Registry / compare
DeepSeek API (first-party) vs DeepSeek via Fireworks AI
The same dimension can grade differently depending on who serves the model. Every cell links to its source; grades are evidence grades, not endorsements.
| Dimension | DeepSeek API (first-party) | DeepSeek via Fireworks AI |
|---|---|---|
| SOC 2 Type II | ○No public evidence Search of DeepSeek's official site and review of its privacy policy and terms reveal no public SOC 2 Type II report, and no gated portal was found. | ◔Partial Verified the Fireworks trust portal itself lists the SOC 2 Type 2 Report 2025; as a serving-platform certification not covering the DeepSeek model independently, partial is correct. |
| ISO 27001 | ○No public evidence Extensive search of DeepSeek's official site and documents found no publicly available ISO/IEC 27001 certification for the DeepSeek API. | ◔Partial Fireworks AI’s Trust Center confirms ISO 27001 for the platform, and no public ISO 27001 evidence was found for DeepSeek itself, so the offering is partially covered. |
| ISO 42001 | ○No public evidence Extensive search of DeepSeek's own domain and public pages found no authoritative statement of ISO/IEC 42001 certification. | ◔Partial Fireworks Trust Center lists an ISO 42001 Certificate for the platform, and no authoritative DeepSeek page shows the model has its own ISO 42001 certification. |
| Trust center | ●Yes, public The DeepSeek website hosts a publicly accessible Transparency Center page that lists models and related documentation, serving as a compliance portal. | ●Yes, public Fireworks AI maintains a publicly accessible trust center page listing compliance resources and reports, confirming a maintained compliance portal for the DeepSeek offering. |
| HIPAA BAA | ○No public evidence DeepSeek's privacy policy states the service is not intended for health data and provides no public BAA information, so no public evidence of a HIPAA BAA exists. | ◐Yes, sales-gated The provider’s own FAQ confirms a BAA can be provided but only after a sales request, matching the definition of yes_sales_gated. |
| GDPR DPA | ○No public evidence The cited page is DeepSeek's own domain and the quote is verbatim present. Neither the privacy policy nor any DeepSeek public page offers a DPA with SCCs or a published... | ●Yes, public Fireworks AI publishes a public Data Processing Addendum that defines SCCs and also provides a publicly accessible subprocessor list on its trust centre. |
| No-training default | ○No public evidence The privacy policy states DeepSeek uses data to train models by default and only offers an opt‑out, providing no public commitment not to train on customer API data. | ●Yes, public The provider's own privacy notice publicly states they do not train on API inputs without explicit opt‑in, satisfying the commitment. |
| Retention / ZDR | ◔Partial The privacy policy documents data retention, but no public page from DeepSeek describes a zero‑data‑retention offering, so only part of the claim is satisfied. | ●Yes, public Fireworks publicly documents zero-data-retention for open models and DeepSeek is classified as an open model, confirming retention is documented and zero-data-retention is available. |
| Residency | ○No public evidence DeepSeek's authoritative privacy policy (cdn.deepseek.com) states data is directly collected, processed and stored in the PRC and no regional data-pinning feature is documented... | ◔Partial Verified on Fireworks' own docs: self-serve --region pinning to listed EU single regions exists, but single-region quota is only granted at the GLOBAL multi-region level by... |
| GPAI Code | ✕No, verified DeepSeek is absent from the complete, official EU Commission signatory list, which by definition makes the claim false. | ✕No, verified DeepSeek is not present on the EU Commission’s complete signatory list, which is the authoritative source for GPAI Code of Practice signatories, so its absence is a confirmed no. |
| Art. 53 summary | ●Yes, public DeepSeek’s own policy page publicly provides a training‑data summary, satisfying the Article 53 developer obligation. | ●Yes, public DeepSeek's own page (cdn.deepseek.com/policies/en-US/model-algorithm-disclosure.html) states verbatim "DeepSeek hereby publishes Training Data Summary" and describes the... |