Are Chinese AI models safe to use?

Where your data goes depends on how you reach the model

Chinese labs like DeepSeek, Alibaba (Qwen), Moonshot (Kimi) and Z.ai (GLM) publish their models as open weights: the trained model is a file anyone can download and run. So the same model can reach you three ways, and your data goes somewhere different in each.

Many people assume that using a Chinese model means sending data to China. The model file travels; your data only goes where the service you use sends it. Running a model on your own machine needs serious hardware for the larger models, so the usual alternative to the official app is another app or hosting company that runs it for you. That moves the question to the host: where it runs, and whether it keeps or trains on what you send. More on how open weights work is in why China open-sources its AI while the US keeps it closed.

Is the DeepSeek app safe?

For anything you'd mind a company in China keeping, treat it with care. DeepSeek's privacy policy (last updated 10 February 2026) says it will "collect, process and store your Personal Data in People's Republic of China". What it collects includes your prompts, uploaded files, photos and chat history. It uses that data "to train and improve our technology", and lists a right to opt out of training by emailing privacy@deepseek.com.

The legal concern people cite is China's National Intelligence Law (2017). Its Article 7 says organizations and citizens shall "support, assist, and cooperate with national intelligence efforts". Governments point to this law when they restrict Chinese apps. Whether any particular user's chats have ever been handed over is not public.

There is also a security record. On 29 January 2025, the security firm Wiz reported that it had found a DeepSeek database open to the internet with no password. It held over a million lines of logs, including chat history and secret keys. DeepSeek locked it down after Wiz told it (Wiz Research, 29 January 2025).

For casual questions, the risk is the same kind you take with any free chatbot run by a foreign company, with the addition of Chinese law. For health records, client documents, passwords or anything from work, keep it out of the DeepSeek app. A side-by-side of the two apps is in DeepSeek app vs ChatGPT app.

Which governments have banned DeepSeek?

Several, most of them in early 2025. Most cover government devices only. Italy's block and South Korea's pause on downloads are the two that reached ordinary users.

Sources: Australia's PSPF Direction 001-2025 (4 February 2025), the Garante's order (30 January 2025), the National Defense Authorization Act for Fiscal Year 2026 (sections 1532 and 6604), and reports at the time by CNBC, the Associated Press, Yonhap and Reuters. A separate bill to ban DeepSeek across US federal agencies, the No DeepSeek on Government Devices Act, was introduced in the House (H.R. 1121) on 7 February 2025 and in the Senate (S. 765) on 27 February 2025. As of October 2026 neither version had passed.

Do Chinese AI models censor answers?

Yes, on topics the Chinese government treats as sensitive. In January 2025, the testing company Promptfoo sent DeepSeek R1 1,360 prompts about subjects like Taiwan, Tiananmen and Xi Jinping. About 85% got a refusal or a canned answer that backed the government line (Promptfoo, 28 January 2025). Promptfoo ran that test through OpenRouter, outside DeepSeek's app. The censorship is trained into the model, so a host in the US or Europe serves the same behavior.

NIST's Center for AI Standards and Innovation (CAISI) found the same pattern in a broader test: DeepSeek's models "echoed four times as many inaccurate and misleading CCP narratives" as the US models it compared them with (NIST CAISI, 30 September 2025).

In practice this matters for questions about Chinese politics, history and territory. It rarely touches an email or a recipe. If you ask a Chinese model about those topics, check the answer somewhere else.

How Chinese models score in safety tests

The published results are mostly about DeepSeek, and mostly about versions from 2025.

Western models fail some of these tests too, as Cisco's GPT-4o figure shows. The pattern across these tests is that the Chinese models tested refuse less, and that their guardrails can be removed by anyone who downloads the weights. Once someone runs the weights on their own hardware, the developer's safeguards no longer apply: they can strip or change them, or retrain the model (TechCrunch, 4 August 2026, reporting on SaferAI's GLM-5.2 test).

For an ordinary person asking everyday questions, a weak refusal mostly affects what other people can get out of the model. It doesn't put your own chats at risk. It matters more if you give an AI agent access to your email, files or accounts, where NIST's agent-hijacking result is the one to take seriously. Why these models are so cheap in the first place is covered in why Chinese AI models are cheaper.

How Plainly handles Chinese models

Plainly runs one capable open-source model and switches when a better one comes out. You never pick. That model may be Chinese-developed, and often has been, so this question applies to Plainly too.

Plainly reaches the model through OpenRouter, a service that passes each request to a hosting company. It never sends your chats to DeepSeek's app. Plainly's OpenRouter account excludes hosts that train on prompts. On 11 October 2026, OpenRouter listed DeepSeek's own hosted service as one that may train on prompts and keeps them, so Plainly's requests don't go there.

That setting is about training. It doesn't filter by country. On the same date, OpenRouter listed two hosts of the model Plainly ran with headquarters in China, Baidu and StreamLake. Both state they don't train on prompts, so the setting allows them, and both keep prompts for a period. Some hosts in other countries keep prompts for a period too. Plainly makes no zero-retention promise; what it promises is that your chats are never used to train AI, and nobody at Plainly reads them unless you ask or the law requires it. What Plainly itself keeps is listed in does Plainly train on your chats.

The censorship travels with the model, so Plainly can give a cautious or one-sided answer about Chinese politics like any other app running the same model.

A checklist before you use a Chinese AI model

1. Decide which risk you care about: where your words go, or what the model says back.
2. If you use DeepSeek's app or website, assume what you type is stored in China and may train its models. Keep health details, financial records, passwords and work documents out of it.
3. If your employer or a government agency bans it on work devices, follow the rule. Those bans cover work devices, and your personal phone is a separate matter.
4. To use the same model without DeepSeek's servers, use an app or host outside China, and read who hosts it and whether it trains on or keeps prompts.
5. For anything about Chinese politics, history or Taiwan, check the answer against another source.
6. Before you let any AI agent act on your email, files or accounts, look for its safety test results. The 2025 results for DeepSeek were poor.