DeepSeek AI Vendor Risk Profile
Chinese AI lab that developed DeepSeek V3 and DeepSeek R1, achieving frontier-level performance at significantly lower training costs. Known for open-weight releases that disrupted pricing expectations across the AI industry.
Risk overview
Risk score: 67/100
Risk tier: High
Safety rating: 33/100 (higher is better)
Lower risk scores indicate lower assessed risk.
Last verified: Apr 19, 2026 Aging
Risk dimensions
| Dimension | Risk score |
|---|---|
| Data Handling | 80/100 |
| IP Exposure | 55/100 |
| Jurisdiction | 79/100 |
| Security | 65/100 |
| Regulatory Compliance | 80/100 |
| Transparency | 50/100 |
| Business Stability | 49/100 |
| Dependency Chain | Not assessed |
| Agent Governance | Not assessed |
Analyst summary
Rating: Avoid
DeepSeek produces capable open-weights models but the hosted consumer app stores data on servers in the People's Republic of China, under PRC jurisdiction including the National Intelligence Law. The Italian Garante has already ordered the app blocked. Self-hosted use of DeepSeek weights is a different risk profile from using the hosted service.
Bottom line: Hosted service is off-limits for most enterprise use; self-hosted open weights is a separate, narrower conversation.
Strengths
- Competitive open-weights models (DeepSeek V3, R1) available for self-hosted use
- Strong reasoning performance at significantly lower training cost than Western peers
- Self-hosted deployment removes PRC jurisdictional concerns from the data path
Concerns
- Hosted consumer app stores data on PRC servers subject to National Intelligence Law
- Italian Garante ordered the app blocked citing failed GDPR compliance demonstrations
- No SOC 2 Type II, no FedRAMP, no HIPAA BAA disclosed
- Parent company (High-Flyer) is a Chinese hedge fund with opaque governance
Best for
- Researchers and teams using DeepSeek open weights in self-hosted deployments
- Use cases where benchmarking or comparing against Chinese frontier models is the goal
Avoid if
- You are considering the hosted DeepSeek app for any enterprise or personal data
- You are a US government contractor, critical infrastructure, or defense-adjacent organization
- You are subject to EU GDPR enforcement (already blocked in Italy)
- You process any PII, PHI, or regulated data through the hosted service
Citations
- Data Handling — Data Residency Options
We store and process your personal information on servers located in the People's Republic of China.
- Data Handling — Third Party Data Sharing
We may be required to share your information with law enforcement, regulators, and government bodies in China pursuant to applicable law.
- Data Handling — Trains On User Data
We may use your inputs and outputs to improve our Services, including to train our models, unless you are using the Enterprise API with a no-training agreement.
- Governance — Government Ties
DeepSeek operates under China's cybersecurity and national intelligence laws, which can compel cooperation with state authorities.
- Jurisdiction Profiles — Incorporation Country
DeepSeek is a Chinese AI company based in Hangzhou, owned by High-Flyer, a Chinese quantitative hedge fund.
- Jurisdiction Profiles — Subject To China Jurisdiction
Italy's Garante ordered DeepSeek to block its service, citing concerns over data being transferred to and processed in China under PRC jurisdiction.
- Security Compliance — Gdpr Compliant
The Italian data protection authority found DeepSeek failed to demonstrate GDPR compliance and ordered the app blocked in Italy.
- Security Compliance — Soc2 Type2
No public SOC 2 Type II report is available for DeepSeek as of April 2026.