Is DeepSeek safe for your AI agent? Where your prompts actually go

The model is a file; the host is the question

Open weights are a file of numbers. They cannot send anything anywhere: whatever hardware loads them does the work, and the company that owns that hardware is the one that sees your agent’s prompts. So “is DeepSeek safe?” splits into two questions with different answers. DeepSeek’s own app, website and API are a service run from China: its privacy policy (last updated February 10, 2026) says it will “collect, process and store your Personal Data in People’s Republic of China” and use it “to train and improve our technology, such as our machine learning models,” with a right to opt out of the training. The same model run by another company is governed by that company’s terms and that company’s location.

An agent sends more than a chat does. Every turn carries its instructions, its memory files, the conversation so far and whatever its tools just read, so the host sees your documents and messages as well as your questions. That is why the choice of host matters more for an agent than for a one-off question.

Who was serving DeepSeek V4.1 Flash on September 23, 2026

The hosts are the ones on the model’s OpenRouter page, and their policies and locations are the ones OpenRouter publishes in its provider data-policy table. Where it cannot establish a host’s policy, its zero-retention docs say it assumes the host “both retains and trains on data.”

• Keeps prompts and trains on them (1): DeepSeek’s own service, headquartered in China.
• Keeps prompts, does not train on them (4): StreamLake, headquartered in China; Alibaba Cloud, headquartered in Singapore with datacentres in Singapore and China; GMICloud and AtlasCloud, both in the US.
• Keeps nothing (20): among them DeepInfra, Fireworks, Together, Baseten, CoreWeave, Novita and Modal, none of the twenty listed with Chinese headquarters or datacentres.

None of the hosts that keep prompts says for how long. Other DeepSeek models have their own host lists, and the lists change, so read the model’s own providers page for the model your agent actually runs.

Where the default settings send it

OpenRouter’s default routing picks among hosts without a recent outage, weighted by the inverse square of the price, so cheaper hosts get most of the traffic. DeepSeek’s own endpoint is not the cheapest: it was listed at $0.15 per million input tokens, against $0.10 for the cheapest host. Worked through on that day’s list prices (arithmetic from the documented weighting, not measured traffic), an account that allows every host would send about 1 request in 15 to DeepSeek’s own service and about 1 in 8 to a host with Chinese headquarters or datacentres. An agent busy enough to make a few hundred requests a day would send a dozen or more of them to DeepSeek’s own service.

The two settings that decide it

Both live on your OpenRouter account’s privacy settings page, so they apply to every request your agent makes, whatever agent software sends it:

• Turn off providers that may train on your data. OpenRouter’s provider-policy docs: “If you opt out of training in your account settings, OpenRouter will not route to providers that train.” That removes DeepSeek’s own service. On the same arithmetic, about 1 request in 17 would still reach a Chinese-linked host that keeps prompts, because OpenRouter “does not have routing rules that change based on data retention policies.”
• Enforce zero data retention. It can be set for all models or for a model group, and DeepSeek falls in the “all other models” group. It limits routing to hosts that keep nothing, which for this model left twenty, none listed with Chinese headquarters or datacentres.

If you want particular hosts out whatever their policy, the same page takes a list of providers to ignore. The per-request versions of these controls, and what they do not cover, are in the OpenRouter data policy guide. The cost of strictness is a smaller pool: with zero retention on, this model still had twenty hosts, so an agent loses little.

Check which host actually answered

OpenRouter’s request logs name the provider that served each request. After a day of normal use, read them: if a host you meant to exclude appears, the setting is not doing what you think, and the logs are the evidence rather than the settings page. If your agent uses a key from DeepSeek’s own developer platform instead of a router, there is nothing to check: every request goes to DeepSeek’s service, under its policy.

Keeping the prompts on your own hardware

Because the weights are open, the other answer is to run them yourself, so that no host sees anything. That trades the privacy question for a hardware one: the model has to fit and run fast enough on a machine you own, and a model served that way needs the same tool-calling checks as any other. Running OpenClaw with Ollama covers the setup and those checks. Where your prompts go is also a separate question from how well a model behaves as an agent; the security floor for a model that runs tools is in the model guide.