DeepSeek

Strong models, a free tier, and a privacy policy that puts the data somewhere most enterprise policies already exclude. That makes it the clearest finding in most fleets.

What leaks through it

Everything the consumer tier receives is trained on, with no opt-out, and stored under a jurisdiction your policy probably names. The API host also turns up inside third-party tools that route through DeepSeek without saying so in their interface.

• chat.deepseek.com
• api.deepseek.com

Guardrails once it is inspected

Alectura intercepts only tools it has been tested against. Everything else is discovered, meaning you get the app, the devices running it and how often, but the content is never decrypted, so content rules cannot run on it yet.

Today DeepSeek is discovered: you get the app, the devices running it and how often, without decrypting anything. The rules below are the ones that apply to it, and they run once it is onboarded for inspection.

• BlockNo cloud credentialsALC-003

  Cloud keys stop at the device. On a destination with no deletion path, blocking is the only control that means anything.

• BlockBlock private keysALC-002

  Private key blocks are refused outright rather than masked.

• AlertInternal host / URL leakALC-005

  Internal hostnames and private IPs in the prompt, flagged with the device that sent them.

Those are the ones worth spelling out for DeepSeek. All 27 rules in the catalog apply, and you can see the full catalog.

What happens to whatever gets through

Model training

Inputs are used to train and improve the service on the consumer tier.

Retention

Retained for as long as the policy requires, with no consumer-facing opt-out.

Data residency

Stored on servers in the People’s Republic of China per the published privacy policy. This drives most enterprise blocks, ahead of any question about model quality.

The vendor’s own controls

• ·None at the consumer tier
• ·Self-hosting the open weights avoids the service entirely

Sources

• DeepSeek privacy policy

Vendor terms last checked August 14, 2026, and summarised from DeepSeek’s published documentation. Confirm against the sources above before writing policy around this page.