Vendors · Questionnaire · DeepSeek
Read DeepSeek’s own answers to nine buyer questions
DeepSeek services and Open Platform. Each answer quotes DeepSeek’s own page or feed as kept on the day shown. Each question cites the NIST text that asks it. The answers are not a score and not a verdict.
Q1
Does the vendor train its models on business and API customers’ data?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not published in the pages kept
Searched: DeepSeek Privacy Policy; DeepSeek Open Platform Terms of Service; Rate Limit & Isolation.
Q2
Does the vendor train its models on free and consumer use of its products?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Listed as a use of personal data
To improve and develop the Services and to train and improve our technology, such as our machine learning models and algorithms.
DeepSeek Privacy Policy, kept 24 Oct 2026 · sha256 339984e36a79
Q3
How long does the vendor keep the data that customers send?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
As long as necessary; inputs are kept for as long as you have an account
we keep this Personal Data for as long as you have an account. This Personal Data includes your account Personal Data, input and payment Personal Data.
Under “How Long Do We Keep Your Personal Data”, given as an example of the general rule: “We retain Personal Data for as long as necessary to provide our Services and for the other purposes set out in this Privacy Policy.” The Privacy Policy does not cover end users of apps built on the Open Platform. DeepSeek Privacy Policy, kept 24 Oct 2026 · sha256 339984e36a79
Q4
Can a customer have the vendor keep none of its data?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Not published in the pages kept
Searched: DeepSeek Privacy Policy; DeepSeek Open Platform Terms of Service; Rate Limit & Isolation.
Q5
Where does the vendor process and store customer data?
NIST AI 600-1, action GV-6.1-009: “Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy …”
NIST AI RMF 1.0, GOVERN 6.1
Personal data collected, processed and stored in the People’s Republic of China
To provide you with our services, we directly collect, process and store your Personal Data in People's Republic of China.
DeepSeek Privacy Policy, kept 24 Oct 2026 · sha256 339984e36a79
Q6
Which other companies process customer data for the vendor?
NIST AI 600-1, action GV-6.1-007: “Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.”
NIST AI RMF 1.0, GOVERN 6.1; NIST AI RMF 1.0, MANAGE 3.1
Service providers by category; no list in the kept pages
We engage service providers that help us provide, support, and develop the Services and understand how they are used.
DeepSeek Privacy Policy, kept 24 Oct 2026 · sha256 339984e36a79
Q7
Which independent audits or certifications does the vendor name?
NIST AI 600-1, Appendix A.1.3: “statement on standards for attestation engagement (SSAE) reports to help with third-party transparency and risk management for GAI systems”
NIST AI RMF 1.0, GOVERN 6.1
Not published in the pages kept
Searched: DeepSeek Privacy Policy; DeepSeek Open Platform Terms of Service; Rate Limit & Isolation.
Q8
Does the vendor publish a history of its service incidents?
NIST AI 600-1, action GV-6.2-007: “Service Level Agreements (SLAs) in vendor contracts that address incident response, response times, and availability of critical support.”
NIST AI RMF 1.0, GOVERN 6.2
Yes: a status history feed, with 36 incidents kept since 2026-07-28
Status history feed, kept 1 Nov 2026 · sha256 367102b1baad. The record.
Q9
Does the vendor publish the dates on which it retires its models?
NIST AI 600-1, action GV-6.2-007: “Review vendor contracts and avoid arbitrary or capricious termination of critical GAI technologies or vendor services …”
NIST AI RMF 1.0, GOVERN 6.2
No answer kept
The change log names model updates but gives no table of deprecation or retirement dates. The page.
- DeepSeek, DeepSeek Privacy Policy, kept 24 Oct 2026.
- DeepSeek, Status history feed, kept 1 Nov 2026.
- NIST, NIST AI 600-1, 2024-07. Republished courtesy of the National Institute of Standards and Technology.