Grok

Bundled with X subscriptions, so it lands on devices through a consumer account rather than any procurement path.

What leaks through it

A consumer account with consumer terms, reached from a work machine. Whatever is pasted in is governed by a subscription nobody in your organisation bought.

• grok.com
• api.x.ai

Guardrails once it is inspected

Alectura intercepts only tools it has been tested against. Everything else is discovered, meaning you get the app, the devices running it and how often, but the content is never decrypted, so content rules cannot run on it yet.

Today Grok is discovered: you get the app, the devices running it and how often, without decrypting anything. The rules below are the ones that apply to it, and they run once it is onboarded for inspection.

• MaskNo secrets in inputALC-001

  Keys and tokens in the prompt are masked before it is sent.

• AlertPII in input (basic)ALC-006

  Personal data pasted into a consumer-tier session.

• AlertDenied topicsALC-004

  Project codenames, unreleased product names and competitor terms you have chosen to watch for.

Those are the ones worth spelling out for Grok. All 27 rules in the catalog apply, and you can see the full catalog.

What happens to whatever gets through

Model training

Consumer conversations may be used to train models; the setting is user-controlled on the account.

Retention

Retained per the xAI privacy policy until deleted by the user.

Data residency

US-hosted.

The vendor’s own controls

• ·Limited at the consumer tier
• ·Enterprise API terms available separately

Sources

• xAI privacy policy

Vendor terms last checked August 14, 2026, and summarised from xAI’s published documentation. Confirm against the sources above before writing policy around this page.