Is DeepSeek Safe? A Practical Guide to DeepSeek Safety in 2026

Can you use DeepSeek without handing sensitive data to a service governed by Chinese law, without triggering a compliance incident at work, and without relying on a model that researchers have jailbroken more easily than its US rivals? That is the real deepseek safety question, and the honest answer is: it depends on which surface you use, what you feed it, and what your regulator says. The web app and the hosted API are not the same risk profile as running the open weights on your own hardware. Italy’s data-protection authority ordered a limitation on DeepSeek’s processing of Italian users’ data in January 2025, governments from Australia to the Czech Republic have barred it from official systems, and a US Department of Homeland Security order published on 20 October 2026 removes it from federal civilian agency IT. Published security research has also documented weaknesses in the apps and in earlier models. This guide lays out what the cited sources actually say, with dates, and how to make a sensible call.

Short answer: is DeepSeek safe to use?

There are three DeepSeek surfaces, and they carry different risks. The web chat and mobile app send your prompts to DeepSeek, whose Privacy Policy (last updated 10 February 2026) says it collects, processes and stores personal data in the People’s Republic of China. The hosted API (api.deepseek.com) is operated by the same company. The open-weight models — the current DeepSeek-V4.1-Flash-1017 and DeepSeek-V4-Pro-0813, both MIT-licensed on Hugging Face, and earlier releases such as R1 — can be run on your own hardware or with a provider you choose, and when you do that the cross-border data-flow concern disappears, though weaknesses that come from the model’s training do not.

For personal, non-sensitive use, the hosted DeepSeek carries the familiar risks of a free foreign chatbot, plus the China data-storage question. For regulated data (health, legal, financial, government, or anything covered by GDPR), the hosted service is a poor fit — authorities in Italy, Germany and the Czech Republic have acted against it (details below). The rest of this article explains why, with sources.

Where your data goes

DeepSeek’s privacy position is unusually candid about where data lives. Its Privacy Policy, last updated 10 February 2026, says personal data may be stored on a server outside the country where you live and that DeepSeek “directly collect[s], process[es] and store[s]” personal data in the People’s Republic of China. The policy’s supplemental clause for the EEA, Switzerland and the UK repeats the same data-storage statement.

The data itself is broad. According to the policy, DeepSeek collects account details (date of birth where applicable, username, email address and/or phone number, password), your text and voice input, prompts, uploaded files, photos, feedback and chat history, plus device model, operating system, IP address, device identifiers, system language, crash reports and logs of the features you use, and approximate location derived from your IP address. Entities in DeepSeek’s corporate group process this data for functions that include storage, security and foundation-model training, and the policy allows sharing with law enforcement and public authorities to comply with applicable law, legal process or government requests. The policy also says the services are not designed to process sensitive personal data and asks users not to provide it.

Chinese law is the core legal issue

China’s 2017 National Intelligence Law is the provision most often cited. Proton, in an assessment published on 31 January 2025, describes it as “a statute that compels all Chinese companies to assist the government with national security matters”, and argues that Western companies, by contrast, can challenge government data requests in independent courts or refuse requests that violate laws like GDPR. Czech cybersecurity officials made a similar point in July 2025: “In the context of the legal environment of the People’s Republic of China, which allows state authorities access to this data, there is a completely justified reason for concern,” NÚKIB director Lukáš Kintr said, as Radio Prague International reported on 10 July 2025. Western AI companies face government data requests too; the difference these sources point to is legal recourse.

Countries that have restricted DeepSeek

The regulatory response has been fast and broad. Here is the picture from the regulators’ notices and dated news reports cited below, as of 24 October 2026.

Sources: Garante press release, 30 Jan 2025; Federal Register 2026-21447, 20 Oct 2026; Gottheimer and LaHood release, 3 Mar 2025; Bloomberg via Gulf News, 4 Feb 2025; Reuters via NBC News, 17 Feb 2025 and Reuters, 28 Apr 2025; Radio Free Asia, 2 Feb 2025; Berlin Commissioner for Data Protection, 27 Jun 2025; Radio Prague International, 10 Jul 2025.

The Italian action is the most consequential one for EU users. On 30 January 2025, the Garante ordered, as a matter of urgency and with immediate effect, a limitation on the processing of Italian users’ data by Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence. The companies had told the regulator that they did not operate in Italy and that European law did not apply to them, a reply the Garante called entirely unsatisfactory. The order itself notes that, according to the privacy policy, data collected for the DeepSeek service is stored in the People’s Republic of China, “in violation of the safeguards provided for by the Regulation, in particular Article 32 on security of processing”. It also records that the companies said they had removed the app from Italian app stores, and that on 30 January 2025 the app was no longer available in Apple’s and Google’s stores there while the website remained reachable. On 24 October 2026, Apple’s Italian App Store still returned no listing for DeepSeek’s official app.

Germany’s case turned on the same transfer question: on 27 June 2025 the Berlin Commissioner called the transfer of user data to China unlawful, noting that the EU has issued no adequacy decision for China. At EU level, the European Data Protection Board announced on 12 February 2025 that it was extending its ChatGPT task force to AI enforcement generally and setting up a quick response team to coordinate national authorities on urgent matters.

Security findings researchers have published

Separately from privacy law, security firms and a US government evaluator have published their own tests of DeepSeek’s apps and models. The findings below are theirs, dated, and mostly concern early-2025 versions; they are not results from this site.

Mobile app weaknesses

• Unencrypted transmission and weak crypto. NowSecure’s analysis of the iOS app, published 6 February 2025, reported registration and device data sent over the internet without encryption, Apple’s built-in transport protection disabled globally for the app, outdated 3DES encryption with a hardcoded key, and username, password and encryption keys stored insecurely.
• Third-party data flow. The same NowSecure report found app data being sent to Volcengine, a ByteDance cloud platform, which NowSecure says raises concerns over government access and compliance risks.
• Exposed database. On 29 January 2025, Wiz Research reported a publicly accessible ClickHouse database belonging to DeepSeek with over a million lines of log streams containing chat history, secret keys and backend details. Wiz says DeepSeek promptly secured the exposure after it was disclosed.

Model-level weaknesses

On the models themselves, the jailbreak picture is the most concerning. Palo Alto Networks Unit 42 reported on 30 January 2025 that three techniques — Bad Likert Judge, Crescendo and Deceptive Delight — achieved significant bypass rates against a distilled DeepSeek model, eliciting guidance for data-exfiltration tools, keyloggers and incendiary devices, with SQL injection and lateral movement among the malicious activities discussed. KELA reported on 27 January 2025 that DeepSeek-R1 could be jailbroken with methods publicly disclosed more than two years earlier, including the “Evil Jailbreak” that KELA says has been patched in GPT-4 and GPT-4o.

The most systematic comparison so far is the US Center for AI Standards and Innovation (CAISI) at NIST. Its evaluation, released 30 September 2025, covered DeepSeek R1, R1-0528 and V3.1 against OpenAI’s GPT-5, GPT-5-mini and gpt-oss and Anthropic’s Opus 4. CAISI reported that DeepSeek’s most secure model in that set, R1-0528, responded to 94% of overtly malicious requests when a common jailbreaking technique was used, against 8% for the US reference models, and that agents built on R1-0528 were on average 12 times more likely than the evaluated US frontier models to follow malicious instructions designed to derail them from user tasks. These weaknesses come from the model’s training, so they travel with the weights whether you use the hosted API or self-host. The cited evaluations predate the current DeepSeek-V4.1-Flash-1017 and DeepSeek-V4-Pro-0813, so check for newer red-team results before assuming they apply unchanged.

Censorship is built in

The same CAISI evaluation found that the DeepSeek models it tested echoed four times as many inaccurate and misleading Chinese Communist Party narratives as the US reference models. Because this behaviour comes from training rather than hosting, running the open weights yourself does not remove it. If you care about unrestricted output on geopolitical topics, this is a functional safety issue, not just a policy one.

DeepSeek API safety for developers

The API is a separate surface, and developers need to understand how it differs from the consumer app. As of October 2026 its two current model IDs are deepseek-flash (DeepSeek-V4.1-Flash-1017) and deepseek-v4-pro (DeepSeek-V4-Pro-0813); setup and parameters are in our DeepSeek API documentation guide. The API is stateless: it does not keep your conversation for you, so history must be resent on every call — a different behaviour from the web chat, which keeps session history. Stateless describes how context works, not whether requests are logged or retained.

From a safety standpoint, the API is run by the same company whose Privacy Policy describes collecting, processing and storing personal data in the People’s Republic of China, and that policy also covers payment data for paid open-platform services. The policy adds that it does not cover end users of applications built on DeepSeek’s open platform: the developer running such an application is the controller of that data and should disclose its own data-protection policy to users. For EU-regulated workloads, the cross-border transfer is typically the blocker — the Berlin Commissioner’s June 2025 notice turned on exactly that. If you need the model family but not the hosted service, the open weights are the way out — see how to install DeepSeek locally or run via Ollama. Note that Ollama’s deepseek-v4.1-flash and deepseek-v4-pro tags are cloud-only, so prompts sent through them leave your machine; a tag such as deepseek-r1:8b (R1-0528-Qwen3-8B, 5.2 GB) runs locally.

How DeepSeek safety compares to Western alternatives

This is worth being specific about, because “all AI has privacy risks” is true but lazy. There are real differences in the legal environment and the published evidence.

The honest read: on measured jailbreak resistance, the US models in CAISI’s evaluation have the stronger record, and at least some US vendors publish security certifications that DeepSeek does not mention. On openness, DeepSeek is stronger — you can actually run the weights. Neither DeepSeek’s Privacy Policy (10 February 2026) nor its Terms of Use (27 March 2026) mentions third-party security audits or certifications such as ISO/IEC 27001. That may change, but today it is a fair point. Anthropic’s certification list comes from its Privacy Center; check OpenAI’s and Google’s trust pages for theirs.

For more detail on how the products compare outside of safety, see DeepSeek vs ChatGPT and DeepSeek vs Claude.

How to use DeepSeek more safely

If you have decided the trade-offs are acceptable for your situation, these are the practical steps that meaningfully reduce risk.

1. Do not submit regulated data. No health records, no client names, no tax IDs, no unredacted contracts, no source code under NDA. DeepSeek’s own Privacy Policy says the services are not designed to process sensitive personal data and asks you not to provide it. This is the single most important rule.
2. Use a separate account. Register with an email you would not mind seeing leaked. If you sign in with Apple or Google, the Privacy Policy says DeepSeek may receive data such as an access token from that service.
3. Turn off model training. DeepSeek’s Terms of Use (27 March 2026) say you can opt out of having your inputs and outputs used to improve the services by turning off “Improve the model for everyone”, and the Privacy Policy lists a right to opt out of training, depending on where you live.
4. Self-host for anything sensitive. Run the Flash model (see our DeepSeek V4-Flash guide, which covers V4.1-Flash-1017) or a distilled model on hardware you control. The full current checkpoints are large — about 510 GB for V4.1-Flash-1017 and about 893 GB for V4-Pro-0813 on Hugging Face — so most people start with a small distilled model. This eliminates cross-border data flow; it does not fix censorship or jailbreak weaknesses in the weights.
5. Be cautious with the mobile app if you use the hosted service. The NowSecure findings above concern the iOS app as analysed in February 2025; keep the app updated and give it only the permissions it needs.
6. Verify the app before installing. Lookalike “DeepSeek” apps exist. On Apple’s App Store the official app’s seller is Hangzhou DeepSeek Artificial Intelligence Co., Ltd; on Google Play the developer is listed as DeepSeek. See our note on how to verify the official DeepSeek app.
7. For enterprises, consider a third-party inference provider. Some providers host DeepSeek’s open weights in other regions; that trades one set of risks for another, so check where each provider processes data and what its terms say.

When you should not use DeepSeek at all

Some situations are clear-cut. Do not use the hosted DeepSeek service if:

• You work for a government that has restricted it — including US federal civilian agencies under the October 2026 DHS order (check your department’s policy; several have restrictions).
• Your data is covered by HIPAA, GDPR special categories, PCI-DSS, FERPA, or equivalent regulated regimes, and you have no signed DPA with an approved processor.
• You are handling client-confidential legal, financial, or M&A material.
• You are in Italy and need the mobile app — Apple’s Italian App Store still had no listing for it on 24 October 2026.

For those cases, alternatives to DeepSeek or self-hosting are the honest options.

Bottom line on deepseek safety

DeepSeek is a capable open-weight model family with a genuine and well-documented privacy problem when used as a hosted service, and a separate, technical safety problem — jailbreak resistance, documented on earlier models — that follows the weights themselves. The open-source release is a real contribution; the hosted service is not appropriate for regulated workloads as of October 2026. If you want the model without the hosting risk, run it yourself, and treat censorship and jailbreakability as real engineering constraints rather than marketing footnotes.