Security FAQ and Production Deployment Checklist

xAI Security FAQ

Before wrapping up this course with the deployment review, let’s answer the questions that come up most often in the course—the ones you’ll ask sooner or later, some with surprising answers.

How do I enable MFA on my account? MFA (Multi-Factor Authentication) is configured on accounts.x.ai, Security page. Activation provides you with a series of recovery codes: store them immediately in a secure password manager before doing anything else. The rest of this FAQ explains why this reflex is non-negotiable.

What if I lose my MFA recovery codes? This is the most surprising answer: xAI cannot remove or reset MFA without the recovery codes. There is no backup procedure via identity verification, no exceptions. The only remaining option is to contact [email protected] to request account deletion—imagine losing access to the account holding your production keys because a phone fell in water.

How do I delete my account? On accounts.x.ai/account. Deletion is not immediate: the account remains recoverable for 30 days; simply log back in to restore it. After this period, deletion is permanent. For data privacy requests, the dedicated address is privacy.x.ai.

Can I use the same account for Grok and the API? Yes: accounts are shared between grok.com and console.x.ai. However, billing is separate—API is managed on the console, while Grok subscriptions are managed on grok.com or via Apple/Google. So don’t look for your API costs in your Grok subscription, or vice versa.

How do I detect unauthorized access? The location shown in the console is an approximation based on IP: a session appearing in a nearby city isn’t necessarily suspicious. If in doubt, act in this order: reset your password, clear all active sessions, enable MFA if not already done, then check your API key usage history—this is where compromise leaves measurable traces.

Are prepaid credits refundable? No, except where required by law. And an administrative detail that costs the careless dearly: invoices cannot be regenerated retroactively with new information. So check your billing information in the console before purchase, not after.

The Production Deployment Review, Pillar by Pillar

The following summarizes everything the course covered, organized into six domains to review before every deployment—not just the first one.

The first domain is contractual and regulatory. This is the only one that doesn’t depend on your code, and the one your lawyer or DPO must be able to produce on request:

• The DPA (Data Processing Agreement) is signed with xAI
• The BAA is signed if handling health data (HIPAA)
• Your GDPR record of processing activities is updated
• A DPIA is completed if processing presents high risk
• Your privacy policy mentions xAI as a subprocessor
• Regional data residency is configured if necessary

As long as one of these pieces is missing, no technical setting will fix the situation: a missing DPA is non-compliance in itself.

Next comes API key management—statistically, this is where most preventable incidents occur. Verify no key is exposed in frontend code and all live in server environment variables or a secrets manager. Each key must have restrictive ACLs, no wildcards in production, a defined expiration date, and rate limits (QPS, QPM, TPM) configured. Development and production keys must be distinct, a rotation process must exist, and the .env file must be in .gitignore—this last line, trivial, is the one most often forgotten.

The third domain is architecture, meaning the path your requests actually take. All API calls must go through a backend proxy; WebSocket connections must use ephemeral tokens, with duration reduced to the minimum your use case supports; and user authentication must be verified before your server agrees to proxy anything, otherwise your endpoint becomes a free relay to the API.

The fourth domain covers the data itself. Confirm store: false is configured by default for sensitive data and systematically applied to images, that personal data is anonymized before sending when functionality allows, that a data classification policy is documented, and that application-side log retention is defined—your own logs can keep what xAI does not.

The fifth domain brings together moderation and monitoring. Input pre-moderation and output post-moderation layers must be in place, a reporting system offered to users, alerts triggered on consumption thresholds, spending limits defined in the console, and your application logs must capture metadata without ever recording sensitive content.

The sixth domain returns to the account, the entry point for everything else. MFA must be enabled on all administrator accounts, with recovery codes stored in a vault. SAML SSO must be configured if your organization supports it, teams structured by environment and project, and former employee accesses effectively revoked—verified, not assumed.

A final series of tests turns these checks into certainties: a load test with rate limits configured, a fallback test in case of API unavailability, an ephemeral token renewal test, a moderation test with edge cases, and verification that staging keys are not used in production.

The Recurring Security Review Process

A review validated on launch day expires quickly: keys age, teams change, xAI publishes new features. Security must therefore install itself in your calendar at three rhythms. Monthly, audit active API keys and their permissions, review triggered consumption alerts and check spending limits—thirty minutes suffices when regular. Quarterly, rotate API keys, review moderation policy in light of received reports, update DPIA if processing evolved, and train developers who arrived in between. Annually, finally, conduct the full DPA and BAA review, SOC 2 / HIPAA compliance audit, a penetration test including API flows, and update your repository with new xAI features. This last point guarantees your documentation lives at the same pace as the platform.

Key Takeaways

• MFA protects your account, but recovery codes are irreplaceable: without them, only account deletion remains possible
• Account deletion is reversible for 30 days, permanent afterwards
• The review covers six domains: compliance, keys, architecture, data, moderation, account—plus pre-deployment tests
• Schedule security reviews monthly, quarterly, and annually
• Security is a continuous process, not a state: update your repository with every platform evolution

Test Your Knowledge

Certifications, data, keys: xAI security before deployment.

1. What compliance guarantees does xAI offer?

Answer: SOC 2 Type II, HIPAA options, GDPR with regional data residency—and the commitment that your API data is not used for model training.

2. How do you protect the API key in an application?

Answer: Never client-side: the key lives on the server; real-time in the browser goes through ephemeral tokens—short, limited, revocable.

3. What do ACLs on keys allow?

Answer: Least privilege: restrict each key to necessary endpoints and models—a compromised key exposes only its perimeter.

4. What does store:false resolve?

Answer: Non-persistence of sensitive data on the API side: content is not stored—the setting for applications handling confidential data.

5. What does the deployment checklist cover?

Answer: Protected and rotated keys, ACLs set, moderation and usage policy active, audit logs monitored, sensitive data framed—compliance as a verifiable list.

Certifications upstream, keys secured, data mastered, continuous audit: security is a system—the course checklist is the contract.