Is DeepSeek safe for your resume after the US ban?

What did the US actually ban, and does it apply to you?

The ban is aimed at government systems, not at your laptop. On 20 October 2026 the Department of Homeland Security publicised Exclusion and Removal Order 2026-01, signed in July under the Federal Acquisition Supply Chain Security Act, which tells federal civilian agencies to remove IT products and services developed by Hangzhou DeepSeek Artificial Intelligence and its affiliates, and bars them from buying more. The removal half reaches further than the app itself: third-party software built on DeepSeek implementations is covered too, and no public list of affected vendors came with it, so buyers have to work that out themselves. Agencies may request exceptions. Defence and intelligence systems sit outside the order, though Congress restricted DeepSeek in intelligence community systems back in December 2025.

The stated reasoning is the part that should interest you. DHS pointed to exposure of sensitive information, user tracking and digital fingerprinting, and weaknesses in the app itself — plus the plain fact that DeepSeek's servers sit in China, where legal authorities can compel access to private infrastructure. That logic has been spreading for well over a year. Commerce bureaus blocked the app on government devices in March 2025; Texas moved first among the states and New York followed; Australia, South Korea and Taiwan pulled it from public-sector devices; the Czech Republic banned it across public administration; the Netherlands barred civil servants from using it; Italy's data-protection regulator blocked the consumer app outright. India's finance ministry issued internal guidance against it.

Nobody has told private citizens in the US, the UK or India to stop using DeepSeek, and you won't break a law by opening it tonight. But read that threat model again and swap "government document" for "resume". Your CV is one of the densest packets of personal data you own: legal name, mobile number, home city, personal email, every employer and date for the past decade, and quite often your referees' names and phone numbers. When you paste it in to get the wording tightened, you aren't sharing a prompt. You're uploading an identity file to infrastructure that a dozen governments have decided they don't trust with their own paperwork.

What does DeepSeek do with your resume once you upload it?

DeepSeek's own privacy policy states that it collects, processes and stores personal data in the People's Republic of China, and that what it collects includes your text prompts, uploaded files and chat history — not just your account details. So a resume you paste or attach ends up stored on servers in China, controlled by Hangzhou DeepSeek Artificial Intelligence. Alongside the document itself, the service logs the usual technical exhaust: IP address, device identifiers, approximate location. Retention language is open-ended, too — data is kept as long as necessary for the purposes it was collected for, with no published deletion window you can hold anyone to.

There is a training opt-out now, and you should use it, but don't overestimate what it buys you. DeepSeek's consumer terms describe a control usually labelled along the lines of "Improve the model for everyone", reachable through settings on web and mobile, and the current policy grants a right to refuse processing of your personal data for model training. The catch is what an opt-out can't do. It applies to future conversations, it isn't a deletion request, and it can't pull your CV out of a training run that already happened. Deleting your chat history or your whole account doesn't guarantee every copy evaporates either; billing and safety logs normally survive. The developer API runs on separate terms, so a toggle in your chat account settles nothing there.

It also helps to stop treating "DeepSeek" as one thing. The consumer app, the paid API and the downloadable open weights are three different data paths with three different risk profiles, and only the last keeps your file off Chinese infrastructure. That distinction matters more than usual this week, because the removal order explicitly covers third-party tools built on DeepSeek — meaning the resume helper you found last month may be calling it under the hood without ever saying so. If a tool won't tell you which model it uses and where that call lands, assume the worst: the stolen API keys in the OpenCode breach showed how fast saved credentials and stored prompts become somebody else's property.

Who should keep their resume out of DeepSeek entirely?

Four groups should treat DeepSeek as off-limits for CV work, full stop: applicants for US federal jobs, people at government contractors, anyone holding or seeking a security clearance, and staff at defence or critical-infrastructure suppliers. In those worlds the question isn't really whether your resume leaks — it's whether touching the tool at all surfaces later as a compliance problem. A contractor's acceptable-use policy almost certainly mirrors the federal exclusion by now, and "I used my personal account, on my own CV" is a thin defence if the document names programmes, clients or project detail you shouldn't be repeating anywhere, in any chatbox, ever.

The second category is anyone drafting a CV on a company machine. Pasting your resume into a consumer AI tool from a work laptop stacks two problems: your job search travels through corporate monitoring and browser telemetry, and you may be shifting data across a border your employer's policy forbids. Regulated sectors sharpen it further — healthcare, banking, law and public-sector employers across the UK and India increasingly keep approved-AI lists, and Chinese-hosted services rarely appear on them. If you're a cleared or regulated professional, do your CV work on a personal device, on your own network, in your own time. That inconvenience is trivial next to explaining it afterwards.

For everyone else — a marketing manager in Manchester, a backend developer in Bengaluru, a nurse in Ohio — here's my honest read, and it's duller than the headlines. The realistic harm isn't a state analyst poring over your employment history. It's mundane: your full name, mobile number and home address sitting in an open-ended retention bucket, attached to an account you'll have forgotten about in a year, reachable by anyone who breaks into it. That exposure exists with any AI tool, which is why the permission checklist for AI agents handling your job search matters whichever model you choose. Redact first, and the logo on the chatbox matters far less than people assume.

What's the safest DeepSeek alternative for CV review?

The safest substitute is any setup where you know precisely where your file is processed: a purpose-built CV tool that publishes how it handles uploads, an open-weights model you run yourself, or a model hosted in your own jurisdiction. Here's the quietly useful detail in this whole story — DeepSeek's models ship under the MIT licence, weights included, which means the model and the company are separable. Anyone can host the identical weights anywhere on earth. If you liked DeepSeek's drafting, you don't have to give it up to keep your resume off servers in Hangzhou; you just have to stop using DeepSeek's own front door to reach it.

Self-hosting is the purist route, and it's genuinely practical for the smaller models — run one on your own machine and no prompt ever leaves the house. The flagship models are another matter; they need serious hardware, which is why most people land on a hosted option instead. Inference providers in the US and Europe run the same open weights on their own infrastructure, and several advertise zero retention for open models by default, meaning prompts and generations aren't logged unless you opt in. Read that claim closely before trusting it, though: "we don't train on your data" and "we don't store your data" are two different promises, and only the second one actually protects a resume.

On-device AI is the other direction worth watching, and what offline AI really does for your CV is a fair account of the trade-off: genuine privacy for your address and salary expectations, perfectly decent drafting, and one stubborn blind spot. No general-purpose chatbot — local, hosted, open or closed — can tell you how your PDF behaves when a parser takes it apart. It will cheerfully praise elegant prose trapped inside a two-column layout that an applicant tracking system reads as word salad. That's the gap a free CV analysis built for the job fills: a score out of 100, five category scores including ATS compatibility, and a visual layout check.

Which checks should you run on a CV before any AI sees it?

Run three checks before any AI tool sees your resume: strip the identifying block, clean the file, and decide what the tool genuinely needs. Start by swapping your name, phone number, home address and personal email for placeholders — FIRSTNAME LASTNAME, CITY, EMAIL — and delete your referees outright. Their names and mobile numbers are someone else's personal data, and you have no business uploading them to anything. Cut your date of birth, any national ID or PAN number, marital status and photo while you're in there. None of them help a model improve your bullet points, and in most English-language markets they shouldn't be on the CV at all.

Then look at the file rather than the words. PDF and Word properties quietly carry your name, your employer's licence details and sometimes the colleague who first built the template; tracked changes and stray comments survive export far more often than people expect. Rename the document to something neutral instead of Resume_final_SMITH_salary85k.pdf. A walkthrough of what to strip out before an assistant sees your CV goes deeper on the fields worth removing. Once you've built that redacted working copy, keep it — that's the version you feed to every tool, with the real contact details restored only in the file you actually send to an employer.

Be clear, too, about what you're asking a general chatbot to do. Rewriting bullets, sharpening weak verbs, tailoring language to a job ad — all fine, and all doable with a redacted copy. Judging whether your file survives automated screening is a different task that needs the real document and a tool built for it. Paste the job description into an analysis and you'll see which skills are missing, plus ATS-friendly rewrites across six templates that mirror the ad's own keywords. If you'd rather start clean, a chat-based CV builder takes an old CV and rebuilds it — and writes Hebrew CVs in Hebrew, exported right-to-left.

Frequently asked questions