Chart-Topping AI App DeepSeek Under Fire: Unencrypted Data Sent to Chinese Servers

Summary

DeepSeek, a generative AI app similar to ChatGPT, has been found to have significant security and privacy issues. Despite its rapid rise to the top of the US App Store charts in January 2025, the app is developed by a Chinese AI startup and has been criticized for several major lapses:

• Unencrypted Data Transmission: Sensitive user data is sent unencrypted, making it vulnerable to interception.
• Insecure Data Storage: User data is stored insecurely, increasing the risk of data breaches.
• Excessive Data Collection: The app collects extensive user and device data.
• Data Sent to Chinese Servers: User data is transmitted to servers owned by ByteDance, a Chinese company bound by Chinese laws that allow government access.
• Deprecated Encryption: Although DeepSeek uses 3DES encryption, it has been deprecated since 2016 due to security vulnerabilities. The app also hard-codes the same encryption keys for all users, further compromising security.
• Disabled Security Protocols: The app disables Apple's App Transport Security protocol, which enforces data encryption.

NowSecure, a mobile security firm, is continuing to investigate DeepSeek and has noted that the Android version of the app is even less secure. These issues raise significant concerns about user privacy and data protection.