xAI

Security and trust center evidence

xAI is an AI company building advanced large language models and generative AI solutions, including Grok, to accelerate human scientific

x.ai AI infrastructureLast verified 2 Nov 2026

Request the report Are you xAI?

FedRAMPVerified

CSA STARVerified

DPFExpired

xAI has 2 registry-verified rows, and 1 expired in the CertReports index, last verified 2 Nov 2026. The strongest row is FedRAMP: Agency In Process. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

xAI is listed in the FedRAMP Marketplace with a status of Agency In Process, as of 19 Sep 2026. The FedRAMP Marketplace listing names Schellman Compliance, LLC as the assessor for xAI's in-process authorization, as of 19 Sep 2026. xAI is listed in the CSA STAR registry with a STAR Level 1 self-assessment (CAIQ), issued 19 Jan 2026, as of 17 Sep 2026. The CSA STAR Level 1 listing for xAI is a self-assessment rather than a third-party certification, as of 17 Sep 2026. xAI's EU-US Data Privacy Framework record shows Inactive status, as of 17 Sep 2026.

FedRAMP: Agency In Process, assessor Schellman Compliance, LLC, no authorization date listed, as of 19 Sep 2026.
CSA STAR Level 1 self-assessment (CAIQ), issued 19 Jan 2026, as of 17 Sep 2026; self-assessed, not third-party certified.
EU-US Data Privacy Framework: Inactive, no issue date listed, as of 17 Sep 2026.

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 19 Sep 2026; it is regenerated whenever a row changes.

Among ai infrastructure vendors

2verified rows

Category median 1, across 35 indexed ai infrastructure vendors. xAI has more verified rows than 89 percent of them.

conversational aigenerative aillmscientific discovery

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for HIPAA, SOC 2, GDPR, PCI DSS, ISO 27001, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Legal artefacts

No DPA, BAA or subprocessor list has been captured from a public page yet. Registry rows above do not depend on this. Check the vendor trust centre.

Subprocessors

No subprocessor list captured yet.

Change history

18 Sep 2026First indexed by CertReports3 evidence rows across 3 frameworks entered the index.

Similar vendors with evidence

Related by product tags and the AI infrastructure category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.