Is DeepSeek Safe to Use? What the US Ban Means for You

Published 20 October 2026

It depends on whose computer runs it. The DeepSeek app, website and API send what you type to DeepSeek’s servers in China, so keep anything private or work-related out of them. A copy of the model running on your own hardware sends nothing to DeepSeek. The US order made public this week binds federal civilian agencies and the companies that work for them. It does not stop anyone else from using DeepSeek.

Two things happened at once. DeepSeek released a new model, V4.1-Flash-1017, on 17 October. Two days later, the Department of Homeland Security (DHS) made public an order, first issued on 24 July 2026, that tells civilian agencies to remove DeepSeek from their systems.

The ban covers federal civilian agencies, not you

The order is called Exclusion and Removal Order #2026-01. DHS Secretary Markwayne Mullin signed it under the Federal Acquisition Supply Chain Security Act of 2018, a law that lets DHS keep risky technology out of federal systems. DHS published it in the Federal Register on 20 October (Federal Register).

It tells every federal civilian agency, such as Treasury, State and Justice, to do two things (CNBC):

1. Stop buying. Agencies may not buy DeepSeek products, or products from companies tied to DeepSeek.
2. Remove what they have. Agencies must take DeepSeek products off their systems. This includes “third-party products and services developed using DeepSeek implementations”, meaning other companies’ tools built on DeepSeek.

An agency that cannot comply can ask DHS for an exception in writing within 60 days of the order’s issue. DHS will review the order within one year, and every year after that.

The order does not cover the Defense Department or the intelligence agencies. They have their own rules. The Defense Information Systems Agency moved to block DeepSeek in January 2025, and Congress restricted it in intelligence systems in December 2025 (CNBC).

DHS gives four reasons. DeepSeek’s servers are in China, and Chinese law gives the government wide power to reach into private companies’ systems. Signing up for an account collects personal data, and DeepSeek “may also track and digitally fingerprint users”. Typing into the app could send sensitive data to China. And the models “may contain malware or other security vulnerabilities”. For evidence, the order cites DeepSeek’s 2025 privacy policy, a 2025 House committee report and a February 2025 security test of the iPhone app. It cites no newer test.

How can an open model be banned? The order does not ban the model itself, which anyone can download. It bans agencies from using DeepSeek products. What counts as a product “developed using DeepSeek implementations” is not defined. The order makes no exception for copies that run on US servers or on an agency’s own machines.

Why only DeepSeek? The order names only DeepSeek. It says nothing about other Chinese models.

China’s foreign ministry told Reuters that it opposes “the over-generalization of national security” (CNBC). DeepSeek had not commented when CNBC published.

State rules are separate. Texas, for example, bars state employees and contractors from using DeepSeek on state devices, or on personal devices they use for state work (Texas Governor’s office). If you work for a state or a large employer, check its rules too.

Does DeepSeek track you? It collects what most chatbots collect, and stores it in China

Yes, in the ordinary sense. DeepSeek’s privacy policy, last updated 10 February 2026, lists what it collects (DeepSeek privacy policy):

• Your account: email address or phone number, and password.
• What you send: text, voice, prompts, uploaded files, photos, feedback and chat history.
• Your device: device model, operating system, IP address (your internet address, which shows your rough location), device identifiers and system language. On the website, it also uses cookies.

Four rules in that policy matter more than the list:

• Where it goes. DeepSeek says it collects, processes and stores your data in the People’s Republic of China.
• Training. It uses your data to train its models. You have the right to opt out, but the policy gives no setting for it. The only route it names is an email to privacy@deepseek.com.
• How long. It keeps your account details and inputs for as long as you have an account. You can delete chat history in settings.
• Who else sees it. It may share data with law enforcement and public authorities to comply with “applicable law, legal process or government requests”.

The app has a security record too. In February 2025, the security firm NowSecure tested DeepSeek’s iPhone app. It found that the app sent some sign-up and device data over the internet without encryption, so anyone on the same network could read it. The app also switched off Apple’s built-in protection for network traffic, used an outdated cipher (Triple DES) with keys written into the app, and stored the username and password insecurely on the phone. Some data went to a cloud service run by ByteDance, TikTok’s owner (NowSecure). That test is from 2025. We have not seen a public re-test of the current app, so we cannot say whether these flaws are fixed.

DeepSeek is riskier than ChatGPT on four points, and alike on the rest

Much is the same. Both companies collect your prompts, files, device details and IP address. Both may train on what you type. Both say they share data with authorities when the law requires it (OpenAI US privacy policy; DeepSeek privacy policy). ChatGPT also uses ad data to personalise ads for Free and Go users, which DeepSeek’s policy does not describe.

The four differences:

1. Whose law applies. OpenAI says it processes and stores your data in places that include its US servers, and a San Francisco company controls it. DeepSeek stores it in China. Each government can compel its own companies to hand over data, so the question is which government you would rather have that power.
2. How you opt out of training. ChatGPT has a setting. DeepSeek asks you to email it.
3. How fast deletion happens. When you delete chats in ChatGPT, OpenAI says it removes them within 30 days, unless it must keep them for legal or safety reasons. ChatGPT’s Temporary Chats are deleted within 30 days and are not used for training. DeepSeek’s policy gives no deadline for removing data after you delete it. It keeps your inputs while your account exists.
4. How the model behaves under attack. In September 2025, NIST’s Center for AI Standards and Innovation (CAISI), a US government lab, tested three DeepSeek models against four US models of that time, including OpenAI’s GPT-5 and Anthropic’s Claude Opus 4. AI agents built on R1-0528, DeepSeek’s most secure model in that test, were on average 12 times more likely than GPT-5 and Opus 4 to follow malicious instructions planted to pull them off the user’s task. With a common jailbreak trick, R1-0528 answered 94% of plainly harmful requests, against 8% for the US models. DeepSeek’s models also repeated four times as many inaccurate or misleading Chinese Communist Party talking points (NIST). Both sides of that test are 2025 models. CAISI did not test the new 1017 release or today’s ChatGPT, so the gap may have changed.

Running DeepSeek on your own hardware keeps your data private, but not the model’s habits

When you run the model yourself, your prompts go nowhere. The model is a large file of numbers. A program on your computer reads that file and works out the answer locally. DeepSeek never sees the conversation.

The new model is free to download. DeepSeek put V4.1-Flash-1017 on Hugging Face under the MIT license, which allows commercial use (Hugging Face). The full download is about 510 GB, so it needs server-class hardware, not a laptop.

The weights come in the safetensors format, which Hugging Face built to store model numbers safely, unlike the older pickle format, which can run hidden code when a file is loaded (Hugging Face docs). The same repository also ships Python scripts for running the model. Those scripts are code, so read them or use a well-known runner instead.

Three things travel with the model even on your own hardware:

• Its answers on China. CAISI found that DeepSeek models echo Chinese government narratives more often than US models. Running the model yourself does not remove what it learned.
• Its weakness to hijacking. If you let the model use tools, such as reading email or running commands, hidden instructions in a web page or document can steer it. CAISI found agents built on DeepSeek far easier to hijack. Ask for approval before any action, and do not give it your passwords.
• The ban, if you do federal work. The order makes no exception for self-hosted copies. Treat them as covered until DHS says otherwise.

To be sure nothing leaves your machine, block the runner program’s internet access in your firewall. It does not need the internet once the files are downloaded.

Federal contractors should take DeepSeek out of contract work now

If your company works for a federal civilian agency, the ban can reach you. A standard contract clause, FAR 52.204-30, makes DHS orders like this one binding on contracts that include the clause and were not awarded by the Defense Department (FAR 52.204-30):

• No use in the work. Contractors may not provide or use a covered product as part of the contract.
• It flows down. The clause goes into every subcontract, including ones for commercial products and services.
• Check SAM.gov. Contractors search the government’s contracting site for the phrase “FASCSA order”, and check again at least once every three months.
• Report fast. If you find a covered product in your work, tell the contracting officer within 3 business days. Within 10 more business days, report how you will stop it happening again.

There is one timing detail. An order issued after a contract was put out for bids applies to that contract only once the agency adds it by amendment. The duty to report applies either way.

DeepSeek can also hide inside other tools. On 20 October, the policy site AI Policy Desk counted 18 DeepSeek models among the 470 on OpenRouter, a service that sends your request to whichever model you choose, or picks one for you on an “auto” setting (AI Policy Desk). If your tools use automatic model choice, check whether DeepSeek is on the list, and ask your AI vendors in writing.

This is a reading of the public texts, not legal advice. Check your own contract with your contracting officer or a lawyer.

The bottom line: keep private data out of DeepSeek’s own app and API

• The app or website: safe enough for questions you would happily post in public, such as explaining a maths idea. Do not type in health details, client files, passwords or anything from work.
• The API: fine for experiments on public data. Do not send customer or regulated data. The terms follow Chinese law, and disputes go to a court in Hangzhou (DeepSeek Open Platform terms).
• Through another company’s host: your data goes to that company, so read its terms. The model’s behaviour is the same as DeepSeek’s own.
• On your own hardware: the most private choice. Use the official safetensors files, block the runner’s internet access, and keep a human approval step before any action it takes.
• Federal civilian staff and contractors: do not use DeepSeek in any form for government work until DHS says otherwise.

LodeHQ’s daily AI newsletter covers new models, tools and research.

For a comparison of the leading US models, read Gemini 4 Argon vs Claude Opus 5.5 vs GPT-6 Astra.

How we checked

We read the DHS order in the Federal Register, including the signed order printed in its appendix, on 20 October 2026. On the same day we read DeepSeek’s privacy policy and Open Platform terms, OpenAI’s US privacy policy, the FAR 52.204-30 clause, CNBC’s report, AI Policy Desk’s contractor guide and DeepSeek’s Hugging Face page. The app findings come from NowSecure’s February 2025 test, and the model findings come from NIST’s September 2025 evaluation. We did not test the DeepSeek app or model ourselves. We will check again when DHS says what “developed using DeepSeek” covers, or on 20 November 2026, whichever comes first.