Registry / compare
DeepSeek API (first-party) vs DeepSeek via Fireworks AI
The same dimension can grade differently depending on who serves the model. Every cell links to its source; grades are evidence grades, not endorsements.
| Dimension | DeepSeek API (first-party) | DeepSeek via Fireworks AI |
|---|---|---|
| SOC 2 Type II | ○No public evidence The cited page is DeepSeek's own authoritative privacy policy containing the quoted security-measures language, and no public evidence of a DeepSeek SOC 2 Type II report was... | ◔Partial Per the model-via-platform certification rule, trust.fireworks.ai/resources lists "SOC 2 Type 2 Report 2025" as Fireworks' platform certificate, but since DeepSeek's developer... |
| ISO 27001 | ○No public evidence A thorough search of DeepSeek's own site and documentation found no public statement of ISO/IEC 27001 certification for the API. | ◔Partial Fireworks' own trust portal and docs publicly confirm its ISO 27001 certification, while DeepSeek has no public ISO 27001 of its own, so the... |
| ISO 42001 | ○No public evidence Search of DeepSeek's official domains (deepseek.com, cdn.deepseek.com, api-docs.deepseek.com) shows no public statement or certificate for ISO/IEC 42001, so evidence is absent | ◔Partial Fireworks AI publicly confirms ISO 42001, but no authoritative DeepSeek source shows the model developer has its own ISO 42001, so the offering is only partially covered |
| Trust center | ●Yes, public The DeepSeek Transparency Center page is publicly accessible and lists models and reports, satisfying the definition of a maintained trust/compliance portal. | ●Yes, public The provider's own public trust portal is accessible without login and lists a HIPAA Report of Compliance, confirming a maintained compliance portal. |
| HIPAA BAA | ○No public evidence No public DeepSeek page mentions offering a HIPAA BAA, and the privacy policy states the service is not intended for health data, indicating no publicly available BAA. | ◐Yes, sales-gated The provider’s FAQ states a BAA can be supplied upon request, indicating a gated HIPAA agreement for the DeepSeek offering. |
| GDPR DPA | ○No public evidence DeepSeek’s own site provides only a privacy policy and contains no publicly available DPA, SCCs, or subprocessor list. | ●Yes, public Public DPA on Fireworks' own domain includes SCCs per the quoted definition, and a subprocessor list is publicly published on trust.fireworks.ai (AWS, GCP, Oracle, CloudFlare,... |
| No-training default | ○No public evidence The provider explicitly notes that some user input may be used for training, contradicting a commitment not to train on API data. | ●Yes, public Fireworks AI's public privacy policy explicitly states they do not use API inputs to train models without explicit opt‑in, confirming a default commitment not to train on customer data. |
| Retention / ZDR | ◔Partial DeepSeek publicly documents its data retention period, but no authoritative DeepSeek page shows a zero‑data‑retention option for the API. | ●Yes, public Fireworks' own blog documents that DeepSeek on Fireworks has zero data retention by default, satisfying the retention documentation requirement. |
| Residency | ○No public evidence Searches of DeepSeek's own site reveal no authoritative page asserting EU data residency for the API, and the privacy policy only identifies China as the data controller. | ◐Yes, sales-gated Fireworks AI documentation confirms region pinning is possible but only after contacting sales, matching a sales‑gated capability. |
| GPAI Code | ✕No, verified DeepSeek is not listed among the signatories on the European Commission's complete GPAI Code of Practice signatory list, confirming it is not a signatory. | ✕No, verified The EC's authoritative and complete signatory list (fetched 31 Jul 2026) does not include DeepSeek, confirming a verified no. |
| Art. 53 summary | ●Yes, public DeepSeek's own policy page publicly links the EC‑template training‑content summaries for V3.1, V3.2 and V4, satisfying Art. 53(1)(d) without any access gate. | ●Yes, public DeepSeek's own publicly accessible page lists downloadable training data summary PDFs, fulfilling the Art. 53 developer obligation without any gate. |