DeepSeek via Fireworks AI

Per the model-via-platform certification rule, trust.fireworks.ai/resources lists "SOC 2 Type 2 Report 2025" as Fireworks' platform certificate, but since DeepSeek's developer has no own SOC 2 to certify the model, the offering is only partially covered (partial), with the request-gated access noted

SOC 2 Type 2 Report 2025

source

Fireworks AI publicly lists an ISO 27001 certificate for its platform, while DeepSeek's own site provides no ISO 27001 evidence, so the certification covers only the platform, not the model

## ISO 27001 Certificate |

source

Fireworks AI publicly confirms ISO 42001, but no authoritative DeepSeek source shows the model developer has its own ISO 42001, so the offering is only partially covered

We are proud to announce that Fireworks has achieved ISO 27001, ISO 27701 and ISO 42001 certifications, the leading global standards for information security, privacy management, and responsible AI governance.

source

The provider's own public trust portal (trust.fireworks.ai) is live and maintained, displaying compliance, controls, subprocessors, FAQ, and updates without any gate, so yes_public is confirmed.

HIPAA Report of Compliance Published January 29, 2026 Added most recent HIPAA Report of Compliance.

source

The provider’s FAQ states a BAA can be supplied upon request, indicating a gated HIPAA agreement for the DeepSeek offering.

Fireworks AI supports HIPAA-compliant use cases and can provide a Business Associate Agreement (BAA) for eligible customers whose use of the Services involves the processing of Protected Health Information (PHI). To request a BAA, please contact [email protected] ...

source

Public DPA on Fireworks' own domain includes SCCs per the quoted definition, and a subprocessor list is publicly published on trust.fireworks.ai (AWS, GCP, Oracle, CloudFlare, Anthropic), so the recorded value stands.

"Standard Contractual Clauses" or "SCCs" means the Standard Contractual Clauses annexed to the Commission Implementing Decision (EU) 2021/914.

source

Fireworks AI's public privacy policy explicitly states they do not use API inputs to train models without explicit opt‑in, confirming a default commitment not to train on customer data.

No AI Training on Your Data: We do not use your prompts, training data, or API inputs to train or improve our AI models without your explicit opt‑in.

source

Fireworks' own blog documents that DeepSeek on Fireworks has zero data retention by default, satisfying the retention documentation requirement.

Secure Hosting: DeepSeek hosted securely in the US and EU, with zero data retention by default.

source

Fireworks AI documentation confirms region pinning is possible but only after contacting sales, matching a sales‑gated capability.

If you have a specific need for a single region, contact Fireworks to request it. When creating a deployment, you can pass the `--region` flag to pin it to a single region.

source

The EC's authoritative and complete signatory list (fetched 31 Jul 2026) does not include DeepSeek, confirming a verified no.

## Signatories of the code of practice - AI Studio Delta - Aleph Alpha - Almawave - Amazon - Anthropic - Black Forest Labs - Bria AI - Cohere - Domyn - Dweve - Fastweb - IBM - LINAGORA - Microsoft - Mistral AI - Open Hippo - OpenAI - Pleias - ServiceNow - WRITER

source

DeepSeek's own publicly accessible page lists downloadable training data summary PDFs, fulfilling the Art. 53 developer obligation without any gate.

To enhance transparency, DeepSeek hereby publishes Training Data Summaries – [DeepSeek-V3.1 Training Data Summary] – [DeepSeek-V3.2 Training Data Summary] – [DeepSeek-V4 Training Data Summary]

source