Is DeepSeek Safe? The 2026 Security Verdict

Is DeepSeek safe? It depends entirely on how you use it. The consumer app and website — hosted in China and subject to Chinese law — are the real risk, and the US government has ordered them removed from federal civilian systems. DeepSeek's open-weight models, downloaded and run on your own hardware, are a different story: the weights don't phone home.

TL;DR

• Verdict: Don't type anything sensitive into the DeepSeek app, website, or first-party API. Do consider the open weights self-hosted or on a Western inference host — that removes the China data-residency problem entirely.
• The freshness: On July 24, 2026, DHS signed an order removing DeepSeek from federal civilian agency systems; it hit the Federal Register on October 20, 2026.
• What researchers found: Wiz found a fully exposed DeepSeek database with chat logs and API keys in plaintext (Jan 2025). NowSecure found the iOS app shipping data unencrypted (Feb 2025).
• The escape hatch most articles miss: DeepSeek's models ship under the MIT license. Run them yourself and no data reaches DeepSeek's China-based infrastructure.
• The trade-off is real: DeepSeek is genuinely capable and cheap — which is why the safety question matters instead of being academic.

Is DeepSeek safe to use?

The honest answer: the word "DeepSeek" covers four very different things, and only two of them are risky.

There's the consumer app and website, the first-party API (api.deepseek.com), the open weights you run yourself, and the open weights run by a Western inference provider. The privacy problem lives almost entirely in the first two, because both route your data to servers in China. The last two don't.

Here's the decision at a glance.

If you remember one thing: the model is not the risk. The China-hosted service is.

How capable is DeepSeek, and why safety matters

DeepSeek is not a toy — which is exactly why the safety question deserves a real answer instead of a shrug.

On the Artificial Analysis Intelligence Index v5.0.1 (as of November 2026), DeepSeek's open models land mid-field: V4.1 Flash at 33 and V4 Pro at 23. That's below the Western frontier — Gemini 4 Carbon at 60, Claude Opus 5.5 at 59, GPT-6 Astra at 57 — but DeepSeek delivers it at a small fraction of their price.

Capable enough to be genuinely useful, cheap enough to be tempting. That combination is why so many people paste real work into it, and why where that data ends up is worth understanding.

What data does DeepSeek collect and where does it go?

If you use the app or website, a lot — and it goes to China.

DeepSeek's own privacy policy states that user data is stored and processed in the People's Republic of China. That's the structural fact underneath every government warning. It isn't proof of misuse; it's a statement about jurisdiction.

The jurisdiction matters because of China's National Intelligence Law (2017), whose Article 7 obligates Chinese organizations to support state intelligence work when asked. That's the legal structure security teams worry about: data sitting on Chinese servers can, in principle, be compelled. Treat that as a data-residency and legal-access concern — not as evidence that exfiltration has happened.

The API carries the same exposure. api.deepseek.com is the same company's infrastructure in the same country. Paying for the API instead of using the free app changes your billing relationship, not your data residency.

Self-hosting changes everything about this paragraph. The weights have no backend to call home to.

What have security researchers actually found?

Three findings stand out, and it's worth separating what was demonstrated from what was inferred.

Wiz Research (January 2025). Wiz found a DeepSeek ClickHouse database exposed to the open internet with no authentication at all. It held over a million log entries — chat history, API keys, and backend secrets — in plaintext. This is a demonstrated failure, not a theory. DeepSeek secured it after Wiz disclosed it.

NowSecure (February 2025). NowSecure analyzed the iOS app and found it sent registration and device data unencrypted, with Apple's App Transport Security disabled globally. It also used 3DES, a broken cipher, with a hardcoded key and a reused initialization vector. Some performance data went to a Volcengine endpoint — Volcengine being a ByteDance cloud platform.

Feroot Security (early 2025). Feroot reported obfuscated JavaScript on DeepSeek's login page linking to China Mobile infrastructure, with device-fingerprinting scripts. Researchers at Calgary and UC Berkeley independently confirmed the China Mobile-linked code. Note the nuance: Feroot did not observe active transfers to China Mobile during North American logins — the capability was present, the transfer wasn't caught in the act.

Separately, the US House Select Committee on the CCP's report "DeepSeek Unmasked" (April 16, 2025) found that DeepSeek covertly manipulates its outputs to align with CCP narratives — a content-integrity problem distinct from the privacy ones. That matters if you use it for anything touching politically sensitive topics.

Is DeepSeek banned?

In the US, it's banned on federal civilian government systems — not for the public.

On July 24, 2026, DHS Secretary Markwayne Mullin signed a Federal Acquisition Supply Chain Security Act order, acting on a Federal Acquisition Security Council recommendation. It requires federal civilian executive-branch agencies to exclude and remove DeepSeek products — including third-party products "developed using DeepSeek implementations." It was filed for public inspection October 19, 2026 and published in the Federal Register October 20, 2026 (FR Doc 2026-21447, Docket DHS-2026-0628).

Worth flagging honestly: the Federal Register notice itself gives no public rationale. The "why" comes from the broader government record — the House Committee report above, and the researcher findings. The order covers civilian agencies; Defense and the intelligence community are handled separately, and national-security systems are out of scope.

Internationally, this isn't new. Italy's data regulator (the Garante) moved against DeepSeek's app in 2025; South Korea suspended new downloads; Taiwan and Australia restricted it on government devices. The scope in most of these is government devices, not a blanket public ban — don't overstate it.

None of these bans restrict you, an individual, from using DeepSeek. They tell you how seriously institutions with real threat models take the hosted service.

Is it safe to self-host DeepSeek's open weights?

Yes — and this is the part almost every "is DeepSeek safe" article skips.

DeepSeek ships its current models under the MIT license. The flagship V4 Pro 0813 left preview on August 12, 2026 as MIT-licensed open weights (a 1.7-trillion-parameter model, ~893 GB), alongside the smaller V4.1 Flash 1017. You can download them from Hugging Face.

A set of model weights is a math artifact. It contains no network code, no telemetry, no callback to Beijing. When you run it on your own GPUs — or through a Western inference provider like Together, Fireworks, DeepInfra, or AWS Bedrock Marketplace — your prompts never touch DeepSeek's servers. The entire geopolitical data-residency problem evaporates.

What's left is ordinary due diligence: the same jailbreak, prompt-injection, and output-quality questions you'd ask of any model. The censorship behavior the House Committee flagged can persist in the weights themselves, so for politically sensitive use cases, test outputs regardless of where you host.

The catch is cost. V4 Pro is huge; self-hosting the flagship needs serious expert-parallel infrastructure. For most teams, a Western-hosted endpoint is the practical path to "DeepSeek without the data risk."

Is DeepSeek safe for companies and for coding?

For companies, the consumer app is a hard no. For builders, the open weights are a legitimate yes.

No regulated enterprise should paste customer data, source code, or anything proprietary into the DeepSeek app or first-party API — the data-residency exposure alone fails most compliance regimes, and if you're a federal contractor, the DHS order now creates reporting obligations.

For coding specifically, "is DeepSeek safe to use for coding" has the same split answer. The hosted service sees your code. A self-hosted or Western-hosted deployment doesn't. DeepSeek's price-to-capability ratio makes it attractive for high-volume code generation — see our comparison of DeepSeek and Claude and our roundup of the cheapest AI APIs for where it fits.

Our take

Here's the thesis, and it's a strong one: the DeepSeek safety debate is two different questions wearing one headline. The headlines blur them on purpose, because "China AI banned" is a better story than "data-residency concern has a straightforward mitigation."

Question one: should you type sensitive data into a China-hosted consumer app subject to Chinese intelligence law? No. That's the easy call, and it isn't close. You have Wiz's fully-exposed database, NowSecure's unencrypted transport, Feroot's login fingerprinting, and a privacy policy that says your data lives in China under a legal regime that can compel access. You don't need to believe in active espionage to decline that deal — the demonstrated engineering failures are reason enough, and the legal structure removes any benefit of the doubt. This is my opinion, but it's an evenhanded one: I'd say the same about any app with that security record, Chinese or not.

Question two: are the open-weight models themselves unsafe? No. And this is where the alarmist coverage falls apart. Weights don't phone home. Run V4 Pro or V4.1 Flash on your own infrastructure, or on Together or Bedrock, and the entire data-residency problem is gone. What remains is the ordinary due diligence you'd do for any model — jailbreak resistance, output quality, and in DeepSeek's case, awareness of the censorship the House Committee documented.

So the two lazy positions are both wrong. "It's Chinese, so it's malware" is lazy — it ignores that the open weights are MIT-licensed artifacts you fully control. "It's fine, just use the app" is reckless — it ignores a concrete, documented security record. The defensible position sits between them and depends on deployment, not nationality.

What the bans actually tell you is narrower than they sound. A government removing DeepSeek from federal civilian laptops is a statement about the hosted service and institutional threat models. It is not a finding that the model architecture is malicious. The DHS order targets products and services; it doesn't — and can't — make a matrix of numbers illegal to run.

Keep the demonstrated and the structural straight. Wiz's exposed database and NowSecure's broken crypto are demonstrated: they happened, they're documented, they're fixed-or-not on the record. The National Intelligence Law concern is structural: a statement about what could be compelled, not proof that anything was. Both are legitimate inputs to a decision. Conflating them is how you end up either paranoid or careless.

Concrete guidance:

• Solo dev, non-sensitive work: The app is fine for throwaway tasks. The moment real code or client data is involved, move to self-hosted or a Western-hosted endpoint.
• Regulated enterprise: Ban the app and first-party API outright. If you want DeepSeek's economics, run the open weights through a provider that keeps data in a jurisdiction you can defend to an auditor.
• Builder chasing price and quality: This is DeepSeek's sweet spot. Western-hosted open weights give you the cost advantage without the data path to China. Benchmark it against alternatives like Qwen first.

Verdict: DeepSeek is best for builders who self-host or use a Western inference provider, where it's a genuinely strong, cheap option with no meaningful privacy downside. Avoid it entirely as a consumer app or first-party API for anything you wouldn't post publicly — and if you're a federal contractor, the hosted service is now a compliance liability, not just a privacy one.

Frequently Asked Questions

Is DeepSeek safe to use?

It depends on how. The consumer app and website send your data to servers in China and have a documented security record, so avoid them for anything sensitive. The open-weight models, run on your own hardware or a Western inference provider, carry no such data risk — the weights don't transmit anything.

Is the DeepSeek app or the API the bigger privacy risk?

They carry the same core risk, because both api.deepseek.com and the consumer app route data to DeepSeek's infrastructure in China. The app adds client-side issues — NowSecure found unencrypted iOS transport, Feroot found login fingerprinting. Paying for the API changes your billing, not your data residency.

Where does DeepSeek send your data?

If you use the app, website, or first-party API, to servers in China, per DeepSeek's own privacy policy. NowSecure also observed some iOS performance data reaching a Volcengine (ByteDance) endpoint. If you self-host the open weights or use a Western inference host, your data stays in your chosen environment.

Is it safe to self-host DeepSeek's open weights?

Yes, from a data-privacy standpoint. DeepSeek's models are MIT-licensed, and weights contain no network code — nothing is sent back to DeepSeek. Normal model-safety due diligence still applies: test for jailbreaks, output quality, and the content censorship the US House Committee documented in 2025.

Is DeepSeek banned in the US?

Not for the public. A July 2026 DHS order under FASCSA requires federal civilian agencies to remove DeepSeek products and halt new purchases. Several US states restrict it on government devices. You can still use it personally, but federal contractors now face reporting obligations tied to the hosted service.

Editor's note — sources: Benchmark figures are from the Artificial Analysis Intelligence Index v5.0.1 (as of November 2026); index versions are not comparable across releases. Security findings are attributed to Wiz, NowSecure, and Feroot and carry their 2025 dates; the regulatory action is the US DHS FASCSA order published in the Federal Register on October 20, 2026. The National Intelligence Law point is a statement about legal structure, not evidence of misuse. All sources are linked inline at the claim they support.