Thanks, xiasong. To avoid any confusion - and please correct me if I am wrong:
https://learn.microsoft.com/en-us/microsoft-365/copilot/connect-to-ai-models states that SpaceXAI (Grok) is not covered by Microsoft's Data Protection Addendum (DPA = https://use365.ms/DPA ).
"When your organization chooses to use a SpaceXAI model, your organization is choosing to share your data with SpaceXAI to power Copilot Studio features. This data is processed outside all Microsoft managed environments and audit controls, therefore Microsoft's customer agreements, including the Product Terms and Data Processing Addendum don't apply."
This is wrong. As SpaceXAI, LLC has been listed in the Online Services Subprocessor List as an "Artificial Intelligence Subprocessor", it is covered by the DPA. SpaceXAI is a subprocessor (or sub-subprocessor for some MS customers) under the DPA customers hold with Microsoft.
The DPA includes - for most online services - a Data Processing Agreement as defined in Art. 28 GDPR.