Is your AI tool safe with your data? What to check first

In January 2025, an AI chatbot most people had never heard of shot to the top of the app charts. DeepSeek was fast, capable, and free. Within days, people everywhere were pasting their work into it.

Almost nobody stopped to ask where that work was going.

The answer was not reassuring

Start with storage. DeepSeek keeps user data on servers in China, which puts it under Chinese data law. Spoiler alert: that doesn't line up neatly with Western privacy standards. The US Navy didn't wait for a study. It told its personnel not to use the tool in any capacity.

Then came the leak. Security researchers at Wiz went looking and, within minutes, found a DeepSeek database sitting open on the internet with no login required. Chat histories, API keys, backend details, the whole enchilada. DeepSeek locked it down quickly once told. Still, that's no minor technical oopsie. It tells you how much attention security was getting.

And then there's what the tool will and won't say. Ask about Tiananmen Square or Taiwan and, by many reports, you get a polite change of subject. Which raises a fair question: are you getting answers, or an approved version of them?

Before you feel smug

It's tempting to file this under "foreign app, not my problem." Don't.

The lesson of DeepSeek goes beyond one company or one country. Most organizations had no way to answer basic questions about a tool their people were already using. That same blind spot applies to the AI products you do trust. A US headquarters and a published privacy policy are a better starting point. They are not a security review.

Five questions to ask of any AI tool

1. Where does our data go, and who can get at it? Country, legal jurisdiction, and subcontractors all matter.
2. Is what we type used to train the model? If so, can we turn that off, and is that in writing?
3. What is the vendor's security record? Look for independent audits, certifications, and how they handled past incidents.
4. Does it filter or shape its answers? If so, by whose rules?
5. Who in our organization approved it? If the answer is "nobody, people just started using it," you've found your first governance project.

Free is a price

The cost of "free" or "cool" can be your data, your compliance, or your credibility.

None of this means banning AI. It means knowing what your people are using, deciding what's allowed for which kinds of information, and writing it down.

That's AI governance. It's less exciting than a new chatbot, and it's the reason you'll still be allowed to use the next one.

A shorter version of this article first appeared on LinkedIn. Join the discussion there.