Back to Blog
Artificial Intelligence

DeepSeek and U.S. Enterprise AI: Why Companies Are Switching, and What the Security Tradeoffs Actually Are

Ramp data shows U.S. firms paying DeepSeek directly for cheaper inference — but hosted API use routes data to China under PRC law. A technical breakdown of cost pressure, documented risks, self-hosting nuance, and what security claims hold up.

14 min read
Alireza Barzin Zanganeh
deepseek ai security data privacy enterprise ai llm

In June 2026, DeepSeek topped Ramp’s trending software vendors list — first-time purchases across 50,000+ U.S. businesses. That is not a market takeover: Anthropic (~34%) and OpenAI (~32%) still lead enterprise adoption; DeepSeek’s actual share sits below 1%. But Ramp’s data shows many firms are paying DeepSeek directly, routing prompts to China-hosted infrastructure. The reason is cost. The question is whether that cost is worth it.

Split illustration: left side shows a neural network with dollar signs for low-cost AI tokens; right side shows U.S. and China with a shield and lock, representing cross-border data security risks for enterprise DeepSeek adoption.
Cheaper tokens vs. hosted API risk: cost pressure, data residency, and enterprise compliance

Two deployment paths — very different risk profiles

Most public debate conflates two architecturally distinct choices:

Path What happens to your data
Hosted API (DeepSeek cloud, chat apps, mobile clients) Prompts, files, and chat history go to DeepSeek-operated servers. Privacy policy: stored in the People’s Republic of China.
Self-hosted open weights (your VPC, on-prem GPU, or a Western inference provider) Data stays on infrastructure you control. No cross-border transfer required.

Cross-border risk attaches to the service, not the model weights. The rest of this post is mostly about the hosted API path, because that is the one Ramp’s data shows companies paying for.

Why companies are moving

Token economics

As of mid-2026, output token pricing (per million):

  • DeepSeek V4 Pro: $0.44 input / $0.87 output
  • GPT-5.5: $5 input / $30 output
  • Claude Opus 4.7: $5 input / $25 output

DeepSeek is roughly 30–35× cheaper on output. Vercel’s AI Gateway recorded DeepSeek jumping to 17% of token volume while staying near 1% of actual spend — exactly what you expect when a provider underprices to gain share. At agent scale, where workflows chain dozens of LLM calls, that gap becomes a P&L line item. Lindy’s CEO publicly moved 100% of production traffic from Anthropic to DeepSeek V4, citing millions in savings.

Capability and open weights

DeepSeek V4 Pro benchmarks close to Claude Opus 4.7 and GPT-5.5 on many document and code workflows. Not every task needs the most expensive tier. And because the weights are open, a team can self-host on U.S. or EU infrastructure and get similar model performance without touching DeepSeek’s cloud. You don’t self-host to beat the API on price — you self-host for data sovereignty.

The security question: what is technically true?

Data residency and legal access

DeepSeek’s privacy policy explicitly states data is stored in the PRC and may be shared with authorities to comply with Chinese law. Under China’s Cybersecurity Law, Data Security Law, and PIPL, the government can compel access in ways that do not match what U.S. enterprises expect from SOC 2–audited American vendors.

A fair nuance: the U.S. CLOUD Act also lets law enforcement reach data at American providers. The real difference for enterprises is not “zero access vs. total access” — it is:

  • Which legal system governs breach notification and disputes
  • Whether the vendor signs DPAs, HIPAA BAAs, and zero-retention addenda
  • Whether you have audit rights and VPC endpoints your customers already approved
  • Geopolitical exposure for export-controlled or federally funded data

OpenAI and Anthropic’s enterprise programs are imperfect, but they are built for procurement. DeepSeek’s consumer-grade hosted API is not.

Documented incidents (not theoretical)

  • Jan 2025 — Wiz Research: Two ClickHouse databases left open without authentication, exposing ~1M log entries including chat history, API keys, and backend secrets.
  • Feb 2025 — NowSecure: DeepSeek’s iOS app globally disabled Apple’s App Transport Security, sending data unencrypted over ByteDance-controlled (Volcengine) infrastructure.
  • 2025 — Feroot Security: Researchers alleged undisclosed data flows to China Mobile–linked endpoints in DeepSeek web/mobile clients.

These do not prove intentional backdoors. They do show that operational security maturity on consumer-facing paths has not met enterprise bar. A SOC 2 report you cannot obtain is a gap, not a neutral data point.

Government response

NASA, DoD, Commerce, Energy, and Transportation have blocked DeepSeek on government devices. Texas, New York, Virginia, and others enacted state-level bans. Bipartisan bills in Congress would formalize a federal prohibition. Italy removed the app over GDPR concerns. For private companies these are signals, not law — unless you are a federal contractor. But if NASA will not run it on a laptop, your CISO will ask why your customer support bot does.

Shadow AI

DeepSeek is free and browser-accessible. Employees paste incident tickets, HR cases, and unreleased code into chat UIs without DLP review. The real enterprise risk is often unmanaged egress, not a signed contract. Discovery tools, proxy blocking, and an approved alternative are table stakes.

Pros and cons

Hosted API

  • Pro — Cost: 30–35× cheaper output tokens vs. GPT-5.5.
  • Pro — Performance: Competitive on many agent and document benchmarks.
  • Pro — Ergonomics: OpenAI- and Anthropic-compatible endpoints; low migration friction.
  • Con — Data residency: Prompts stored in China under PRC law.
  • Con — Compliance gaps: No DPA, BAA, FedRAMP, or customer-managed encryption keys.
  • Con — Incident history: Documented misconfigurations and insecure mobile-client transport.
  • Con — Policy risk: Export controls or sudden platform restrictions can break production overnight.

Self-hosted weights

  • Pro — Sovereignty: Prompts never leave your VPC if architected correctly.
  • Pro — Compliance path: Feasible even for air-gapped or highly regulated environments.
  • Con — Ops burden: GPU capacity, model serving, patching, and on-call are yours.
  • Con — TCO: For moderate or bursty volume, hosted API can still undercut self-hosted cost.
  • Con — Provenance: You still trust the upstream weights; supply-chain review is your job.

Decision matrix

Workload Hosted DeepSeek API Self-hosted weights U.S. enterprise API
Public marketing copy, no PII Low friction; cost win Overkill unless volume is huge Fine; pay premium for simplicity
Internal code assist on private repos High IP leakage risk Preferred if cost-sensitive Preferred with DPA + audit
Customer PII / PHI / payment data Do not use Only with full compliance review Default choice with BAA/DPA
High-volume agent loops Economically rational; governance hard Common enterprise compromise Often prohibitive on unit economics
Government / defense / critical infrastructure Effectively banned Case-by-case with air-gap Required (FedRAMP / IL paths)

What I would actually implement

  1. Classify data before classifying models. If it cannot be logged or leave the U.S., it does not go to any public API without review.
  2. Route by sensitivity tier. Cheap foreign inference for sanitized workloads; U.S. enterprise APIs or private deployment for regulated ones. Gateways like LiteLLM or Vercel AI Gateway make this enforceable.
  3. Assume shadow AI is already happening. Block consumer DeepSeek endpoints at the proxy; offer an approved path so employees have an alternative.
  4. If sovereignty is the real constraint, self-host on a U.S.-region GPU cluster. Treat the GPU bill as a compliance line item, not an ops cost.

Bottom line

The security concern — U.S. data on China-hosted inference — is technically valid for the hosted API path: DeepSeek’s own policy, PRC law, and documented incidents all support it. It is not valid for self-hosted deployments, and “China has no rules” is an oversimplification — the issue is different rules, with different threat models, lacking the contractual controls U.S. enterprises expect. The right answer is architectural: match provider to data classification, document your data flows, and treat pricing as a security tradeoff you explicitly accept or engineer around.

Key takeaways

  • Why the shift: 30–35× cheaper output tokens; agent workloads magnify the gap.
  • Hosted API risk: PRC storage, lawful government access, no enterprise compliance tooling, documented incidents.
  • Self-hosted: Same model, no cross-border transfer — but GPUs, ops, and provenance are on you.
  • Scale reality: Trending ≠ dominant; U.S. share is growing but still small.
  • The answer: Segmented routing beats a blanket yes/no on “Chinese AI.”

Sources

#DeepSeek #AISecurity #DataPrivacy #EnterpriseAI #LLM #CloudSecurity #AIGovernance #Infosec