The short answer
DeepSeek publishes some of the strongest open-weight models anyone has released, under an unmodified MIT licence, and sells hosted access at a fraction of what the major US labs charge. All of that is verifiable from DeepSeek's own model cards and pricing page. So is this: its privacy policy states that it collects, processes and stores personal data in the People's Republic of China, and a list of governments have barred its app from official devices.
Those facts get argued about as though they settle one question: can we use DeepSeek or not. They don't, because it's two questions. Are the models good enough for the job, and where does the inference actually run?
The distinction that does most of the work: calling api.deepseek.com sends your prompts to DeepSeek's infrastructure. Downloading the MIT-licensed weights and running them on your own hardware, or paying a US or EU provider to serve those same weights, sends DeepSeek nothing. Same model, completely different data-governance profile. Most public argument collapses those two into one thing, which is why businesses either rule DeepSeek out entirely or adopt it without thinking.
What DeepSeek is and who builds it
DeepSeek is an AI company founded in July 2023 by Liang Wenfeng, spun out of the AI lab inside High-Flyer, a Hangzhou-based Chinese quantitative hedge fund he co-founded in 2016. The hedge-fund origin explains a lot: it was built by people who already owned a GPU cluster and had no need to monetise a chat product, which is roughly why it gives the weights away.
As of September 2026 the current generation is V4. DeepSeek's API docs list deepseek-v4-flash (build 0731), deepseek-v4-pro (build 0813), and deepseek-v4-flash-vision-exp, an experimental model taking image input. The API advertises a 1 million token input context and 384K maximum output. Check the live models page before building — the build suffixes move.
Both main models are Mixture-of-Experts, which matters more than it sounds. V4-Pro's model card lists 1.6 trillion total parameters with 49 billion activated per token; V4-Flash lists 284 billion with 13 billion activated. Total parameters set the memory needed to hold the model; activated parameters set compute per token. MoE is why DeepSeek offers frontier-scale capability at small-model prices — and why self-hosting the big one is harder than the price tag suggests.
Migration is deliberately easy. DeepSeek's docs state the API is format-compatible with both OpenAI and Anthropic, so existing SDKs point at it with a base-URL change. Tool calling, JSON output, a Files API, prefix completion and fill-in-the-middle are documented.
Where DeepSeek is genuinely competitive
Be fair here, because the reason people keep asking isn't ideology. The models are good and the price is low. DeepSeek's strongest showing has consistently been reasoning and code, and the company positions V4-Pro as competitive with the leading open models on agentic coding and multi-step problems. I won't quote benchmark numbers — vendor-reported scores on self-selected evals go stale in weeks. What holds up longer is the shape: a long-context MoE reasoning model with documented tool calling, suiting document processing, code assistance, extraction and agent work.
The million-token context isn't marketing. Problems that would otherwise need a retrieval pipeline can be handed to the model whole — a full contract set, a small codebase, a year of support tickets. On cost, DeepSeek sits at the aggressive end of the market and has for two generations. Whether it beats your provider on cost per completed task rather than cost per token is a separate question: a cheap model that reasons at length into a wrong answer is not cheap.
Hosted API versus open weights: the distinction that decides this
Everything contentious about DeepSeek attaches to one deployment path and not the others.
What the hosted API does with your data
DeepSeek's privacy policy is explicit: the company directly collects, processes and stores personal data in the People's Republic of China. It describes collecting user inputs, prompts and uploaded files alongside IP addresses, device identifiers and usage logs. It also carries a line businesses should read as a live instruction, not boilerplate — DeepSeek states that it does not ask for, and you should not provide, sensitive personal data to the services.
Take that at face value: the vendor is telling you not to send it sensitive data. If your workload touches client PII, health information, financial records, legal matter files or anything under a confidentiality obligation, the hosted API is disqualified on the vendor's own terms, before any geopolitical argument.
Whether your API traffic is used for model improvement has changed over time and varies by account tier — read the current terms before sending production data, and get any data-isolation commitment in writing.
None of this is unique to DeepSeek in kind — every hosted model API is a data processor you're trusting. What differs is jurisdiction. Data resident in China is subject to Chinese law, and the mechanisms you'd normally rely on — a DPA, an EU adequacy decision, a US enterprise contract — aren't straightforwardly available. That's a procurement fact, not a moral position, and you'd run the identical analysis on any overseas vendor whose legal environment you can't reach into.
What running the open weights does instead
It sends nothing anywhere. This is the part that gets lost.
I read the licence file directly rather than trusting a summary: the LICENSE in the DeepSeek-V4-Pro repository on Hugging Face is the standard, unmodified MIT License. Not a bespoke community licence, not a Llama-style acceptable-use addendum, not a revenue threshold. Commercial use, modification and redistribution are permitted; the only obligation is carrying the copyright notice. V4-Flash ships on the same terms.
That's unusually permissive at this capability level, and it's the whole ballgame if you have a data-residency problem. Weights under MIT are files you own a copy of. On a server in your own rack or cloud account, the model has no phone-home path and no vendor telemetry. You can air-gap the box. DeepSeek's privacy policy becomes irrelevant, because you aren't a user of their service — you're a user of a file they published.
This is the same argument that applies to every open-weight model worth running, and it's why self-hosting is a data-governance tool before it's a cost tool. DeepSeek just makes it sharper, because the gap between the two paths is far wider than for a US vendor.
The thing self-hosting does not fix
Self-hosting solves data residency. It does not change how the model behaves, and that behaviour on politically sensitive topics is documented and reproducible.
The clearest evidence is a study called R1dacted (arXiv 2505.12625), which examined censorship in DeepSeek's R1 and found the alignment applied at the model level, persisting when the model was deployed privately. Run locally, the refusal and template-response behaviour on China-sensitive questions was still there. The researchers also found the hosted web chatbot adds further filtering on top — the platform layers more on, but the base weights carry the behaviour on their own.
NIST's Center for AI Standards and Innovation reached a compatible conclusion in a September 2025 evaluation, reporting that DeepSeek models echoed inaccurate CCP narratives several times more often than the US models tested against, with censorship patterns that appeared baked into the model rather than applied service-side. That report covered the R1-0528 and V3.1 generation, not V4, so treat its figures as historical. It also flagged materially higher susceptibility to jailbreaking and agent-hijacking — arguably the more operationally relevant finding if you're wiring a model into an agent that can act.
Commercially this means little for most workloads: a model that deflects on Chinese political history is not impaired at extracting invoice line items or drafting a support reply. But if your product touches journalism, policy research, education or human rights work, and a user could get a state-aligned answer under your brand, that's a product defect you own. Test your real prompts before deciding it doesn't apply.
The government restrictions, factually
The list of official restrictions is real and growing, and almost universally narrower than the headlines suggest.
In the United States, the Department of Commerce and the Navy have barred DeepSeek from government-furnished devices, and states including New York, Virginia, Tennessee and Texas have done the same for state equipment. A No DeepSeek on Government Devices Act was introduced in the 119th Congress; I could not verify its status, so treat it as introduced legislation, not settled law.
Internationally, Italy's data protection authority ordered DeepSeek's chatbot blocked in January 2025 after finding its response to information requests inadequate. Australia barred it from government devices in February 2025, officials stating explicitly that the decision rested on assessed security risk rather than the app's country of origin. South Korea's privacy regulator suspended new downloads pending compliance with Korean data protection law.
Note what those actions have in common. They target the consumer app and the hosted service, on government-managed devices and in national app stores — data protection and device-security actions. None is a finding that the MIT-licensed weights are unsafe on your own hardware, and none prohibits a private business from running them. If you sell into the public sector that may still not save you: procurement rules and client security questionnaires frequently ban a vendor's name outright, with no interest in your deployment topology. Check your contracts before your architecture.
Three deployment paths and what each costs you
Path one: DeepSeek's hosted API. Cheapest per token, zero infrastructure, five minutes to first call, OpenAI-compatible so existing code mostly works. Your data goes to infrastructure in China. Fine for prototyping with synthetic or public data; not for client data, regulated data, or anything under an NDA.
Path two: a Western inference provider serving the open weights. The underused middle option, and the right default for most businesses wanting DeepSeek's economics without the residency problem. Providers including Fireworks AI and Together AI host DeepSeek V4 on US infrastructure; the big cloud marketplaces have lagged a generation behind, so verify which version a provider serves. You get a normal US vendor relationship — a DPA, defined retention, an SLA — running identical MIT-licensed weights, at a markup that's still cheap.
Path three: your own hardware. Maximum control, and the one people underestimate. V4-Pro's 1.6 trillion total parameters must sit in memory regardless of how few activate per token, putting the weights alone in the hundreds of gigabytes even heavily quantised. That's a multi-GPU server, not a workstation with a good graphics card. V4-Flash at 284 billion is more tractable but still a serious box. Price it against our local LLM cost and hardware guide — for most small and mid-sized businesses, path two beats owning silicon until volume is large or compliance requires the machine to be yours.
There's a fourth path people forget: don't use DeepSeek. The other open-weight families deserve evaluation in the same pass rather than treating this as DeepSeek-or-nothing.
What actually drives your spend
DeepSeek's published API pricing as of September 2026 is per million tokens and splits three ways: cache-hit input, cache-miss input, output. At peak rates, deepseek-v4-flash lists $0.014, $0.44 and $1.32; deepseek-v4-pro lists $0.044, $1.32 and $3.96. Off-peak rates are half of peak on a published UTC schedule. Verify on the live pricing page — this is exactly the number that moves.
The structure teaches more than the figures. Three things drive your bill.
Output tokens dominate. Output is priced several times above cache-miss input on both models, and reasoning models emit long internal chains you pay for. A model that thinks for two thousand tokens to save four hundred of output has saved you nothing. Measure cost per completed task on your real prompts.
Caching is the biggest single lever and it's automatic. DeepSeek's context caching is on by default with no code changes, works on matching prompt prefixes, and the API returns prompt_cache_hit_tokens and prompt_cache_miss_tokens so you can see your hit rate. The gap between cache-hit and cache-miss input pricing is roughly thirtyfold, which makes prompt architecture a cost decision: stable content — system prompt, schema, reference documents, few-shot examples — at the front, variable user input at the end. That reordering alone can cut input cost by an order of magnitude. Caching is best-effort and entries clear on their own, so treat it as an optimisation, not a guarantee.
Scheduling is free money. The off-peak discount is half price, so moving batch work — nightly document processing, bulk enrichment, report generation — into that window costs you a cron entry. And resist the million-token context as a default: stuffing an entire codebase into every request is a fast way to turn a cheap model expensive.
A decision framework you can apply
Run each workload through three gates in order, and stop at the first failure.
Gate one: what is in the prompt
Classify the data before you classify the model. If the prompt will ever contain client PII, health data, financial account details, legal matter content, credentials, unreleased financials, or anything under an NDA or regulatory regime, the hosted API is out. Not proceed-with-caution — out, on DeepSeek's own written advice. Move to path two or three, or use a different model. If the prompt holds only public data, synthetic test data, non-confidential internal content, or code you'd happily open-source, the hosted API is on the table.
This gate isn't DeepSeek-specific — it's the same triage that decides whether a law firm can use a hosted model at all, and if you haven't run it across your existing AI usage, DeepSeek is not your biggest exposure.
Gate two: does the model's behaviour reach your users
If output is consumed internally by staff who can sanity-check it, the documented content restrictions are a curiosity. If it's published, shown to customers, or drives an automated decision, you need to know how the model behaves at the edges of your domain. Write thirty adversarial prompts from your real use case, run them, read the answers. That's an afternoon, and it's the only version of this question with an answer specific to you.
If the model will drive an agent with write access — sending email, updating records, executing code — weigh the NIST findings on jailbreak and hijacking susceptibility. Those covered an earlier generation and V4 may differ, but test rather than assume improvement. Constrain tool permissions and require human approval on consequential actions regardless of model.
Gate three: what does procurement say
Check three documents before getting attached to an architecture: your customer contracts and their subprocessor and data-location clauses, the security questionnaires you've already answered for clients, and any procurement restrictions if you sell to government or regulated industries. Plenty of enterprise questionnaires now ask whether any Chinese-headquartered AI vendor sits in the stack. A self-hosted-weights answer is defensible — but you'll defend it in writing.
Pass all three and DeepSeek is a normal vendor decision, evaluated on quality and price like anything else. Fail gate one and the answer isn't no DeepSeek — it's not the hosted API.
Who should consider DeepSeek, and who shouldn't
Consider it if you have high-volume, low-sensitivity inference — document classification, code assistance on non-proprietary code, bulk content processing, internal research — and cost per token genuinely constrains what you can build. Consider it if you already run self-hosted infrastructure and want frontier-scale capability under a licence with no strings, or want a cheap strong option in a model-agnostic routing table.
Don't bother if your AI spend is a few hundred dollars a month. The price difference is smaller than the meeting you'd hold to discuss it. Use the model with the least explaining to do.
Don't use the hosted API if you handle regulated data, contract with government, have customer contracts restricting data location or subprocessors, or would struggle to explain the decision to your largest client. Self-hosted weights may still be fine — confirm it, don't assume it.
Avoid entirely if your product's output is public-facing and touches politics, journalism, education about world affairs, or human rights work. That model-level behaviour is a risk you can't patch out of the weights, and strong alternatives exist without it.
Frequently asked questions
The questions people actually search, answered directly.
Is DeepSeek safe for business use?
It depends entirely on deployment. The open weights on your own infrastructure, or a Western provider's, are as safe as any self-hosted model — nothing leaves your control. The hosted API sends prompts to China under Chinese jurisdiction: unsafe for confidential or regulated data, fine for public and synthetic data. Anyone answering this without asking which deployment you mean isn't answering it.
Is DeepSeek actually open source, or just free to use?
The weights are genuinely open. The V4-Pro and V4-Flash repositories on Hugging Face carry the standard, unmodified MIT License with no acceptable-use addendum, permitting commercial use, modification and redistribution — more permissive than most "open" model licences, which append usage restrictions or revenue thresholds. The strict term is open-weight rather than open-source, since training data and pipeline aren't published, but commercially it's about as unencumbered as it gets.
Does DeepSeek send my data to China, and can I avoid it?
Through the hosted API or consumer app, yes — DeepSeek's privacy policy states it collects, processes and stores personal data in the People's Republic of China. You can avoid it entirely, and this is the practical answer for most businesses: run the MIT-licensed weights on your own hardware, or use a Western provider such as Fireworks AI or Together AI serving them from US infrastructure. Same model, normal vendor relationship, modest markup — and DeepSeek receives nothing, because you never contact DeepSeek.
Is DeepSeek banned in the US?
Not for private businesses. The restrictions are device- and procurement-level: Commerce and the Navy barred it from government-furnished devices, and states including New York, Virginia, Tennessee and Texas did the same for state equipment. A No DeepSeek on Government Devices Act was introduced in Congress. None of that prohibits a private company from using DeepSeek, and none addresses running the open weights on your own hardware. If you contract with government, check your specific terms — they often go further.
Is DeepSeek censored, and does that matter for business use?
It applies content restrictions on topics politically sensitive in China, and research indicates this lives in the weights rather than a service-side filter — the R1dacted study found the behaviour persisted when the model ran privately, and NIST's evaluation agreed on an earlier generation. Practically this is irrelevant to invoice extraction, code generation or support drafting. It matters if your product is public-facing and users could ask about Chinese politics or history. Test your real prompts.
How does DeepSeek's API pricing compare to OpenAI or Anthropic?
DeepSeek is materially cheaper per token and has been across two generations. I'm not quoting competitor rates because model pricing changes monthly; pull current published rates and compare directly. Compare on three axes rather than one: cache-miss input, output, and cached input. DeepSeek's cache-hit rate sits far below its cache-miss rate, so a workload with a large stable prompt prefix shows a bigger advantage than a headline comparison suggests.
What hardware do I need to self-host DeepSeek?
More than most people expect. Mixture-of-Experts saves compute, not memory — every parameter must be loaded even though only a fraction activate per token. V4-Pro's 1.6 trillion parameters put the weights in the hundreds of gigabytes even heavily quantised: a multi-GPU server. V4-Flash at 284 billion is more approachable but still well beyond a single consumer card. For a local model on modest hardware, smaller open-weight models are the realistic route.
How to evaluate this in a week
Stop reading comparisons and run the test. Take your highest-volume workload and fifty real inputs, anything sensitive stripped. Run them through your current model and through DeepSeek V4 on a Western provider, recording correctness, tokens and cost. If the numbers favour DeepSeek and the three gates pass, adopt it for that workload — not for everything.
The broader principle outlasts this vendor. Build systems where the model is a swappable component and the API keys are yours. That turns a question like this into a config change instead of a migration, and it's why we build every system model-agnostic and BYOK, with clients paying model costs directly to the provider at no markup — typically $30 to $150 a month depending on volume. Automation builds start at $7,500 with a roughly 30-day typical timeline. If you'd rather first find out which workflows are worth automating at all, the free audit is a three-minute self-serve questionnaire returning an automation health score, what manual work costs you annually, and ranked quick wins. No call required.