01. Checked by a second reader.
Offering: xAI API
The API, tier or platform the row covers, in the provider's words.
Is the xAI API HIPAA compliant?
Source: https://docs.x.ai/developers/faq/security. Read 2026-11-01. Checked by a second reader.
Trains on API data by default: No
True or false only where the text plainly says what happens to this offering's API data with no opt-in or opt-out by the customer. An opt-out with no stated default is left blank. Where pages differ: legal or privacy page first, then help or trust pages, then developer docs, with the other in conflicts.
SpaceXSI never trains on your API inputs or outputs without your explicit permission.
Source: https://docs.x.ai/developers/faq/security. Read 2026-11-01. Checked by a second reader.
Default retention: All API requests and responses are stored on our servers (encrypted at rest) for 30 days for auditing purposes in the event of suspected abuse or misuse
How long prompts and outputs are kept by default, in the provider's words. Where pages differ: legal or privacy page first, then help or trust pages, then developer docs, with the other in conflicts. A page that's only less specific isn't a conflict: the more specific statement is the value.
By default, all API requests and responses are stored on our servers (encrypted at rest) for 30 days for auditing purposes in the event of suspected abuse or misuse.
Source: https://docs.x.ai/developers/faq/security. Read 2026-11-01. Checked by a second reader.
Exceptions: ZDR disables features that depend on stored data, including the stateful Responses API, files and collections, and the batch API
The main case with different retention, in the provider's words: first a model carved out of the general promise, then a feature, then a case such as flagged content. Pages rank as for Default retention; between pages of equal rank, the one naming the models. One passage only, so others may exist.
ZDR disables important API features that depend on stored data, including the stateful Responses API, Files and Collections, and the Batch API
Source: https://docs.x.ai/developers/faq/security. Read 2026-11-01. Read once.
Zero retention offered: Yes
True only where the provider plainly offers zero data retention by that name for this offering; false only where it plainly excludes it. A similar control under another name is left blank here and described in How to get it.
No storage of prompts: ZDR ensures that API request inputs (i.e., your prompt) and outputs (i.e., the tokens generated by the LLM) are never persisted to disk.
Source: https://docs.x.ai/developers/faq/security. Read 2026-11-01. Checked by a second reader.
How to get it: Self-serve: where available, a team admin can turn it on or off directly from the xAI Console
What the provider says is needed for zero retention. Where it has no offer by that name, its nearest named control or pointer, in its own words. Where pages differ: legal or privacy page first, then help or trust pages, then developer docs, with the other in conflicts.
Self-serve: Where available, a team admin can turn it on or off directly from the xAI Console.
Source: https://docs.x.ai/developers/faq/security. Read 2026-11-01. Checked by a second reader.
BAA available: Not found
True where the provider says it signs or offers a HIPAA Business Associate Agreement, or sets terms for use under one, for this offering. A general cloud BAA that the page doesn't tie to this offering, or an invitation to ask, is left blank.
No source we could use stated this. A blank never means no.
Data location: The default endpoint does not guarantee a processing region. To keep retained request data in the United States, use the US regional endpoint
Where the provider states data is processed or stored, in its words. Where pages differ: legal or privacy page first, then help or trust pages, then developer docs, with the other in conflicts.
The default endpoint, https://api.x.ai, does not guarantee a processing region. To keep API request handling, model inference, moderation, and retained request data in the United States, use the US regional endpoint, https://us.api.x.ai/v1.
Source: https://docs.x.ai/developers/faq/security. Read 2026-11-01. Checked by a second reader.