DeepSeek: sensitive data

1. 01DeepSeek trains on customer data. Block the app or move users to a business tier that excludes training.
2. 02Every DLP match for DeepSeek was audit or warn only (All Full Names, Source Code). The policy sees the data leaving and lets it go. Move the rule to Block for these information types, at least for uploads and pastes to unsanctioned AI sites.
3. 03High-impact information types were involved (All Full Names, Source Code). Treat this as a data incident: confirm with the user what was pasted, and check the vendor's retention terms for the accounts involved.

• ▲Critical75DeepSeekNetwork2 people
• ●Medium40DeepSeekEndpoint2 people
• ◆High62DeepSeekSIEM · Splunk (demo)1 person

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. dlp_activity · Sep 10, 2026
   2 DLP events for DeepSeek by 2 people in 30 days: 0 blocked, 0 warned, 0 overridden, 2 audit only; types: All Full Names, Source Code
   Detail

   {
     "domains": [
       {
         "count": 2,
         "domain": "chat.deepseek.com"
       }
     ],
     "byAction": {
       "warn": 0,
       "audit": 2,
       "block": 0,
       "unknown": 0,
       "override": 0
     },
     "policies": [
       {
         "name": "Endpoint DLP - Source code",
         "count": 1
       },
       {
         "name": "Endpoint DLP - Customer data",
         "count": 1
       }
     ],
     "applications": [
       {
         "count": 1,
         "application": "chrome.exe"
       },
       {
         "count": 1,
         "application": "msedge.exe"
       }
     ],
     "sensitiveTypes": [
       {
         "name": "All Full Names",
         "count": 1,
         "matches": 30
       },
       {
         "name": "Source Code",
         "count": 1,
         "matches": 1
       }
     ]
   }

2. dlp_audit · Sep 5, 2026
   TextPastedToBrowser to chat.deepseek.com by [email protected]: Source Code ×1 (audit)
   Detail

   {
     "policies": [
       "Endpoint DLP - Source code"
     ],
     "recordId": "ual-0103",
     "application": "chrome.exe"
   }

3. dlp_audit · Sep 10, 2026
   FileUploadedToCloud 'pricing-model.xlsx' to chat.deepseek.com by [email protected]: All Full Names ×30 (audit)
   Detail

   {
     "policies": [
       "Endpoint DLP - Customer data"
     ],
     "recordId": "ual-0104",
     "application": "msedge.exe"
   }

4. corroboration
   Also found by another lane (mdca:40311)
   Detail

   {
     "findingKey": "mdca:40311"
   }

5. corroboration
   Also found by another lane (mde:deepseek)
   Detail

   {
     "findingKey": "mde:deepseek"
   }