Is DeepSeek Safe to Use? Privacy, Bans and Safer Ways to Run It in 2026

Updated November 9, 2026. Bans, policies and research checked on that date.

Is DeepSeek safe to use? For everyday, non-sensitive questions on a personal device, DeepSeek's app is about as risky as any free chatbot that keeps your chats, with one big difference: everything you type goes to servers in the People's Republic of China, under Chinese law. For work data, government devices, client files or anything you'd mind a foreign government reading, don't use DeepSeek's own app, website or API. The DeepSeek models are a separate question. Their weights are public, so you can run them on your own computer or through a host outside China, and then your prompts never reach DeepSeek at all.

That split, the company's service versus the open model, is what most "is DeepSeek safe" answers miss. Below is what DeepSeek's privacy policy says, what security researchers found, which governments have banned it (including the US order made public last month), and the safer ways to use the model.

One disclosure before we start: Cleus is our product, and it runs a modified DeepSeek model. We've kept the facts below to what independent sources and DeepSeek's own documents say.

What DeepSeek's app collects, and where it goes

DeepSeek's current privacy policy (last updated February 10, 2026) is fairly plain about it. The company says it collects, processes and stores personal data "in the People's Republic of China". What it lists:

• Everything you send: text, voice, prompts, uploaded files, photos, feedback and your chat history.
• Account details: email or phone number, password, and date of birth where it applies.
• Device and network data: device model, operating system, IP address, device identifiers, system language, crash reports and performance logs. It assigns a device ID and user ID to link your activity across devices.
• Approximate location worked out from your IP address.
• Usage logs: which features you use and what you do in the app.

Your inputs are used to "train and improve" its models. The policy gives you a right to opt out of training, but the route it describes is an email to privacy@deepseek.com, not a switch in the app. There's no fixed retention period: account and input data are kept as long as your account exists, and longer where DeepSeek needs it for legal obligations or "legitimate interests". It may share data with law enforcement and public authorities when it believes that's needed to comply with the law or government requests.

About the keystroke clause

You'll still see claims that DeepSeek records your keystrokes. The first English policy did list "keystroke patterns or rhythms" (the timing of how you type, not the keys) under technical data. The version dated February 14, 2025 dropped that line, and the current one doesn't include it. Even before the change, privacy firm Privado tested the app and did not see keystroke data being sent. So this one is outdated.

Why "stored in China" matters

China's National Intelligence Law, in force since June 28, 2017, says in Article 7 that organizations and citizens shall "support, assist, and cooperate with national intelligence efforts". Legal scholars disagree about how far that reaches in practice. Some read it narrowly, others as a broad duty. But a Chinese company has few legal grounds to refuse a request, and that is the reason regulators keep citing. The US order made public in October 2026 says sensitive information from government users "could potentially be accessible to Chinese authorities under Chinese law". Berlin's data protection commissioner made the same point in June 2025: DeepSeek had not shown that data sent to China is protected to EU standards.

This is a jurisdiction risk, not proof of misuse. Nobody has published evidence that Chinese authorities pulled DeepSeek user chats. But it's a risk you can't manage from your side, other than by not sending the data.

What security researchers actually found

Several independent teams looked at DeepSeek's apps and models in 2025, and one new issue came up in 2026.

• An open database (January 2025). Wiz found a DeepSeek ClickHouse database open to the internet with no password. It held over a million log lines, including chat history, API keys and backend details. Wiz says DeepSeek locked it down promptly after the report.
• Weak iOS app security (February 2025). NowSecure found the iPhone app turned off Apple's App Transport Security, sending some device data unencrypted. It used outdated 3DES encryption with a key hardcoded in the app (identical on every iPhone), and cached usernames and passwords insecurely on the device. Performance data went to Volcengine, a ByteDance cloud service.
• Android app (February 2025). SecurityScorecard found weak DES encryption, hardcoded keys, a SQL injection risk and embedded ByteDance code. It also said it detected "no overtly malicious behavior".
• Login code linked to China Mobile (February 2025). Feroot Security found obfuscated code on DeepSeek's web login page that pointed to China Mobile infrastructure. Two academics checked it for the AP and confirmed the code was there, but nobody saw data actually sent to China Mobile in their tests.
• South Korea's finding (April 2025). The country's privacy regulator found DeepSeek had sent user data and prompts abroad without permission, including to Beijing-based Volcano Engine.
• A sandbox escape in a developer tool (August 2026). OX Security found CVE-2026-82533, rated 9.4 out of 10, in DeepSeek Harness, an open-source runtime for coding agents. A sandboxed agent could switch off its own confinement. DeepSeek patched it on August 27, 2026. This hits developers running that tool, not people using the chat app.

Some of the app findings are 18 months old, and DeepSeek has changed things since (it stopped the Volcano Engine transfers in Korea and revised its policy). We couldn't find a newer independent audit of the current apps, so we can't tell you which flaws remain.

Problems that travel with the model itself

These next findings are about the model weights, so they apply wherever you run them, including on your own laptop.

• Easy to jailbreak. In January 2025, Cisco and University of Pennsylvania researchers got DeepSeek R1 to answer all 50 harmful test prompts they tried, a 100% attack success rate. OpenAI's o1-preview was at 26% in the same test. (Our post on why DeepSeek jailbreak prompts stop working covers the other side of that.)
• Easier to hijack when used as an agent. The US government's AI evaluation centre (CAISI, part of NIST) found in September 2025 that agents built on R1-0528 were, on average, 12 times more likely than US frontier models to follow malicious instructions hidden in their tasks.
• Built-in Chinese political framing. CAISI also found DeepSeek models repeated inaccurate or misleading Chinese Communist Party narratives about four times as often as the US models it tested. Expect evasive or one-sided answers on Taiwan, Tiananmen and similar topics, even offline.
• Weaker code on sensitive topics. CrowdStrike found in November 2025 that R1 wrote vulnerable code 19% of the time on neutral prompts, rising to 27.2% when a prompt said the system was based in Tibet. CrowdStrike doesn't think this was deliberate.

What no source we read shows is a hidden backdoor or malicious code inside the weights. CAISI's concerns are about how the model behaves, not about planted code. Weights in the standard safetensors format are data, not a program, so what goes over the network is decided by the app you run them in.

Who has banned DeepSeek, and is it banned for you?

Almost every ban is about government devices and systems. As far as we can find, no country has banned private citizens from using DeepSeek. Italy, the main exception, restricted the service itself.

Where things stand now:

• United States: On October 19–20, 2026, the Department of Homeland Security published Exclusion and Removal Order #2026-01 (dated July 24, 2026). Federal civilian agencies must remove DeepSeek products and stop buying them, and the order also covers third-party products built on DeepSeek technology. The Defense Department issued its own order on September 8, 2026, as required by a law passed in December 2025. Before that, the Navy, NASA, the House of Representatives and the Commerce Department had their own bans, and at least ten states (including Texas, New York and Virginia) restricted it on state devices in 2025. None of these reach a private person's phone.
• Italy: The data protection authority ordered DeepSeek to stop processing Italian users' data on January 30, 2025, and the app left Italian app stores. A January 2026 review found that limit still in force, and we found no later notice lifting it.
• South Korea: New downloads were paused from February 15, 2025 while the regulator investigated. The app came back on April 28, 2025, after DeepSeek changed its policy and let Korean users refuse transfers to China.
• Germany: Berlin's commissioner asked Apple and Google in June 2025 to consider removing the app. As of January 2026 the stores hadn't acted and the app was still available.
• Taiwan, Australia and others: Taiwan barred government agencies on January 31, 2025. Australia ordered it off all government systems and devices on February 4, 2025, and said the ban doesn't extend to private citizens. The Netherlands, Belgium, the Czech Republic, Canada and India's Finance Ministry also restricted official use.

If your employer, school or agency has a policy, it probably names DeepSeek now. Check before installing it on a work device, even a personal phone you use for work email.

Open weights: DeepSeek without DeepSeek's servers

DeepSeek publishes its models under the MIT license. V4.1 Flash, released September 10, 2026, is on Hugging Face like R1 and V4 before it. Anyone can download and run them. When you do, or when you use a company that hosts them outside China, your prompts go to that machine or that company, not to DeepSeek. The privacy policy, the China storage and the app flaws above stop applying. NowSecure itself suggested self-hosting or a non-Chinese cloud for organisations that want the model.

The honest catch is size. V4.1 Flash has 552 billion parameters, far beyond a laptop. What most people run locally are smaller versions: Ollama offers DeepSeek R1 in sizes from 1.5B (1.1 GB) up to 70B (43 GB), and these smaller ones are distilled into Qwen and Llama base models. They're private but noticeably less capable. The full 671B R1 is a 404 GB download.

The middle option is a third-party host running the full model. Then your privacy depends on that host's policy, location and logging, so read it the same way you'd read DeepSeek's.

That's what Cleus does. Smartest v3 is an abliterated version of DeepSeek V4.1 Flash with its refusal behaviour removed, run on our own hosting providers rather than DeepSeek's servers. Premium chats can use an opt-in zero-access mode: messages are encrypted on your device, stored only as ciphertext, and the passphrase never leaves your device. The limit is that the text still has to reach the model provider while it answers, so it isn't encryption all the way to the model. How that encryption works explains the details. Note that abliteration removes refusals; it doesn't remove the China-topic slant in the training, and it doesn't make the model safe for your secrets either.

Safe or risky? Test yourself

How to use DeepSeek more safely

A quick checklist:

• Not on work or government devices, and not with work data, unless your organisation has approved it.
• Never paste passwords, API keys, health records, client files or ID numbers into any chatbot, DeepSeek's or anyone else's.
• For privacy, run a model locally with Ollama or LM Studio, or use a host outside China whose policy you've read.
• If you use the official app, email privacy@deepseek.com to opt out of training, and delete chats you don't need from settings.
• Double-check anything political or historical about China, and review any code it writes.
• Treat it as an agent with care: don't let it read untrusted web pages or email and act on them unsupervised.

DeepSeek safety questions

Is DeepSeek safe to download? The official app comes from Apple's and Google's stores, and SecurityScorecard's review of the Android app found no overtly malicious behaviour. The concerns are weak encryption in early versions, data stored in China, and broad collection. For casual use on a personal phone, the main cost is privacy.

Does DeepSeek send my data to China? Yes, if you use DeepSeek's own app, website or API. Its privacy policy says it processes and stores personal data in the PRC. If you run the open model locally or through a non-Chinese host, nothing goes to DeepSeek.

Is DeepSeek banned in the US? Not for individuals. As of November 2026 it's banned on federal civilian and Defense Department systems and on government devices in many states. You can still download it on a personal device.

Is DeepSeek safer than ChatGPT? They carry different risks. DeepSeek's data sits under Chinese jurisdiction, and in the Cisco and CAISI tests its models were much easier to jailbreak than the US models compared. If you want the strongest privacy, a local model beats both.

Can I delete my DeepSeek data? You can delete chat history in settings, and the policy says account deletion is permanent. It doesn't spell out how quickly server copies are erased.

Is running DeepSeek locally completely safe? Your prompts stay on your machine, which solves the data question. The model's censorship on China-related topics and its jailbreak and agent-hijacking weaknesses come along with it, so be careful letting it run code or act on the web.

If you'd like the model with fewer restrictions, our guide to using DeepSeek V4.1 Flash without restrictions walks through the options.

Sources

• DeepSeek: privacy policy, last updated February 10, 2026; February 14, 2025 version
• DeepSeek app: a closer look at its privacy posture (Privado, January 29, 2025)
• National Intelligence Law of the People's Republic of China (Wikipedia)
• Wiz Research uncovers exposed DeepSeek database (Wiz, January 29, 2025)
• NowSecure uncovers multiple security and privacy flaws in DeepSeek iOS app (NowSecure, February 6, 2025)
• A Deep Peek at DeepSeek (SecurityScorecard, February 10, 2025)
• Researchers link DeepSeek's chatbot to Chinese telecom banned from doing business in US (AP via SecurityWeek, February 5, 2025)
• DeepSeek resumes downloads in South Korea (CO/AI, citing Reuters, April 28, 2025)
• DeepSeek Harness sandbox escape (Cloud Security Alliance, September 2026)
• Evaluating security risk in DeepSeek and other frontier reasoning models (Cisco, January 31, 2025)
• CAISI evaluation of DeepSeek AI models finds shortcomings and risks (NIST, September 30, 2025)
• Security flaws in DeepSeek-generated code linked to political triggers (CrowdStrike, November 20, 2025)
• US bans DeepSeek from government agency systems (CNBC, October 20, 2026); US orders federal agencies to remove DeepSeek (TechCrunch, October 20, 2026)
• Removing PRC artificial intelligence models from federal agencies (Congressional Research Service, October 23, 2026)
• DeepSeek one year later: regulatory storm, global surge (AI-Regulation.com, January 28, 2026)
• DeepSeek: the countries and agencies that have banned the AI company's tech (TechCrunch, February 3, 2025)
• Garante privacy: 2025 annual report summary (July 2, 2026)
• GDPR violations prompt Germany to push Google and Apple to ban DeepSeek (Security Affairs, June 2025)
• Australia bans DeepSeek on government devices (Reuters via The Star, February 4, 2025)
• Taiwan bans government agencies from using DeepSeek (The Star, February 1, 2025)
• DeepSeek launches V4.1 Flash (The Next Web, September 10, 2026)
• DeepSeek R1 on Ollama (Ollama library)