Is DeepSeek Safe? It Depends Which DeepSeek You Use

"Is DeepSeek safe?" has a short answer and a useful one.

The short answer is that the model is fine for a lot of everyday work, and the official app is where the risk sits. DeepSeek's own privacy policy says it stores what you type in the People's Republic of China, uses it to train its models unless you switch that off, and keeps it for as long as you have an account.

The useful answer starts with something most coverage skips. "DeepSeek" is three different products: the app and website, the API that other apps plug into, and the open model files anyone can download and run. Each one sends your words somewhere different. And one thing doesn't change between them. When I ran DeepSeek V4.1 Flash on a US company's servers, nowhere near DeepSeek, it still refused to say what happened in Tiananmen Square in 1989.

This is written for a freelancer or a small business deciding whether client work can go into DeepSeek. On 18 October 2026 I read DeepSeek's privacy policy (last updated 10 February 2026), its terms of use (27 March 2026) and its API terms (in force since 29 April 2026). I also read the US defence law that restricts it, the orders and reports of regulators in Italy, South Korea, Germany, Australia, Taiwan and the Czech Republic, NIST's evaluation of its models, and the data pages of Fireworks AI, one of the companies that runs DeepSeek's model outside China.

The Short Answer

Question	Answer
Is the DeepSeek app safe for client work?	Not for anything confidential or personal. It stores your chats in China, trains on them unless you opt out, and keeps them while your account exists
Is DeepSeek Chinese?	Yes. It's made by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., and its terms are governed by mainland Chinese law
Is DeepSeek banned in the US?	Not for the public or private businesses. A 2025 law bars it from Defense Department systems and contract work, and several states ban it on government devices
Can I stop it training on my chats?	Yes. Turn off "Improve the model for everyone"
Is it safer through another app?	Only if that app runs the model itself. Apps built on DeepSeek's API still send your text to DeepSeek
Does it censor answers?	Yes, on some topics. The refusals are in the model, so they come with it to any host
Is the app safe to download?	Get it only through deepseek.com. Researchers found security flaws in the iPhone app in 2025, and no re-test has been published

"DeepSeek" Is Three Products With Three Data Deals

Most of the confusion about DeepSeek's safety comes from treating it as one thing. Here's what happens to your text in each case.

	DeepSeek app and website	Apps that use DeepSeek's API	DeepSeek's open model, run by another company
Who receives your text	DeepSeek	DeepSeek, and the app you're using	The company running the model
Where DeepSeek says it's kept	In the People's Republic of China	The API terms don't say	DeepSeek never gets it
Used to train DeepSeek's models	Yes, unless you switch it off	The API terms don't say	No
How long DeepSeek keeps it	As long as you have an account	The API terms don't say	DeepSeek never gets it
Law in DeepSeek's terms	Mainland Chinese law	Mainland Chinese law	The host's own terms
The model's refusals	Yes	Yes	Yes

The app and website are covered by DeepSeek's privacy policy, which the next section goes through.

The API is the version developers build on. If a chatbot, a writing tool or a browser extension says it's "powered by DeepSeek" and calls DeepSeek's API, every message you type passes through to DeepSeek. DeepSeek's privacy policy doesn't cover you in that case. It says the rules for people using apps built on its API "are not covered by this privacy policy", and the API terms make the app developer responsible for telling you what happens to your data. So you're relying on that developer's privacy page, while your text still goes to DeepSeek. The API terms, which took effect on 29 April 2026, don't say where API traffic is processed or whether it's used for training, either way.

The open model is the part that makes DeepSeek different from ChatGPT or Claude. DeepSeek's page on how it trains its models says it releases "all model weights, parameters, and inference tool code" under the MIT licence. DeepSeek V4.1 Flash, released on 10 September, is on Hugging Face under that licence, and so is the update DeepSeek put into its own app and website on 17 October. Any company with the hardware can run it, and when it does, DeepSeek isn't involved at all. Your text goes to that company and is handled under its terms.

So "which DeepSeek?" is the first question to ask of any app that offers it. If the app's privacy page or sub-processor list names DeepSeek or Hangzhou DeepSeek, it uses the API. If it names a hosting company or a cloud provider instead, it runs the model itself.

What DeepSeek's Privacy Policy Says

DeepSeek's privacy policy, last updated on 10 February 2026, applies to its apps, website and related services. It's shorter and plainer than most, and five parts of it matter for work.

What it collects. Your account details, and then "your text input, voice input, prompt, uploaded files, photos, feedback, chat history, or other content that you provide." Automatically, it adds your device model, operating system, IP address, device identifiers and system language, crash reports, a log of the features you use, and your approximate location from your IP address. If you've read that DeepSeek records keystroke patterns, that isn't in the current policy.

Where it's stored. "To provide you with our services, we directly collect, process and store your Personal Data in People's Republic of China." The company itself is Hangzhou DeepSeek Artificial Intelligence Co., Ltd., and its terms of use are governed by "the laws of the People's Republic of China in the mainland", with disputes going to a court where the company is registered.

Training. The policy lists training as a purpose: "to train and improve our technology, such as our machine learning models and algorithms." It also lists entities in DeepSeek's corporate group that process your data for "foundation model training and optimization", among other things. DeepSeek's page on its training methods says the fine-tuning data comes mostly from its research team, "with a small portion potentially based on user input", which it says it de-identifies first. You can opt out. The terms of use say: "you can opt out by turning off 'Improve the model for everyone'." Opting out stops the training use. It doesn't change anything else on this list.

How long it's kept. "We keep this Personal Data for as long as you have an account." Deleting the account is the way to end that, and the terms add that DeepSeek may still "retain certain data of the user as required by laws and regulations" afterwards.

Who it's shared with. Service providers, companies in DeepSeek's group, and "law enforcement agencies, public authorities, copyright holders, or other third parties" when DeepSeek believes it's necessary "to comply with applicable law, legal process or government requests". The data is stored in China, so "applicable law" means Chinese law first.

Two smaller lines are worth knowing. The policy says the service isn't meant for sensitive data such as health, religion or immigration status: "you should not provide sensitive Personal Data to the Services, whether about yourself or other individuals." And the terms warn that if you share a chat by link and someone posts that link publicly, the conversation "may be at risk of being obtained by third parties through technical means such as web crawlers."

For users in the EU, the UK and Switzerland, there's a supplement with legal bases and data rights, and DeepSeek has appointed Prighter as its representative there. Rights requests go to privacy@deepseek.com or, in the EU and UK, to rep_deepseek@prighter.com.

None of this is hidden. The question is whether that deal suits what you're about to type.

Is DeepSeek Banned in the US?

Not for you. No US law restricts private use of DeepSeek, by people or by businesses, and its app is in the US App Store. The "No DeepSeek on Government Devices Act", introduced in both houses of Congress in February 2025, is still listed as "Introduced".

What did pass is narrower, with one part that's easy to miss. The defence budget law for 2026, signed on 18 December 2025, has two DeepSeek sections. Section 1532 orders the Defense Department to remove DeepSeek from its systems and devices. It also says that "no contractor may, during the period of performance of such contractor under a contract with the Department of Defense, use covered artificial intelligence with respect to the performance of a contract with the Department." The law defines covered artificial intelligence as "any artificial intelligence, or successor artificial intelligence, developed by the Chinese company DeepSeek." That's the model, not the app, so it applies wherever the model runs. If you hold a Defense Department contract, DeepSeek is off limits for that work on any host, izzedo included, unless the department grants a waiver. Section 6604 removes the DeepSeek app from intelligence-agency systems.

States went further for their own staff. Texas banned DeepSeek on 31 January 2025 for state employees and contractors, on state devices and on "personal devices used for work". New York banned it on state government devices and networks, and Virginia's governor did the same by executive order on 11 February 2025. News reports in late 2025 counted at least 17 states with some form of government-device ban. None of them stops a private business or a member of the public.

Outside the US, governments also restricted their own devices. Italy went further.

Country	What happened	Status in October 2026
Italy	The data protection authority ordered an immediate limit on DeepSeek processing Italian users' data on 30 January 2025, noting the data is kept in China	No lifting or later decision published. The app isn't in the Italian App Store
South Korea	New downloads were suspended in February 2025. The regulator found user input had been sent to Beijing Volcano Engine, a company linked to ByteDance	Service resumed after fixes. DeepSeek has blocked that transfer since 10 April 2025
Germany	Berlin's data protection commissioner called DeepSeek's transfer of user data to China unlawful and asked Apple and Google to remove the app in June 2025	Both refused, and the commissioner's office said it would complain under the EU's Digital Services Act. The app is still in the German store
Australia	Every government entity must remove DeepSeek products, apps and web services, since February 2025	In force. Open models deployed locally on a government system, with mitigations, are exempt
Taiwan	Government agencies are barred from DeepSeek's cloud service, app and local downloads	In force. Public use isn't restricted
Czech Republic	State administration is barred from all DeepSeek products and services, since July 2025	No revocation found

Australia's exemption draws the same line this post does. DeepSeek's app and services are banned, but an open model running on the government's own systems can be allowed. The US defence law doesn't draw that line. It covers the model itself.

DeepSeek's Security Record

Two kinds of finding get mixed together here, and they matter differently to a small business. Some are about DeepSeek's service and how it handles your data. Others are about the model and how easily it can be talked into doing harm.

The service. In January 2025 the security firm Wiz found a DeepSeek database open to anyone on the internet, with "over a million lines of log streams containing chat history, secret keys, backend details". Wiz says DeepSeek "promptly secured the exposure" once told. In February 2025 NowSecure tested DeepSeek's iPhone app and found it switched off App Transport Security, the iOS protection that forces encrypted connections, and sent "some mobile app registration and device data over the Internet without encryption". It also used an outdated encryption method with a key written into the app. The unencrypted data was registration and device details, not chat text, and NowSecure tested one version of the app. I haven't found a published re-test. South Korea's regulator reported in April 2025 that DeepSeek had fixed weak access controls on a developer database, among other issues, during its review.

The model. In September 2025 NIST's AI evaluation centre, CAISI, tested three DeepSeek models from 2025 (R1, R1-0528 and V3.1) against US models from OpenAI and Anthropic. Agents built on DeepSeek's most secure model were "12 times likelier" to follow malicious instructions planted to hijack them away from the user's task. Under a common jailbreak, that model "complied with 94% of overtly malicious requests", against 8% for the US models. CAISI ran the models on its own servers from files downloaded from Hugging Face, so these findings describe the model, not DeepSeek's app.

For DeepSeek's 2026 models the evidence is thinner and mixed. CAISI's May 2026 report on DeepSeek V4 Pro covered capability and cost only. It put V4 Pro about eight months behind the US frontier, and more cost-efficient than the cheapest comparable US model on five of seven benchmarks. The AI safety group FAR.AI reported in May 2026 that V4 Pro refused every harmful request asked directly, but that low-skill attackers got past its safeguards 98 to 100% of the time through DeepSeek's own API, using a jailbreak written for the previous version. An MLCommons paper in October 2026 found V4 Pro no more likely to give unsafe answers under its attack set. Nobody has published a security test of V4.1 Flash.

Most jailbreak research is about bad actors misusing the model, which isn't your problem. The finding that is your problem is hijacking. If you let an AI agent read your email, open web pages or act in your tools, a page or an email can carry hidden instructions, and a model that follows them can send, delete or leak things on your behalf. CAISI's numbers are for 2025 models, but until someone tests V4.1, don't hand a DeepSeek agent your inbox, and keep the setting that makes it ask before it acts.

What Changes When Someone Else Runs DeepSeek, and What Doesn't

Running DeepSeek's model somewhere other than DeepSeek fixes the data question. Your text goes to the host, under the host's policy, and DeepSeek never sees it. It doesn't change the model, because the model is the same file wherever it runs.

I tested that on 18 October 2026. In izzedo chat, DeepSeek V4.1 Flash runs on Fireworks AI, a US company, and never touches DeepSeek's servers. I asked it, in three sentences, what happened in Tiananmen Square in June 1989. It answered: "I'm not able to help with that request." Then I switched the same thread to Claude Haiku 5.5 and asked again.

So the refusal is in the model, not in DeepSeek's app. A US host, a different app and no DeepSeek account made no difference.

That doesn't make DeepSeek useless for anything that mentions China. In a fresh chat I asked it for a neutral way to describe Taiwan's political status in a supplier profile for a furniture maker. It wrote a balanced paragraph. Taiwan is self-governing, with its own government and constitution, its status is disputed internationally, and the People's Republic of China claims it as a province. Then it suggested leaving sovereignty out of a supplier profile altogether. That was a fair answer.

Two prompts aren't a study, and I'm not presenting them as one. CAISI ran the proper version in 2025, on DeepSeek models it hosted itself. On a set of questions politically sensitive for the Chinese Communist Party, DeepSeek's models "echoed 4 times as many inaccurate and misleading CCP narratives as U.S. reference models did", and the report concludes that "CCP censorship is built directly into DeepSeek models." Those were the 2025 models. My Tiananmen test says V4.1 Flash still carries at least some of it.

In practice, if a task touches Chinese politics, history or territory, expect DeepSeek to refuse some of it, and check what it does write against a second model. In an app with several models, that takes one click.

What's Safe to Put Into DeepSeek

The answer depends on what you're typing and which DeepSeek you're typing it into.

What you're typing	DeepSeek app or website	DeepSeek run by a host that keeps nothing
Public information, brainstorming, a blog draft	Fine	Fine
A client's name, email, address or invoice	Keep it out	Fine, if the host's terms suit your clients
Contracts, prices, financials, unreleased plans	Keep it out	Fine, if the host's terms suit your clients
Health, religion, immigration status or other sensitive data	Keep it out. DeepSeek's own policy says not to	Think twice anywhere
Chinese politics, Taiwan, Tibet, Xinjiang, Tiananmen	Expect refusals	Expect refusals. Check with a second model

Client data and GDPR. If you work in the EU or the UK and you paste a client's personal data into the DeepSeek app, you're sending it to China. The European Commission keeps a list of countries it has found to protect personal data adequately. Japan and South Korea are on it, and so is the US under its Data Privacy Framework. China isn't. DeepSeek's policy says it uses "appropriate safeguards" for transfers "where required", but you're the one who decided to send your client's data, so the simplest rule is to keep anyone's personal details out of the app. Two European regulators have already said what they think of the transfer. Italy's ordered an immediate limit on DeepSeek's processing of Italian users' data in January 2025, and Berlin's data protection commissioner called the transfer to China "rechtswidrig", unlawful.

If you use the app anyway, four habits cut the exposure:

1. Turn off "Improve the model for everyone", so your chats aren't used for training.
2. Don't share chats by link.
3. Delete chats you don't need, and delete the account when you stop using it, since DeepSeek keeps your data for as long as the account exists.
4. Install it only from the links on deepseek.com's download page.

Where izzedo Fits

izzedo chat has DeepSeek V4.1 Flash on its free plan, in the same picker as GPT-6 Luna, Claude Haiku 5.5, Gemini 3.8 Flash and Grok 4.7. It runs on Fireworks AI, a US company whose documentation says it "does not log or store prompt or generation data for any open models." izzedo never calls DeepSeek's API, so DeepSeek doesn't receive anything you type. izzedo doesn't train models on your chats, it keeps your history in its database in the EU so you can come back to it, and you can delete it whenever you like.

What izzedo can't change is the model. DeepSeek V4.1 Flash still refuses what it refuses, as the screenshot above shows. The fix is the one in that screenshot. Switch the thread to Claude, GPT or Gemini, and the next model reads everything before it. Those three are on the free plan too, and every chat model is on the $6 Hobby plan. The current allowances are on the pricing page.

Agent mode and the 50+ connectors are on the free plan as well, and by default izzedo asks before every tool action in a chat, reads included. Given CAISI's hijacking numbers, that's the setting to keep if DeepSeek is the model doing the work.

The Bottom Line

DeepSeek the model is good, free and openly published. DeepSeek the app keeps your chats in China, trains on them unless you switch that off, and holds them for as long as your account exists. Whether that's safe depends on what you put into it, and for client work the answer is mostly no.

Running the model somewhere else takes DeepSeek out of the loop, and for most everyday work that's enough. It doesn't take out the refusals, so anything touching Chinese politics needs a second opinion from a model trained somewhere else.

And check the date on this post. DeepSeek updated its model the day before I wrote it and rewrote its privacy policy and both sets of terms between February and April, and Berlin's data protection office was still pursuing Apple and Google over the app in June.

---

Want DeepSeek without sending anything to DeepSeek, and Claude in the same thread when it won't answer? Try izzedo chat free, no credit card required.