DeepSeek
Data retention, API terms, open-weights licensing, and risk analysis for DeepSeek V3 and R1 reasoning models.
Governance and contractual terms
- Training use (default)
- DeepSeek Consumer App / Web Interface: yes, inputs may be collected and used for model training. DeepSeek Paid API: terms state prompt data is retained for logging, but not used for model training unless opted in.
- Retention
- API prompt logs retained up to 30 days for safety filtering and service stability.
- Opt-out
- Self-hosted open weights offer total data privacy control. Web chat interface has limited opt-out capabilities.
- Data residency
- API servers hosted in Mainland China. Self-hosted deployments run locally on customer hardware.
- Sub-processor list
- Unverified — no published GDPR-compliant sub-processor registry available on website.
- DPA available
- Unverified — no standard EU GDPR Article 28 DPA self-service mechanism provided.
- Contracting entity
- Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (China)
- EU contracting entity
- None — no dedicated EU subsidiary entity listed in terms
- Governing law
- Laws of the People's Republic of China; Hangzhou arbitration court
- Certifications
- Unverified
- AI Act Code of Practice
- unverified
- Vulnerability disclosure
- Security issues routed to service@deepseek.com.
- Documented incidents
- No public security breach reported, but regulatory warnings issued regarding cross-border data flows from China-hosted API endpoints.
Model inventory
Listed by the AI Act deadline each model falls under, which depends on when it was placed on the EU market rather than on its capability. No benchmark scores — why not.
| Model | API identifier | EU availability | AI Act deadline | Covered by DPA |
|---|---|---|---|---|
| DeepSeek-R1 Open-weights reasoning model using Mixture-of-Experts (MoE) architecture. | deepseek-reasoner | 2025-01-20 | 2 Aug 2026 | Unverified for SaaS API; Covered when self-hosted on enterprise infrastructure |
| DeepSeek-V3 671B parameter open-weights model. | deepseek-chat | 2024-12-26 | 2 Aug 2026 | Unverified for SaaS API |
The short answer
DeepSeek is an artificial intelligence research lab and LLM provider based in Hangzhou, China. For security and compliance teams, DeepSeek presents a stark distinction between using its public SaaS API vs self-hosting its open-weight models:
- Public SaaS API / Web Chat: Data submitted to the public API is processed on servers located in Mainland China without standard EU GDPR DPA coverage or EU data residency.
- Self-Hosted Open Weights (DeepSeek-R1 / V3): The model weights are released under permissive licenses (MIT License), allowing organizations to host inference locally on their own isolated GPUs, guaranteeing zero data leakage to third parties.
Security & compliance breakdown
SaaS API & Web App Risks
- Jurisdiction & Cross-Border Transfers: The contracting entity is Hangzhou DeepSeek AI Co., Ltd. Standard Contractual Clauses (SCCs) and GDPR Art. 28 DPAs are not provided for standard API keys.
- Data Residency: Prompts and outputs route through Chinese infrastructure, creating regulatory compliance risks under EU GDPR Art. 44-49 and financial data regulations.
Self-Hosted Deployment (Recommended Strategy)
Because DeepSeek releases model weights publicly, enterprise security teams can safely run DeepSeek-R1 inside local vLLM / Ollama clusters or private cloud enclaves (e.g. AWS EC2, Azure ML, or local hardware). When self-hosted, 100% of telemetry, prompts, and code remain on internal networks.
This record describes contractual and governance terms as read on the date shown, for the tier shown. Providers revise terms without notice — verify against the provider's own documentation before relying on any of it. Nothing here is legal advice.