Choosing a provider
DeepSeek's iPhone app sent data unencrypted
In February 2025 the security company NowSecure found that DeepSeek's iOS app switched off the iPhone's protection for encrypted connections and sent some device data over the internet unencrypted.
In early 2025, soon after its launch, DeepSeek's Chinese chatbot app became one of the most downloaded iPhone apps. NowSecure, a mobile security company, examined the version for iPhone and iPad and on 6 February 2025 reported a series of security and privacy flaws.
iOS has a built-in protection, App Transport Security, which makes apps send data only over encrypted channels. DeepSeek's app switched it off entirely and sent some registration and device data, such as the device language and details, the operating system and an identifier for the installation, without encryption. An attacker on the network could read or even alter it. To encrypt some data, the app used an outdated algorithm considered broken (3DES), with a key built into the program. From a cache on the device, NowSecure also recovered usernames, passwords and encryption keys.
According to NowSecure, the app also collected plenty of data from which a device can be identified, such as the device name, which often contains the owner's name. Performance and tracking data went to Volcengine, the cloud platform of ByteDance, and the privacy policy says user data is stored and processed in China. NowSecure advised organisations to prohibit the app on company-managed devices and on personal devices used for work.
What can we learn from it?
An app's security also depends on how it sends data from the phone, and users cannot see that: the app works the same whether it encrypts or not. That is why it matters who makes it. For work, choose AI apps whose operator, place of data processing and terms you know, and that have been independently tested. On work devices, it helps to agree in advance which AI apps may be used, so nobody has to decide on the spot.
Sources
- NowSecure: NowSecure Uncovers Multiple Security and Privacy Flaws in DeepSeek iOS Mobile App
- 9to5Mac: Multiple security flaws found in DeepSeek iOS app, including sending unencrypted data
This article is based on the public sources listed. If you find a mistake, write to us: [email protected]