Is DeepSeek Safe for Business? Where Your Company Data Goes

Is DeepSeek safe? Every manager who asks us this gets a question back first: which DeepSeek? The app on your phone, the model running on your company's own server, or the service you buy through Microsoft's cloud? All three carry the same name, and what happens to your data is completely different in each.

Any answer that skips that distinction is wrong. The person who says "it's Chinese, don't use it" and the person who says "it's open source, no problem" are making the same mistake: confusing the product with the model. In this article we will first separate what goes where, then look at the security record, the real scope of the government bans, and where a business stands under data protection law. By the end you will have a written rule set you can hand to your team.

We covered data security in tool selection at a general level in our guide to AI tools for business; this piece is devoted to the single question from that guide we get asked most.

Does DeepSeek send my data to China?

If you use the app, the website or the official API, yes. DeepSeek's privacy policy states plainly that personal data is stored on servers in the People's Republic of China. The list of collected data includes text inputs, uploaded files, IP address, device information and keystroke patterns. Inputs can be used for model training unless you switch that off.

Read the keystroke item without exaggeration. The policy's phrase is "keystroke patterns or rhythms"; that is a behavioral measurement used for bot detection and device fingerprinting, not a log of every key. Still, its presence in a chat app's policy is notable on its own. The real issue is the legal framework: China's 2017 National Intelligence Law obliges organizations to support intelligence work, and authorities can request data with no notification requirement. Where the data sits matters; who can reach it, and by what process, matters as much.

There is also a single-source claim worth flagging: that DeepSeek's API terms allow training on user data by default, whereas OpenAI, Anthropic and Google keep API data out of training by default. We saw this from one source only, so we do not state it as fact; if you plan to use the API, read the current terms yourself.

Which DeepSeek? Three ways to use it, three different answers

DeepSeek releases its models as open weights under the MIT license, which means you can download the model and run it on your own server. In that case the data goes nowhere: no telemetry, no cross-border transfer. The same model is also offered through Microsoft Azure and AWS Bedrock; there the data stays inside that cloud provider's infrastructure, an EU region can be selected, and nothing is shared with the model's maker. The app is an entirely separate product.

So the question "is DeepSeek safe" splits into three:

• App, web, official API: Data on Chinese servers, usable for training, subject to Chinese law. For company data, no.
• Open-weight model on your own server: Data never leaves. Needs hardware and a technical team; small distilled versions are reasonable, the large ones need hundreds of gigabytes of memory.
• Through Azure, AWS and similar clouds: Data in a Western cloud under an enterprise contract. The China-server problem is solved; the cross-border transfer obligation under laws like GDPR remains, because it is still a transfer.

One footnote: running the model on your own server solves the privacy problem, but the model's content filters and biases from training come with it. That is an output-reliability issue; do not confuse it with a privacy risk, keep the two apart.

Open weights do not mean an open app. The model weights are public; the chat app's server code, logging policy and infrastructure are closed, and in China.

The security record: what actually happened

DeepSeek's record from early 2025 explains by itself why the app side is not trusted. In January 2025 the security firm Wiz found a database with no authentication and no firewall: more than a million records, chat histories, API keys and backend details were exposed. In February 2025 Cisco and the University of Pennsylvania ran 50 harmful prompts against the model; it blocked none of them, a 100 percent success rate for the attackers.

One detail of the Wiz incident says more about the company's maturity: because the researchers could not find a proper vulnerability disclosure channel, they had to reach employees through LinkedIn. The database was closed quickly after notification. Enkrypt AI's testing found the model 11 times more susceptible to jailbreaks than other frontier models.

All of these incidents belong to the product's app and infrastructure side; none concern the open-weight model running on your own server. But when deciding whether to use a company's product, the fact that it left a database open on the internet is a reasonable data point.

Is DeepSeek banned?

In no Western country is there a general ban for citizens. Restrictions are either limited to government devices and staff, or take the form of app-store removals. The picture is narrower than the headlines suggest:

• Italy: The data protection authority blocked the app in January 2025, citing insufficient information about how personal data is used.
• Europe more broadly: Inquiries in 13 jurisdictions; the European Data Protection Board set up an enforcement task force.
• South Korea: App-store downloads suspended in February 2025.
• Australia, Taiwan, India: Banned on government devices and for official use by public employees.
• United States: Multiple federal agencies and states banned it on government devices; no consumer ban. The headline "the US banned DeepSeek" is misleading.
• Turkey, as one example of a market with no action: As of publication we found no access block and no data-protection ruling there; the "banned" stories circulating locally are reports of restrictions elsewhere.

The lesson from this list is that "is it banned?" is the wrong question. A government banning it on its own devices is the same decision your company makes for its own data: nobody decides for you, you decide.

A fair comparison: are we safe if we use ChatGPT?

Not automatically. Free ChatGPT also uses conversations for model training by default; it can be switched off in settings, and it is off by default on business plans and the API. Under GDPR and similar laws, pasting personal data into ChatGPT is also a cross-border transfer to a country without a blanket adequacy decision in many regimes. The issue is that an input containing personal data reaches a server abroad; where the company is headquartered comes second.

The difference shows up in the law and the track record around the data collection. In the US there are court processes and transparency reports; in China the intelligence law provides for access without notification. On the security ledger, the Wiz leak and the 100 percent jailbreak sit against DeepSeek's name. Rather than "Western tools are flawless, Chinese tools are dangerous," the more accurate sentence is: any free chat tool can use your data; the difference is who can access it, under which law, and how transparently.

We wrote the same distinction for Claude by account type: the gap between a consumer plan and a business plan matters more than which company made the product. The logic holds for other Chinese-origin open-weight models such as Qwen, Kimi and MiniMax: run the weights on your own infrastructure and no data leaves; use their apps and it does. For agent products offered only as a cloud service, Manus for example, the "download the weights" escape route does not exist.

An employee pasted the customer list into DeepSeek. Now what?

Under GDPR-style rules this counts as a cross-border transfer of personal data without appropriate safeguards. Most such regimes work in tiers: countries with an adequacy decision, then appropriate safeguards such as standard contractual clauses, then narrow exceptions. China has no adequacy decision under any of them; the pasted list had no standard clauses either. A breach notification may be required and administrative fines are on the table.

This article is not legal advice on article numbers or deadlines; take a concrete incident to your lawyer. But preventing the incident is a policy job and needs no lawyer at all; that part follows.

From the field: a four-person accounting practice

A four-person accounting firm. A junior staffer, trying to speed up a trial-balance review, pastes a client company's balance sheet lines into the free DeepSeek app, company name and tax ID included. Good intentions; the result is a data protection breach and a breach of the confidentiality clause in the client contract.

The setup the firm adopted a week later: for public information (a general regulation question, a draft article) any free tool is allowed, with training switched off. For any work involving client data, one approved tool: an enterprise-contracted service, or anonymized data. A one-page written rule, a one-hour team conversation, and no logging into company accounts on personal phones. Cost close to zero; a repeat close to impossible.

Frequently asked questions

Isn't it safe because it's open source?

Open weights do not mean a safe application. The weights are open; the chat app's server side is closed and in China. The exposed database Wiz found lived on exactly that closed side.

If I run the model on my own server, is everything solved?

The privacy part, yes. Built-in censorship and bias remain, and hardware plus maintenance costs are added. For a small business the realistic option is the small distilled versions.

Is using DeepSeek through Azure or AWS compliant?

It solves the China-server problem, not the cross-border transfer obligation. Standard contractual clauses and any required regulator filing still apply. Choosing an EU region helps; it does not zero out the obligation.

Should we avoid DeepSeek entirely?

No need to be that sharp. For work on public information (a general question, a blog draft, a code snippet) the free app is reasonable, and strong at some tasks. Classify instead of banning: make clear what may be entered and leave the rest free. A tool that is banned outright gets used in secret; a tool with a clear boundary gets used openly.

My team is already using it. What do I do retroactively?

No panic, an inventory. List roughly who entered what kind of data into which tool. Where personal data went in, delete the chat history in those accounts and switch off training; then publish the policy. Whether a single incident needs a breach notification depends on the nature of the data; your lawyer decides.

Same for Qwen, Kimi and the others?

Yes, the same distinction: if it publishes open weights, you can run it on your own infrastructure; if it is only an app or API, the data goes to the provider's server and that country's law governs.

What not to do

• Do not write a one-line policy saying "Chinese tools are banned"; the team will paste the same data into ChatGPT and the problem simply moves.
• Do not read the "open source" label as a security approval; the weights are open, the app is closed.
• Do not make self-hosting the first option at small-business scale; the maintenance load exceeds most teams, an enterprise cloud service is more realistic.
• Do not write the policy and file it in a drawer; no written rule gets followed without a one-hour conversation.

So what should you do?

• Split data in two: public information and company data. Free Chinese-origin apps are allowed only in the first category; we suggested the same classification for source-citing research tools in our Perplexity guide.
• Switch off "use for training" in every tool; DeepSeek, ChatGPT, all of them.
• Define one approved route for company data: an enterprise-contracted service, or an open-weight model on your own server.
• Write a one-page AI usage policy, explain it to the team in an hour, and add AI tools to your data processing inventory.
• No company logins on personal devices; restrict the app on company phones.

Back to the opening question: which DeepSeek? If you can answer that, you have answered the safety question too. If you would like to write that one-page rule for your team, tell us what kinds of data you work with and we will draft it together.