Is DeepSeek Safe? The App, the API and the Open Weights You Run Locally

Is DeepSeek safe? The app and API are not safe for confidential or personal data: DeepSeek's privacy policy says it collects, processes and stores personal data in China, and data protection authorities in Italy and Berlin have acted against the service. The open-weight models are different. Run offline from verified files, they send nothing to DeepSeek, but a US government evaluation found earlier versions far easier to jailbreak than US models, so test them first.

The question usually mixes three things. One is DeepSeek’s chatbot, on the web and in its iOS and Android apps. Another is the API that developers call from their own software. The third is the family of open-weight models DeepSeek publishes on Hugging Face, currently under the MIT licence, which anyone can download and run without DeepSeek being involved at all. The data risk sits almost entirely in the first two; the third turns the question into one about provenance and model behaviour.

Facts were checked on 14 October 2026 against DeepSeek’s privacy policy and platform terms, the official model cards, government and regulator pages, and the evaluations published by the US Center for AI Standards and Innovation (CAISI). Teams planning a production deployment should also read our DeepSeek provenance and GPU sizing review.

Three things called DeepSeek

The third row catches people out. In Ollama’s library, deepseek-v4.1-flash is offered only as a :cloud tag that runs on Ollama’s servers, and deepseek-v4-pro is also listed as a cloud model, so pulling either does not keep your prompts on your machine. Ollama says it does not use cloud prompts and responses to train models, but its cloud documentation does not say where those servers are. Setting OLLAMA_NO_CLOUD=1 before starting Ollama switches it to local-only mode.

Is DeepSeek safe to use? The app and website

DeepSeek’s privacy policy is direct about the main point: to provide its services, the company collects, processes and stores personal data in the People’s Republic of China. That covers the text and voice input, prompts, uploaded files, photos and chat history you submit, along with device model, operating system, IP address and an approximate location derived from it. Other terms worth knowing:

• Training. Inputs may be used to train and improve DeepSeek’s models. The policy lists a right to opt out of that use but does not name a setting for it.
• Retention. Data is kept for as long as you have an account, and longer where legal obligations, rule violations or legitimate interests require.
• Disclosure. DeepSeek may share data to comply with applicable law, legal process or government requests.
• Who is responsible. The service is operated by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., which names Prighter Group as its privacy representative in the EU and UK.

The security record adds a caution. In January 2025, Wiz Research reported finding a DeepSeek database open to the internet without any authentication, holding more than a million lines of logs that included chat history and secret keys; DeepSeek secured it promptly once told.

For personal questions about public topics, using the app is a choice you can make knowing where the data goes. For work documents, client details or anything about other people, it is the wrong tool, and if staff are already using it at work, that is shadow AI to bring under policy rather than ignore.

What regulators and governments have done

Listed here are only the actions we could confirm on an official government or regulator page, as of 14 October 2026:

• Italy, 30 January 2025. The Garante, Italy’s data protection authority, ordered with immediate effect a limitation on the processing of Italian users’ data by the two Chinese companies behind the chatbot, and opened an investigation, after they replied that they do not operate in Italy and that European law does not apply to them.
• Australia, 4 February 2025. Protective Security Policy Framework Direction 001-2025 requires Australian Government entities to prevent the use or installation of DeepSeek products, applications and web services and to remove existing instances from government systems and devices.
• New York State, 10 February 2025. The Governor banned downloading DeepSeek on government devices and networks managed by the state’s IT agency, citing data harvesting and links to foreign government surveillance and censorship.
• Berlin, 27 June 2025. The Berlin Commissioner for Data Protection reported the DeepSeek apps to Apple and Google as illegal content under Article 16 of the Digital Services Act, finding the transfer of German users’ data to China unlawful under Article 46(1) GDPR after DeepSeek did not comply with a request in May.
• Czech Republic, 10 July 2025. The national cyber security agency NÚKIB warned operators covered by the Cyber Security Act against DeepSeek products, applications, websites and APIs, and a government resolution told ministries and central authorities to make sure they are not used. The warning excludes open-source DeepSeek models deployed locally with no capability to communicate with DeepSeek’s servers.
• United States, FY2026 defence act. The Congressional Research Service summarises section 1532 of the National Defense Authorization Act for Fiscal Year 2026 (Public Law 119-60) as prohibiting the Department of Defense from using or acquiring covered AI systems, including those from DeepSeek and its parent High Flyer, with case-by-case waivers for research, training and evaluation. Section 6604 has the Director of National Intelligence require DeepSeek’s removal from intelligence community systems.

Is DeepSeek safe to use in the USA, India or Canada?

Your location does not change where the data goes: the app and API send it to DeepSeek and it is stored in China, whether you type in Ohio, Pune or Toronto. What changes is the rulebook. The restrictions we could confirm apply to government devices and systems, defence work or regulated operators; Italy and Berlin are the exceptions that targeted the service itself. We found no official government page for restrictions in India or Canada, so none is listed. Private use is a personal decision; work use should follow your employer’s AI policy.

Is the DeepSeek API safer than the app?

No. The API is run by the same company, and its Open Platform terms, released on 22 April 2026 and effective from 29 April, are governed by the laws of mainland China. The version we read sets no retention period, does not say whether DeepSeek trains on API inputs, and mentions no data processing agreement. It does say that where illegal activity is suspected, relevant records will be retained and reported to the competent authorities. Developers who put the API behind their own product are also responsible for explaining to their end users how their data is processed.

For a prototype built on public or synthetic data, the API is usable. For customer records, personal data or anything confidential, treat it exactly like the app.

Is DeepSeek safe to run locally?

For the data, it can be. A checkpoint is a set of weight files plus configuration; on a machine with no outbound connection it has nothing to send and nowhere to send it. The Czech warning draws the same line by excluding local deployments that cannot reach DeepSeek, and the data transfer objections raised against the app do not reach weights in your own data centre. The licence is simple too: the four V4-family checkpoints DeepSeek published between July and September 2026 are tagged MIT on Hugging Face, and the card for DeepSeek-V4.1-Flash, published on 10 September 2026, states that both the repository and the weights are licensed under MIT.

What running locally does not remove:

• Model behaviour. CAISI’s evaluation published on 30 September 2025 compared DeepSeek R1, R1-0528 and V3.1 with US models including GPT-5 and Claude Opus 4. Agents built on R1-0528 were 12 times more likely to follow malicious instructions that pulled them away from the user’s task; under a common jailbreak, R1-0528 answered 94% of overtly malicious requests, against 8% for the US reference models; and the DeepSeek models echoed inaccurate and misleading CCP narratives four times as often. CAISI’s May 2026 report on DeepSeek V4 Pro covers capability and cost and publishes no safety results: it placed V4 about eight months behind the US frontier and found DeepSeek’s self-reported scores higher than CAISI’s own.
• Which model you actually have. In Ollama, most deepseek-r1 tags are smaller models distilled from R1’s reasoning data onto other bases: 1.5b, 7b, 14b and 32b are Qwen-based and 70b is built on Llama 3.3, and their licences follow those bases as well. Test results for the full model do not carry over to a 7B distill.
• Your sector’s rules. CRS’s summary of section 1532 of the US defence act describes no exception for local deployment of the kind the Czech warning makes. Defence suppliers need legal advice, not a network diagram.
• The software around the model. Inference engines, chat front ends and plugins have their own update channels and telemetry.

How to run DeepSeek weights safely

These steps cover a single team or a production cluster alike:

1. Download only from deepseek-ai. Quantised and GGUF conversions by other publishers are separate builds with their own supply chain, however popular they are. Review each one or leave it out.
2. Pin and verify the files. Record the commit you reviewed, download exactly that revision, and check every file against the checksums the Hub publishes:

# Download the exact revision you reviewed
hf download deepseek-ai/DeepSeek-V4-Flash-0731 --revision <commit-sha> --local-dir ./deepseek-v4-flash-0731

# Compare every local file with the Hub's checksums; prints "All checksums match." on success
hf cache verify deepseek-ai/DeepSeek-V4-Flash-0731 --revision <commit-sha> --local-dir ./deepseek-v4-flash-0731 --fail-on-missing-files

3. Load safetensors only. DeepSeek’s V4-family weights ship as .safetensors, a format that stores tensors without executable code. Treat a pickle-based .bin or .pt file in a DeepSeek download as a warning sign.
4. Read the Python before running it. DeepSeek-V4.1-Flash has no Jinja chat template; prompt formatting relies on a Python reference encoder in the repository or DeepSeek’s deepseek-recipe Rust library, and local inference needs the weight conversion code in its inference folder.
5. Cut the network at runtime. Serve from a segment with no outbound route, and stop the tooling from calling home:

export HF_HUB_OFFLINE=1            # no HTTP calls to the Hugging Face Hub; cached files only
export HF_HUB_DISABLE_TELEMETRY=1  # no usage telemetry from Hugging Face libraries
export OLLAMA_NO_CLOUD=1           # for Ollama: local models only, no cloud models or web search

6. Test the checkpoint you will serve. Re-run CAISI-style probes on the exact weights and settings: instructions planted in documents and tool output, jailbreak prompts from your acceptable-use categories, and questions on politically sensitive topics your organisation actually handles.

Our model import pipeline generalises these checks to any open-weight model, and the open-weight licensing guide covers the clauses that start to matter once weights move between legal entities. Serving the model to many users is a separate job, which our guide to running Ollama for a team covers.

Is DeepSeek safer than ChatGPT?

It depends on which DeepSeek you mean, and the two answers point in opposite directions:

• As a hosted chatbot, no. OpenAI states that it does not train on data from ChatGPT’s business plans or its API by default, and our ChatGPT guide sets out each plan’s terms. We found no DeepSeek business terms with comparable commitments: its privacy policy reserves the right to train on inputs, subject to an opt-out, and its platform terms mention no processing agreement.
• On model behaviour, the published evidence favours US models. In CAISI’s 2025 tests, R1-0528 complied with 94% of overtly malicious requests under a common jailbreak; the US reference models, which included OpenAI’s GPT-5, complied with 8%.
• For data control, local DeepSeek wins. ChatGPT cannot be run offline. DeepSeek’s weights can, and a model with no network path cannot leak a prompt to its vendor, which no hosted chatbot can promise.

So, for staff who want a chatbot, an approved business ChatGPT workspace is the safer choice. For an organisation that must keep data in-house, a DeepSeek checkpoint on its own servers can be safer for the data than either hosted service, provided it passes the behaviour tests above.

How VDF AI fits

VDF AI is the platform layer for the last row of the first table: self-hosted chat, private retrieval over company documents and governed agents, running on-premises, in a private cloud or air-gapped. The model itself is served by your own inference engine. VDF AI Router registers that deployment, or an Ollama endpoint, alongside any cloud models your policy approves, and its air-gap mode keeps routing on local models only.

That lets a security team approve DeepSeek narrowly. Role-based access control, available on every plan, decides which groups can use the agents built on it, audit logs record usage, and on-premises staff sign in with native Microsoft Entra ID single sign-on. If testing rules DeepSeek out, the same setup can serve a different open-weight family without changing the applications built on it.