xAI

xAI’s enterprise/API infrastructure is documented as built primarily on AWS, and current API docs explicitly show at least us-east-1 for available API clusters. The DPA states xAI may transfer and process personal data outside Europe, including the United States and other countries where xAI and its subprocessors operate. No EU-only processing option was found in the primary sources.

For enterprise/API services, xAI says User Content is automatically deleted within 30 days unless legally required to retain it or it is flagged for safety, compliance, moderation, or possible Agreement/AUP violations. The DPA also says customers can delete data and that login data, prompt/response pairs, and billing information are typically deleted within 30 days after a deletion request; upon termination xAI deletes personal data except where retention is legally required.

Enterprise Terms state xAI may use User Content to provide the services and for safety, compliance, abuse prevention, and moderation, but shall not use User Content for internal AI or other training purposes. xAI may continue to use de-identified or aggregated data and Feedback.