DeepSeek V4 API Privacy: Attested, No Data to China
Run DeepSeek V4 Pro and V4 Flash on attested, non-Chinese infrastructure. No prompt or output storage by default, provable in hardware. OpenAI-compatible.
DeepSeek V4 on attested infrastructure: your prompts never reach the model vendor.
The worry behind "is the DeepSeek API safe" is specific. api.deepseek.com runs on the vendor's own infrastructure, several US states have restricted it on government devices, and a January 2025 incident exposed plaintext chat logs. The V4 weights themselves are MIT-licensed. The risk lives in where the endpoint runs.
TrustedRouter serves deepseek-v4-pro and deepseek-v4-flash through non-Chinese hosting providers inside a hardware-attested confidential-compute gateway. TrustedRouter does not store prompt or output content by default. Zero-Data-Retention and TEE tiers are available per route. Migration is one line: change base_url, keep your OpenAI SDK.
from openai import OpenAI
client = OpenAI(
base_url="https://api.trustedrouter.com/v1",
api_key=TR_KEY,
)
r = client.chat.completions.create(
model="deepseek-v4-pro", # or deepseek-v4-flash
messages=[{"role": "user", "content": "Summarize this contract."}],
)Served outside China
DeepSeek V4 routes run on non-Chinese hosting providers on attested infrastructure. Prompts do not go to the model vendor. EU-focused routing is available through the EU gateway.
Attestation you can run
The gateway source is open and the image digest is published. One curl with a nonce returns a JWT signed by the CPU vendor's root key, bound to the live TLS session. Details at /security.
Nothing stored by default
No prompt or output content is stored by default. Zero-Data-Retention routes add contractual guarantees; TEE routes keep prompts sealed even from the hosting provider. See zero data retention.
Run the attestation check yourself.
Other US hosts also serve DeepSeek outside China with zero-retention policies, and that is a real improvement over first-party routing. They still ask you to take the policy on faith. TrustedRouter's gateway proves it: run curl "https://api.trustedrouter.com/attestation?nonce=$NONCE" and check the returned JWT against the published image digest. Your compliance team gets evidence, plus the DPA, subprocessor list, and SOC 2 readiness documentation to assess it with.
Hosting is the control point for Chinese open-weights generally. In our testing, the same GLM weights answered 60 of 60 sensitive questions through TrustedRouter's enclave versus 30 of 60 via the vendor-hosted API; the filtering is host-applied, not in the weights. One anonymized proof point: a document-processing company scaled from zero to over a billion tokens per week through the attested gateway within three weeks of onboarding. And on DeepSeek R2: unreleased as of July 2026. V4 is what ships today, and it is live on TrustedRouter now. Try it in the playground or compare latency at measured benchmarks.
Questions
Is the DeepSeek API safe to use?
It depends on which endpoint you call. api.deepseek.com is the vendor's own service, and several US states have restricted it on government devices. TrustedRouter serves the same MIT-licensed V4 weights through non-Chinese hosting providers inside a hardware-attested gateway. Prompts do not go to the model vendor, and TrustedRouter does not store prompt or output content by default. You can verify the attestation live at any time instead of relying on a policy.
Does using DeepSeek through TrustedRouter send data to China?
No. DeepSeek V4 routes are served by non-Chinese hosting providers on attested infrastructure, so prompts never reach the model vendor. Zero-Data-Retention routes add a contractual guarantee that providers keep nothing, and TEE routes keep the prompt sealed even from the hosting provider. Each route's privacy tier is listed on the models page, and the attestation backing the claim is checkable live.
When will DeepSeek R2 be released?
R2 is unreleased as of July 2026, and no release date is confirmed. The current generation is V4, available as deepseek-v4-pro and deepseek-v4-flash, and both are live on TrustedRouter today. Because the API is OpenAI-compatible, pointing existing code at V4 now and at newer DeepSeek routes later is a one-line model-id change.
How do I migrate off the legacy deepseek-chat alias?
DeepSeek's legacy deepseek-chat alias is scheduled to retire on July 24, 2026. Moving to TrustedRouter takes two edits: set base_url to https://api.trustedrouter.com/v1 and pick a DeepSeek V4 route from the models page. Your OpenAI SDK and the rest of your code stay the same, and automatic provider fallback keeps requests flowing during provider outages.