Is DeepSeek safe? Privacy and security risks to know before you use it

What data does DeepSeek say it collects?

DeepSeek’s privacy policy says that when users create an account, enter content, contact the company directly or otherwise use the service, DeepSeek may collect several types of personal data. These include account information, user input or uploaded content, chat history, contact-related information, device and network information, usage logs, IP address and approximate location.

For an AI chatbot, the biggest privacy issue is often not just your email address or IP address. The higher-risk data is what you type or upload: prompts, documents, snippets of code, customer details, contract text or internal business information. Because DeepSeek’s policy includes user input within the categories of data it may collect, users should not treat the chat box as a private or confidential workspace.

DeepSeek also says personal data may be used to operate, provide, develop and improve its services, and that it retains personal data for as long as necessary for the purposes set out in the policy. The safer rule is simple: if you would be worried about the information being stored, processed or exposed, do not put it into the chatbot.

Where is DeepSeek data processed and stored?

DeepSeek’s privacy policy says personal data may be directly collected, processed and stored in China. NPR has also reported that data DeepSeek collects from U.S. users is sent to servers in China under the company’s terms, and that international regulators have questioned how DeepSeek uses data.

That does not, by itself, prove the data will be misused. But data location and jurisdiction are major factors in a privacy and security risk assessment, especially for businesses, legal teams, financial services, healthcare organisations, public bodies and any organisation with strict data-protection duties.

Independent security warnings to consider

Beyond the privacy policy, several technical concerns have been reported. Krebs on Security, citing analysis by NowSecure of DeepSeek’s iOS app, said the app had disabled App Transport Security, transmitted some device data without encryption and used the outdated 3DES algorithm with a hard-coded key in the app.

Krebs also cited research by Wiz that found DeepSeek had exposed a publicly accessible database containing more than one million log lines, including chat history, API secrets and backend information. According to that report, DeepSeek fixed the issue after being notified.

These reports do not mean every use of DeepSeek is dangerous at all times. They do mean that, if the question is whether DeepSeek is suitable for sensitive or high-security workloads, the available evidence is not reassuring enough to treat it as a high-trust environment.

Is DeepSeek safer through a third-party app?

Not necessarily. DeepSeek says its privacy policy does not cover the processing of end users’ personal information when they access downstream systems or applications built by developers using DeepSeek’s open platform.

In plain English: if another app says it uses DeepSeek, your data risk depends on that app too. You need to know what the third-party provider collects, where it stores data, who it shares data with, how long it keeps data and how it secures that information. Reading only DeepSeek’s privacy policy may not be enough.

A safer-use checklist for DeepSeek

If you still want to try DeepSeek, reduce your risk with these habits:

1. Do not enter sensitive information. Avoid passwords, API keys, customer data, ID numbers, contracts, financial records, health information, legal material, trade secrets and private source code.
2. Anonymise before prompting. Replace real names, emails, phone numbers, company names, project codes and other identifiers with placeholders.
3. Do not upload internal files. Documents can contain metadata, comments, revision history or hidden information you did not intend to share.
4. Keep work and testing separate. Do not use a work email or company account unless your organisation has approved the tool.
5. Be careful with third-party integrations. If an app uses DeepSeek, review that app’s own privacy terms because DeepSeek’s policy may not directly govern downstream systems.
6. For organisations, review before deployment. At minimum, define which data may be entered, where data may be stored, who can access it, what compliance rules apply, whether usage can be audited and how incidents would be handled.

Bottom line

DeepSeek may be useful for experimenting with public or low-risk content. But for information that needs strong confidentiality, the current public evidence is not enough to treat DeepSeek as enterprise-safe for sensitive data.

The most practical approach is to keep anything sensitive out of the tool: no passwords, customer data, internal documents, trade secrets, legal, medical or financial information, and no private source code.