xAI offers Grok models via its API for text generation, reasoning, coding, tool use, document-centric workflows, and agentic research. The current docs focus primarily on Grok 4.20 as the new flagship, as well as on server-side tools such as Web Search, X Search, Code Execution, and Collections Search.
Additionally, xAI documents classic model-listing endpoints such as /v1/models and /v1/language-models.
xAI API – Grok
LLM “Build with Grok, the AI model designed to deliver truthful, insightful answers.”
Location: USA ⓘ X.AI LLC, 1450 Page Mill Road, Palo Alto, CA 94304, USA
Server-side Tools Additional billing for tool invocations; costs may increase with the complexity of agentic requests.
Credits / API Key API usage takes place via an xAI account, API key, and purchased credits.
Enterprise / ZDR Enterprise customers can use Zero Data Retention so that API requests and responses are not stored.
Voice / Imagine / Batch / Tools Additional product areas for real-time conversations, TTS/STT, image/video generation, batch processing, web search, and structured outputs.
Target audience
The xAI Grok API is aimed primarily at developers, technical teams, start-ups, agencies, and companies that want to build their own LLM-powered applications. It is especially interesting for teams that want to combine research, coding, agent workflows, and tool orchestration, because xAI strongly emphasizes exactly these patterns in the docs. For pure end users without a build context, the API is far less obvious than Grok Web/App.
Outstanding features
The most striking differentiators are the server-side research and agent tools. xAI documents Web Search, X Search, Code Execution, and Collections Search as integrated tools for Grok. In addition, there is Grok 4.20 with a large context window, automatic reasoning, and strict prompt adherence, as well as Grok 4.20 Multi-agent for multi-agent research. For Enterprise, DPA, subprocessor transparency, retention rules, billing/usage controls, and Provisioned Throughput are also relevant.
Key application areas
Grok is particularly strong for up-to-date research, technical analysis, coding, agent workflows, RAG/document search, and interactive assistance systems. The docs repeatedly show exactly these usage patterns: current web/X search, coding in code editors, multi-stage research with Multi-agent, and document work via Collections/Search. As a result, xAI feels less like a pure standard text model and more like an API for tool-supported workflows.
Usage & notes
Operationally, you start with an xAI account, API key, and credits. The docs currently recommend examples mostly with grok-4.20-reasoning. Important here: Grok 4 is a reasoning model; according to the docs, there is no separate non-reasoning mode for it. In addition, Grok-4 reasoning models do not support certain older parameters such as stop, presencePenalty, and frequencyPenalty. For Multi-agent, reasoning.effort has a different meaning: it controls the number of agents, not the depth of thought. For Enterprise use, you should also clearly distinguish between the general Privacy Policy and the Enterprise Terms/DPA.
| Target audience | Assessment |
|---|---|
| Developers / product teams | Very suitable – for Grok-based chat, reasoning, tool, web/X search, voice, image, and video applications. |
| SaaS providers / startups | Suitable – if current information, Grok models, and multimodal API functions are relevant. |
| Creator and social-adjacent products | Suitable to very suitable – especially for applications with real-time/X relevance, content, research, and conversation. |
| SMEs with technical implementation | Suitable – for assistants, search, support, research, automation, and multimodal AI functions. |
| Enterprise / compliance teams | Conditionally to well suited – xAI offers a DPA, a no-training statement for API data, and ZDR for Enterprise, but EU data residency is not publicly documented as a standard. |
Calculate tokens and costs with the KIFOX Tokenizer
grok-4.20-reasoning
Best suited for:
Demanding default choice for current xAI apps: reasoning, tool-supported research, web/X search, coding, document analysis, structured responses.
grok-4.20-multi-agent
Best suited for:
Deep research, multi-perspective analyses, complex topics with multiple sources, agentic deep-research workflows.
grok-4 / grok-4-latest / grok-4-07079
Best suited for:
General high-end text and reasoning tasks with the Grok 4 family; useful for stable alias/version workflows.
grok-code-fast-1
Best suited for:
Coding-related workflows, editor integrations, developer assistance.
grok-3
Best suited for:
Solid older Grok generation for more general LLM workloads if you want to work with a documented older model.
grok-3-mini
Best suited for:
Lower-cost standard tasks, simple extraction/classification, low-cost workloads.
Hosting & Data
1) On-prem / local hosting
Meaning: The company operates the solution on its own hardware or within its own infrastructure. In the strictest sense, not only the application runs locally, but ideally the model as well.
2) Private cloud / data center
Meaning: The solution runs in a dedicated or more clearly separated cloud environment, often with a hosting provider or hyperscaler, but in a German data center or in a particularly controlled environment.
3) EU SaaS / managed
Meaning: The provider operates the solution itself as a service. The company uses the tool as a ready-made cloud service, ideally with EU data residency.
4) Hybrid
Meaning: One part of the processing remains internal / local / in a private cloud, while another part runs in an external cloud or EU SaaS.
5) AVV / DPA
Meaning: This is the data processing agreement or Data Processing Addendum. It governs that the provider processes personal data on behalf of the customer and is bound by the customer's instructions.
6) No training
Meaning: The provider does not use your prompts, uploads, attachments, chat histories, or outputs for training or improving the general model — ideally excluded by contract.
7) Open-source / transparency path
Meaning: There is a path toward greater technical transparency and sovereignty, for example through:
- open models
- documented components
- self-hostable parts
- traceable architecture
- export / switching options
| On-prem / local hosting | ❓ |
| Private cloud / data center | ⚠️ |
| EU SaaS / Managed | ⚠️ |
| Hybrid | ⚠️ |
| DPA / AVV | ⚠️ |
| No training on customer data | ✅ |
| Open source / transparency path | ⚠️ |
On-Prem / local hosting: indirect / not available
No true on-premise or local model deployment on the customer's own infrastructure was found on the website. What is documented is primarily the use of xAI inference services; with Grok Build, tool execution and parts of the data processing take place locally, but inference still runs via the provider.
Private Cloud / data center: partial
The website mentions for Enterprise 'EU data residency options', 'Regional processing for compliance requirements', 'Multi-region infrastructure with custom SLAs' as well as dedicated Enterprise features such as ZDR. However, an explicitly dedicated private cloud or isolated EU data center deployment is not specifically described on the website.
EU SaaS / managed: partial
There are references on the website to 'EU data residency options' and 'Regional processing for compliance requirements'. However, specific EU/EEA data centers, countries, or EU data residency available by default for all API customers are not mentioned.
Hybrid: partial
For Grok Build, the website describes a mixed approach: user inputs and file contents are assembled locally, tool execution takes place locally in a sandbox, but inference is sent to the xAI service. This is a hybrid pattern, but it is not described as a formal hybrid hosting offering for the entire platform.
DPA / DPA: partial
The website refers to 'Legal Resources' with 'Data Processing Addendum' and mentions 'Data processing agreements' for the Voice APIs. However, a specifically accessible DPA text or detailed terms were not found on the reviewed domain itself.
No training: covered
The website explicitly states that xAI does not use API inputs and outputs for training without explicit permission. In addition, for Collections it is explained that user data stored there is not used for model training. For Voice APIs, it also states that audio data is processed in real time and is neither stored nor used for training.
Open source / transparency path: partial
There is some transparency path on the website: protobuf definitions can be downloaded and a repository called 'xai-proto' is mentioned; in addition, local policies, sandboxing, and client-side control for Grok Build can be configured. However, no clear open-source or self-hostable model path for the core models was found.
Data processing
According to the Security FAQ, the standard API temporarily stores requests and responses for 30 days for abuse review and deletes them afterward. For Enterprise, there is Zero Data Retention, in which prompts, responses, and metadata are processed in real time but not persisted. For Grok Build, the website describes a process in which inputs and file contents are assembled locally, inference runs via the provider, and tool execution takes place locally in a sandbox. For Voice APIs, the website additionally mentions EU data residency options and regional processing without naming specific EU/EEA locations.
Conclusion
For an EU/EEA tool directory, from the website perspective xAI API – Grok is not clearly fully GDPR-ready in the standard configuration, but can potentially be used in a more privacy-friendly way under certain conditions: in particular with an Enterprise agreement, DPA, enabled Zero Data Retention, and explicitly agreed EU data residency. Without these additional prerequisites, too many points remain open or are only stated in general terms from a European perspective, especially regarding specific server locations, subprocessors, and standard data processing.
Sources
| On-prem / local hosting | ❓ |
| Private cloud / data center | ⚠️ |
| EU SaaS / Managed | ⚠️ |
| Hybrid | ⚠️ |
| DPA / AVV | ⚠️ |
| No training on customer data | ✅ |
| Open source / transparency path | ⚠️ |
On-Prem / local hosting: indirect / not available
No true on-premise or local model deployment on the customer's own infrastructure was found on the website. What is documented is primarily the use of xAI inference services; with Grok Build, tool execution and parts of the data processing take place locally, but inference still runs via the provider.
Private Cloud / data center: partial
The website mentions for Enterprise 'EU data residency options', 'Regional processing for compliance requirements', 'Multi-region infrastructure with custom SLAs' as well as dedicated Enterprise features such as ZDR. However, an explicitly dedicated private cloud or isolated EU data center deployment is not specifically described on the website.
EU SaaS / managed: partial
There are references on the website to 'EU data residency options' and 'Regional processing for compliance requirements'. However, specific EU/EEA data centers, countries, or EU data residency available by default for all API customers are not mentioned.
Hybrid: partial
For Grok Build, the website describes a mixed approach: user inputs and file contents are assembled locally, tool execution takes place locally in a sandbox, but inference is sent to the xAI service. This is a hybrid pattern, but it is not described as a formal hybrid hosting offering for the entire platform.
DPA / DPA: partial
The website refers to 'Legal Resources' with 'Data Processing Addendum' and mentions 'Data processing agreements' for the Voice APIs. However, a specifically accessible DPA text or detailed terms were not found on the reviewed domain itself.
No training: covered
The website explicitly states that xAI does not use API inputs and outputs for training without explicit permission. In addition, for Collections it is explained that user data stored there is not used for model training. For Voice APIs, it also states that audio data is processed in real time and is neither stored nor used for training.
Open source / transparency path: partial
There is some transparency path on the website: protobuf definitions can be downloaded and a repository called 'xai-proto' is mentioned; in addition, local policies, sandboxing, and client-side control for Grok Build can be configured. However, no clear open-source or self-hostable model path for the core models was found.
Data processing
According to the Security FAQ, the standard API temporarily stores requests and responses for 30 days for abuse review and deletes them afterward. For Enterprise, there is Zero Data Retention, in which prompts, responses, and metadata are processed in real time but not persisted. For Grok Build, the website describes a process in which inputs and file contents are assembled locally, inference runs via the provider, and tool execution takes place locally in a sandbox. For Voice APIs, the website additionally mentions EU data residency options and regional processing without naming specific EU/EEA locations.
Conclusion
For an EU/EEA tool directory, from the website perspective xAI API – Grok is not clearly fully GDPR-ready in the standard configuration, but can potentially be used in a more privacy-friendly way under certain conditions: in particular with an Enterprise agreement, DPA, enabled Zero Data Retention, and explicitly agreed EU data residency. Without these additional prerequisites, too many points remain open or are only stated in general terms from a European perspective, especially regarding specific server locations, subprocessors, and standard data processing.
Sources
Strengths & weaknesses at a glance
| Strengths | Weaknesses |
|---|---|
| - Very strong in real-time research because Grok integrates web search and X search as official tools. | - The documentation is currently inconsistent between new model names like grok-4.20-reasoning and older/dated IDs like grok-4-0709; as a result, the model landscape is less clear than with some competitors. |
| - Well positioned for coding, agentic tool workflows, and document-based analysis. | - Exact token prices for some new models are referenced on the official pricing page, but in the officially parseable sources here they are not cleanly extractable for every model. |
| - xAI explicitly positions Grok 4.20 as a fast, precise model with strict prompt adherence. | - xAI itself points out that outputs may hallucinate or be inaccurate and must be reviewed by the customer. |
| - For enterprise/API data, there is a DPA, a subprocessor list, and according to the Enterprise Terms, a 30-day deletion of User Content unless an exception applies. | - For enterprise customers, operating competing services with the xAI API is prohibited according to the Terms. |
Reviews
0 reviews in total
There are no confirmed reviews for this tool yet.
Submit review
Your review will only become visible after email confirmation. This protects the portal against abuse.
Report review
Please select the reason why this review should be checked.
GDPR-compliant usage possible?
The website documents several privacy-relevant components for use in the EU/EEA region, but no consistently clear, demonstrable full GDPR compliance for standard use of the xAI API. Positive aspects include statements such as "no training without explicit permission," an Enterprise option for Zero Data Retention, references to a "Data Processing Addendum," as well as to "EU data residency options." At the same time, essential points remain unclear on the provider's website or are only indirectly evidenced: a specific server location or specific EU/EEA data centers are not named, subprocessors are not listed on the website, and a DPA/AVV is mentioned but could not be found in detail on the domain reviewed here. For GDPR-compliant use in the European region, the tool therefore appears realistic only under certain conditions, in particular with an Enterprise setup, DPA/AVV, and ideally Zero Data Retention or explicitly agreed EU data residency.
Positive
Several positive privacy signals can be found on the website: xAI states that API inputs and outputs are not used for training without explicit permission. For Enterprise accounts, there is "Zero Data Retention," meaning API requests and responses are not stored. For the Voice APIs, the website also mentions "GDPR Compliant," "Data processing agreements and EU data residency options," as well as "Regional processing for compliance requirements." SOC 2 Type 2 is also mentioned.
Negative
From an EU/EEA perspective, crucial details are missing from the website or remain vague: specific EU/EEA server locations or named data centers are not provided; subprocessors are not listed on the website; a DPA/AVV is mentioned, but its contents could not be found on the reviewed domain; according to the Security FAQ, the standard API generally stores requests and responses for 30 days unless Zero Data Retention is activated as an Enterprise feature. As a result, a simple blanket GDPR approval for all types of use is not substantiated.
Server location
Not specified on the website. There are references to "EU data residency options" and "Regional processing for compliance requirements," but no specifically named server locations or data centers in the EU/EEA.
