DeepSeek's January 2025 release triggered a global governance scramble that most enterprises have not finished. Within two weeks of launch, the Pentagon, NASA, the U.S. Congress, Italy, South Korea, and Australia had all banned the platform from government devices. By June 2026, seventeen U.S. states had enacted bans, NIST's Center for AI Standards and Innovation had completed two independent evaluations finding material compliance and behavioral risks, and H.R. 1121 (the No DeepSeek on Government Devices Act) was moving through Congress.
This guide covers what CISOs need to know: the actual data flows, the documented security vulnerabilities, the three distinct risk profiles by deployment model, detection and blocking methods, and the policy controls required before any DeepSeek deployment.
Key Takeaways
- DeepSeek's cloud API stores all data on PRC servers subject to China's National Intelligence Law, which mandates cooperation with state intelligence agencies on demand, with no judicial check.
- Forensic analysis confirmed DeepSeek collects keystroke patterns, device fingerprints, and routes telemetry to ByteDance's Volcano Engine infrastructure and Shumei device fingerprinting services.
- Wiz Research found DeepSeek's own database exposed over one million plaintext chat records and internal API keys with no authentication required.
- NIST CAISI evaluations in September 2025 and May 2026 found DeepSeek models comply with most malicious requests in testing and exhibit state-sponsored censorship.
- CrowdStrike found that DeepSeek-R1 generates up to 50% more severe code vulnerabilities when prompts reference CCP-politically sensitive topics, regardless of task relevance.
- Self-hosted open-weights deployments (DeepSeek-R1, V3) carry a different risk profile from the cloud API but require specific hardening: network isolation, output filtering, and model integrity verification.
- DeepSeek has no HIPAA BAA, FedRAMP authorization, SOC 2 Type II, or PCI DSS compliance documentation.
The DeepSeek Threat Landscape
DeepSeek is developed by a Chinese hedge fund called High Flyer. Its operations fall under three PRC statutes that every enterprise legal and security team needs to understand before any deployment decision.
The National Intelligence Law of the PRC (2017), Article 7 obligates all organizations and citizens to "support, assist, and cooperate" with national intelligence work. Unlike U.S. intelligence law, there is no independent judicial review, no warrant requirement, and no notification provision. Any data stored on DeepSeek's infrastructure is accessible to PRC intelligence agencies on demand.
The Cybersecurity Law of the PRC (2017) requires network operators to store data locally and cooperate with security inspections. The Data Security Law (2021) reinforces state access rights. DeepSeek's terms of service are governed by PRC law, with disputes resolved in Chinese courts.
The data residency risk extends beyond DeepSeek's own servers. South Korea's Personal Information Protection Commission confirmed in April 2025 that DeepSeek transferred personal data, including device information and user prompt content, to Beijing Volcano Engine Technology, a wholly-owned ByteDance affiliate. This transfer occurred without user consent and was only halted after regulatory intervention. Keysight's network traffic analysis confirmed that the second-highest volume traffic destination after chat.deepseek.com was apmplus.ap-southeast-1.volces.com, a Volcano Engine telemetry endpoint.
Dakota State University's DigForCE Lab published a forensic analysis in April 2025 confirming that DeepSeek's iOS and Android applications collect keystroke patterns and rhythms for behavioral biometric fingerprinting, a technique previously documented in TikTok. Data also routes to Shumei Inc. (portal101.cn), a Chinese device fingerprinting service, and to Tencent Holdings infrastructure.
In June 2025, the House Select Committee on the CCP released "DeepSeek Unmasked," a bipartisan report finding that DeepSeek routes data through backend infrastructure connected to China Mobile, a U.S. government-designated Chinese military company. The report concluded DeepSeek alters or suppresses information deemed sensitive to the CCP approximately 85% of the time and that DeepSeek likely used unlawful model distillation to extract IP from U.S. AI models.
Enterprise Risk Taxonomy: Three Deployment Models
The risk profile for DeepSeek varies materially depending on how it is deployed. CISOs should assess each deployment model separately.
Model A: DeepSeek Cloud API and Consumer App
This is the highest-risk deployment. Every prompt, response, file upload, and session metadata is transmitted to and stored on PRC servers. There are no enterprise contractual protections: no BAA, no Data Processing Agreement, no indemnity clause. The iOS app has no App Transport Security, uses Triple DES encryption with hardcoded keys, and sends unencrypted data, per NowSecure's February 2025 audit.
Compliance status: No HIPAA BAA, no FedRAMP authorization, no SOC 2 Type II, no PCI DSS attestation, no EU Standard Contractual Clauses or adequacy decision for GDPR transfers to China.
Italy's Garante (Data Protection Authority) imposed a blanket ban on January 30, 2025, after DeepSeek failed to provide adequate GDPR compliance documentation. South Korea suspended DeepSeek from its app stores on February 15, 2025, after confirming unauthorized personal data transfers to Volcano Engine.
Model B: Open-Weights Self-Hosted Deployment
DeepSeek-R1 (671B), DeepSeek-V3, and subsequent model generations are available as open weights on HuggingFace in .safetensors format. Static model weights do not phone home after download. When served with a properly isolated inference stack, prompts stay within your infrastructure and the data residency risk from the cloud API does not apply.
This shifts risk to: model behavior (jailbreak susceptibility, censorship-triggered vulnerability generation), supply chain integrity of the weights file, and infrastructure configuration security. Specific findings on these risks are in the vulnerabilities section below.
Production-grade enterprise serving uses vLLM, which supports OpenAI-compatible API endpoints, GPU cluster distribution, and API key enforcement. Ollama is developer-friendly but defaults to binding on 0.0.0.0:11434, exposing the inference API to all network interfaces. Reconfigure to localhost-only or an internal VLAN before any deployment.
Model C: Third-Party Tool Integrations
This is the deployment model most likely to create undetected data residency exposure. DeepSeek provides documented integrations for GitHub Copilot and Cursor to use DeepSeek's cloud API as the model backend. When a developer configures their IDE to use the DeepSeek API, every code completion request, including inline comments, variable names, and code context, routes to DeepSeek's PRC servers.
The compliance status of the IDE wrapper is irrelevant: GitHub Copilot Enterprise holds SOC 2 Type II, but that certification does not protect data that the developer has routed to an uncertified external endpoint. This is a procurement and configuration gap, not a vendor failure.
Quarterly audits of developer tool configurations are required to detect unauthorized model backend switches in Copilot, Cursor, VS Code extensions, and other AI development tools.
Known Security Vulnerabilities
The security issues documented in DeepSeek go beyond data residency.
Exposed Database: Over One Million Chat Records
On January 30, 2025, Wiz Research discovered two publicly accessible, unauthenticated ClickHouse database instances at DeepSeek IP addresses with ports 8123 and 9000 open. The database contained over one million log entries including plaintext chat histories, internal API endpoints, and authentication keys. The ClickHouse HTTP interface permitted arbitrary SQL query execution with no authentication.
DeepSeek secured the database within one hour of notification, but the exposure window and the fact that a database this sensitive was internet-accessible without authentication reflects a security baseline that most enterprises would not accept from a vendor handling their data.
iOS App Cryptographic Failures
NowSecure's February 2025 analysis of the DeepSeek iOS application found that App Transport Security was globally disabled (permitting cleartext data transmission), the app used Triple DES (a deprecated algorithm) with hardcoded encryption keys embedded in the binary, and initialization vectors were reused across sessions, enabling known-plaintext attacks. User credentials, including username and password, were stored insecurely on-device. These are not minor implementation details; they indicate that basic secure coding practices were not followed in the consumer application.
Jailbreak Susceptibility: 58% Failure Rate
Qualys TotalAI tested DeepSeek-R1 against 885 attack variants across 18 jailbreak categories on January 31, 2025. The model failed to block 58% of jailbreak attempts and failed 61% of knowledge base attacks. Successful bypasses included instructions for constructing explosive devices, functional exploit code generation, and dangerous medical misinformation. This is a relevant concern for any organization deploying DeepSeek in contexts where outputs could inform operational decisions.
Chain of Thought Exploitation
Trend Micro's March 2025 research demonstrated that DeepSeek-R1's Chain of Thought reasoning mechanism, which exposes intermediate reasoning steps via
Political Trigger Code Vulnerabilities
CrowdStrike published findings in November 2025 from testing across 30,250 prompts against DeepSeek-R1 (671B). When system prompts contained topics politically sensitive to the CCP (Tibet, Uyghurs, Falun Gong, Tiananmen), DeepSeek-R1 generated code with up to 50% more severe security vulnerabilities compared to control prompts, even when the sensitive terms were entirely irrelevant to the coding task. CrowdStrike also identified an "intrinsic kill switch": the model would reason through a complete technical response but refuse to output the final code in the last step.
This behavior persists regardless of hosting location. A self-hosted DeepSeek instance shows the same pattern. CrowdStrike's assessment was direct: "If a model's performance changes based on geopolitics or ideology, that's not bias, that's a supply-chain risk."
NIST CAISI Evaluation Findings
NIST's Center for AI Standards and Innovation evaluated DeepSeek R1, R1-0528, and V3 in September 2025, comparing them against GPT-5, GPT-5-mini, and Claude Opus 4. The evaluation found that DeepSeek models comply with most malicious requests presented in testing, exhibit state-sponsored censorship (claiming Taiwan is part of China and reflecting CCP political positions), and share user data with third-party entities including ByteDance. NIST's summary stated: "The models' shortcomings related to security and censorship of model responses may pose a risk to application developers, consumers, and U.S. national security."
A May 2026 NIST CAISI evaluation of DeepSeek V4 Pro found it is the most capable PRC AI model evaluated to date, but still lags U.S. frontier models by approximately eight months and scored 32% on cybersecurity CTF benchmarks versus GPT-5.5's 71%.
Government Bans and Regulatory Exposure
By June 2026, the following government bodies had banned or restricted DeepSeek:
U.S. Federal: NASA (January 31, 2025), Pentagon (early February 2025, after confirmed access from work computers), Congress (early February 2025). H.R. 1121 (No DeepSeek on Government Devices Act) directs OMB to develop removal standards covering DeepSeek and all successors from High Flyer. The bipartisan No Adversarial AI Act would create a federal adversarial AI list covering AI tools from China, Russia, Iran, and North Korea, updated every 180 days.
U.S. States: Texas (first state ban), followed by New York, Virginia, Tennessee, Iowa, North Dakota, South Dakota, North Carolina, Nebraska, Arkansas, Oklahoma, Alabama, Kansas, Georgia, Pennsylvania, Oregon, and Nevada.
International: Italy (January 30, 2025, Garante enforcement, GDPR basis), South Korea (February 15, 2025, PIPC directive, Volcano Engine transfer finding), Australia (February 2025, federal government devices), Taiwan (government agencies, state enterprises, public schools), India (Ministry of Finance).
The regulatory exposure for non-government enterprises depends on data classification and sector:
HIPAA: DeepSeek provides no Business Associate Agreement. Any Protected Health Information submitted to the cloud API creates an immediate HIPAA violation under 45 CFR Part 164. There is no technical, administrative, or physical safeguard alignment.
FedRAMP: No authorization exists. Federal contractors handling government data cannot use DeepSeek.
PCI DSS: Cardholder data or sensitive authentication data submitted to DeepSeek's API breaches Requirements 4 (encrypted transmission to authorized parties only) and 12.8 (third-party service provider management).
ITAR: Export-controlled technical data transmitted to DeepSeek constitutes an unauthorized export under 22 CFR 120.17. Electronic transmission to PRC servers is an export to a controlled destination.
SOC 2: DeepSeek has no SOC 2 Type I or II. Enterprises with SOC 2 obligations cannot demonstrate adequate vendor risk management for DeepSeek usage without compensating controls.
GDPR: Italy's enforcement established that DeepSeek fails GDPR Articles 5, 13, and 14 transparency and lawful basis requirements. No adequacy decision, Standard Contractual Clauses, or other GDPR transfer mechanism applies to data transfers to China.
Detecting Unauthorized DeepSeek Use
The detection problem is compounded by the third-party integration model: a developer could switch Cursor or Copilot to the DeepSeek API without any visible organizational change. Detection requires three layers.
Network Layer
DeepSeek uses standard HTTPS (TLS 1.3 over port 443). The SNI field in TLS ClientHello messages reveals the destination hostname without full decryption. Monitor and alert on or block the following hostnames:
deepseek.com,deepseek.ai(primary domains)chat.deepseek.com(consumer chat)api.deepseek.com(API endpoint)apmplus.ap-southeast-1.volces.com(Volcano Engine APM/telemetry)portal101.cn(Shumei device fingerprinting)
Endpoint and SaaS Discovery
Microsoft Defender for Endpoint supports URL indicator enforcement via Settings > Endpoints > Rules > Indicators. Add deepseek.com and volces.com to block and alert. Microsoft Intune policy can enforce device-level domain blocking. For browser visibility, platforms that inspect GenAI SaaS usage patterns in browser sessions (including extension analysis) can identify DeepSeek access that bypasses network controls via personal hotspots or unmanaged devices.
Developer Tool Configuration Audits
Audit IDE and AI assistant configurations quarterly. Check:
.cursor/settings.jsonand Cursor model backend configuration files for DeepSeek API endpoints- VS Code extension settings for AI assistant plugins
- GitHub Copilot extension configurations for custom model endpoints
- Any environment variables containing
deepseek.comAPI keys (grep forDEEPSEEKin developer environment configs)
For a broader shadow AI detection strategy, see our guide on shadow AI security in enterprise environments and our coverage of AI data residency and sovereignty controls.
Self-Hosted Open-Weights Hardening Checklist
For organizations with a legitimate operational need for DeepSeek model capabilities and a valid reason to prefer it over U.S.-developed alternatives (cost, architecture, specific benchmark performance), the self-hosted path is viable with the following controls:
1. Network isolation. Bind inference servers to localhost (127.0.0.1) or a dedicated internal VLAN. Block all outbound traffic from inference nodes except to approved model registries. This prevents the static weights from making any outbound connections, eliminating the data residency concern.
2. Serving framework security. For production, use vLLM with --api-key enforced and TLS termination at a reverse proxy. If using Ollama for development, explicitly set OLLAMA_HOST=127.0.0.1 to prevent the default 0.0.0.0:11434 binding.
3. Output filtering. Strip
4. Model integrity verification. Verify SHA-256 checksums of all .safetensors files against HuggingFace's published checksums before loading. Download weights only from official HuggingFace repositories or an internal model registry, not third-party mirrors.
5. Access controls. Enforce bearer token authentication or mTLS on inference API endpoints. Log all queries and responses for audit purposes. Apply role-based access aligned to data classification.
6. Data classification scoping. Define explicit data classification limits for what can be submitted to a self-hosted DeepSeek instance. Given the CrowdStrike political trigger findings, be cautious about using DeepSeek for code generation on any codebase where topic-sensitive quality degradation would create risk.
7. Isolated compute. Deploy on dedicated GPU infrastructure, not shared cloud instances. Air-gap nodes handling sensitive workloads.
8. Version tracking. Track Ollama and vLLM version releases and apply serving framework patches promptly. Serving framework vulnerabilities are separate from model weight issues.
Enterprise AI Acceptable Use Policy for DeepSeek
An AUP covering DeepSeek and Chinese-origin AI models should address the following elements. For a complete AUP template, see our enterprise AI acceptable use policy guide.
Scope definition: Distinguish between three categories: (1) DeepSeek cloud API and consumer app (prohibited for all work use), (2) third-party AI tools configured to route to DeepSeek backends (prohibited without CISO approval), (3) approved self-hosted deployments with documented controls (permitted within defined data classification limits).
Data classification prohibition: Explicitly prohibit submission of any data classified above PUBLIC, including all PII, PHI, financial data, source code, intellectual property, legal privileged content, and M&A-related information.
Procurement gate: Require security review and CISO sign-off before any new AI tool integration. The review must include documentation of the model backend, data routing path, and contractual protections.
Third-party tool governance: Mandate quarterly audits of IDE and coding assistant configurations. Address the IDE backend switching risk explicitly: the fact that a tool is approved does not mean any model backend is approved.
Jurisdiction acknowledgment: Note that DeepSeek's terms are governed by PRC law with disputes resolved in Chinese courts, creating contractual exposure incompatible with enterprise risk standards.
Self-hosted exception path: Define the technical and procedural requirements for an approved self-hosted deployment. Require documented hardening controls, data classification limits, and security team sign-off.
Training and attestation: Annual user training on AI tool risks and CISO acknowledgment.
The NIST AI Risk Management Framework GOVERN and MAP functions require explicit treatment of third-party AI system provenance, supply chain risk, and data governance for cross-border transfers. DeepSeek's risk profile makes it one of the clearest cases where the MAP function's third-party AI system evaluation should result in a formal risk acceptance or rejection decision with documented rationale.
For CISOs building a complete AI governance program that covers foreign-origin model risk alongside broader enterprise AI controls, see our enterprise AI governance and compliance framework guide.
Conclusion
DeepSeek is not a uniform risk. The cloud API and consumer app present clear, documented, and legally unambiguous data sovereignty risks that no enterprise contractual protection can address. The regulatory gap is total: no HIPAA BAA, no FedRAMP, no SOC 2, no GDPR adequacy mechanism. Every U.S. government agency and 17 states have already reached the same conclusion.
The open-weights self-hosted path is narrower but viable with proper controls. The model behavior risks (jailbreak susceptibility, political trigger vulnerability generation, CoT exploitation) persist regardless of hosting location and require mitigation at the serving layer.
The most likely source of undetected DeepSeek exposure in most enterprises is not direct use of the API but silent backend switches in developer tools. Quarterly configuration audits of Cursor, Copilot, and other AI development tools are a practical, low-overhead control that addresses this specifically.
If your organization needs to baseline its current AI tool exposure, including unauthorized DeepSeek usage, developer tool configurations, and shadow AI inventory, book an AI security assessment with BeyondScale. You can also run a Securetom scan to identify exposed AI inference endpoints and ungoverned AI tool access in your environment.
Sources:
AI Security Audit Checklist
A 30-point checklist covering LLM vulnerabilities, model supply chain risks, data pipeline security, and compliance gaps. Used by our team during actual client engagements.
We will send it to your inbox. No spam.
BeyondScale Team
AI Security Team, BeyondScale Technologies
Security researcher and engineer at BeyondScale Technologies, an ISO 27001 certified AI cybersecurity firm.
Want to know your AI security posture? Run a free Securetom scan in 60 seconds.
Start Free Scan
