Broker guide
Is DeepSeek Safe for Client Data in 2026?
DeepSeek stores hosted-chat data in China. Learn what its privacy controls and Australia’s government-device ban mean for brokers and client records.
- Published
- Updated
No, DeepSeek’s hosted app is not a suitable place for your clients’ personal information because its policy places processing and storage in China. Keep real client records out of it, even when you turn off model training. Running a downloaded DeepSeek model offline is a separate arrangement with different risks.
Is DeepSeek Safe for Client Information?
DeepSeek’s hosted app sends information to a service outside your brokerage’s control, so keep client information out of its chats and uploads. A detailed loan scenario can identify someone through their circumstances even after you remove their name.
Your brokerage’s existing agreements with its approved software providers don’t automatically cover a separate DeepSeek account. Using a work email address also doesn’t create a business data-processing agreement. Before any AI service handles client records, the brokerage must approve that specific service and its data handling.
This is a recommendation about confidential broking work. It doesn’t mean every use of DeepSeek causes a breach or that Australian privacy obligations stop at the border. The wider AI privacy guides distinguish the controls different tools provide.
Where DeepSeek Stores Your Data
DeepSeek’s 2026 Privacy Policy says it will “store your Personal Data in People’s Republic of China”. It collects prompts, uploaded files and chat history, alongside account and device information.
The policy keeps personal data “for as long as necessary” for its stated purposes. It says account-related inputs are kept while you have an account, with other retention grounds including legal obligations. Closing a chat isn’t a promise of immediate deletion.
DeepSeek also uses personal data to “train and improve our technology”. Its 2026 Terms of Use describe de-identification before certain input and output uses and provide an opt-out. Neither statement makes uploading a client file an approved use.
For a business covered by the Privacy Act, Australian Privacy Principle 8 (APP 8) governs overseas disclosure. The Office of the Australian Information Commissioner’s APP 8 guidance generally requires reasonable steps to protect information before disclosure. It also explains the business’s accountability for an overseas recipient’s mishandling, subject to exceptions.
Server location alone doesn’t decide whether an arrangement is legally a disclosure.
Does Turning Off Training Make DeepSeek Safe?
No, turning off training doesn’t change where DeepSeek’s hosted service processes information. The Terms of Use say you can disable “Improve the model for everyone” to opt out of the input and output use described there. That setting doesn’t approve an overseas disclosure or establish the retention terms your brokerage needs.
The paid DeepSeek API is another hosted service, with separate Open Platform Terms of Service. Those terms distinguish developer responsibilities for downstream users’ personal information. Paying for API access doesn’t make the installation local, and the app’s settings aren’t a substitute for assessing an API integration’s agreement.
Government and Business Bans
The Australian Government’s DeepSeek ban applies to government systems and devices under Protective Security Policy Framework Direction 001-2025. The official direction register records its issue in 2025. It requires government entities to prevent access, use or installation and remove existing instances.
That direction doesn’t impose a nationwide ban on private mortgage brokerages or personal use. A brokerage can set its own workplace restriction. For your business, the practical response is to document whether DeepSeek is allowed and keep the hosted app off devices used for client work if it isn’t approved.
Treat a government restriction as a reason to assess the service, rather than proof that every private business has the same legal duty. A staff member’s personal account must follow the brokerage’s policy whenever they handle work information.
What a Broker Must Never Enter
Keep all real client information out of the DeepSeek hosted app, including information pasted into a prompt or visible in an attachment. Exclude the following information.
- Names and contact details, including information about guarantors or family members.
- Identification documents, tax file numbers and account numbers.
- Payslips, tax returns, bank statements and credit reports.
- Health information, hardship explanations and other sensitive circumstances.
- Application files, customer relationship management exports and screenshots containing client details.
In a hypothetical unsafe example, a broker replaces a client’s name but leaves their employer, exact salary and property address in a prompt. The client can still be identifiable. For general experimentation, create a wholly fictional scenario without copying a real file’s distinctive details.
DeepSeek publishes models that can run locally, which is different from using its hosted app or API. A genuinely offline installation processes prompts on your hardware. The software around the model still needs controls for access, saved conversations and backups, including any cloud connections.
The guide to local LLMs explains running a large language model on your own computer. Keep client records in your brokerage’s approved systems until the complete local setup has been assessed and approved for those records.
