You type into a chatbot. The answer comes back. But what happened to your words in between? In September 2026, Anthropic alleged that DeepSeek routed 12.1 million user queries to Claude in just 14 days — and China's internet regulator is now investigating. Whether or not the allegation is proven, the question it raises applies to every AI tool you use: where does your data actually go? This page maps the path, lays out the verified facts of the probe, and scores your own exposure in a 7-question self-check.
Prompt data flow is the full journey of your words after you hit send: which servers receive them, how long they are retained, which jurisdictions they cross, and whether they are used for training. Most users never see any of it.
The normal path is: you → vendor → vendor's own models. The allegation adds the red branch.
Your prompt: questions, documents, code, customer records — whatever you typed or pasted.
The chatbot or API you see. Its terms and privacy policy govern what happens next.
The normal, expected path: your prompt is processed by the vendor's infrastructure.
Anthropic ALLEGED that DeepSeek and Moonshot forwarded selected user requests to Claude — a different company's model in a different country — without users' knowledge. Not proven; under CAC investigation.
ILLUSTRATIVE OF THE ALLEGATIONAnthropic ALLEGED that outputs — including Claude's hidden "thinking signature" — were captured to train or improve the vendors' own models. Not proven; under CAC investigation.
ILLUSTRATIVE OF THE ALLEGATIONThe uncomfortable part: without reading the terms, checking sub-processor lists, and watching for policy changes, you cannot tell from the chatbot window whether your prompt took the plain path or the red branch.
Source: AI Understanding — "China regulator probes DeepSeek and Moonshot AI over data routing"
Answer honestly. Yes = 0 pts (good), Unsure = 1 pt, No = 2 pts. All scoring happens in your browser — nothing is sent anywhere.
Self-assessment only — it scores your visibility into vendor practices, not the vendors themselves. It is not legal or security advice.
Through infrastructure you do not control. Your prompt may be logged, retained, routed across jurisdictions, and — on some tiers — used for training. The mapper traces the journey: endpoint geography, retention policy, training opt-outs, and the subprocessors in between. You cannot consent to a flow you cannot see; this makes it visible.
Anthropic alleged it: in a 154-page threat-intelligence report published September 10, 2026, Anthropic claimed DeepSeek routed 12.1 million user queries to Claude over a 14-day window in July. China's regulator (the CAC) is now investigating those allegations. Nothing has been proven in court or by an independent audit — treat the claims as alleged, not as established fact.
After Anthropic's September 10, 2026 report named seven Chinese AI companies as unauthorized Claude users, the Cyberspace Administration of China (CAC) summoned representatives from all seven — DeepSeek, Moonshot AI, Alibaba, Zhipu, SenseTime, MiniMax and Xiaomi — and narrowed its probe to DeepSeek and Moonshot. Regulators are reportedly examining whether sensitive police, military and state-linked data crossed China's borders to a U.S. AI system without users' knowledge.
The allegation is exactly that: Anthropic said DeepSeek relayed selected user requests to Claude while users believed they were dealing with DeepSeek's own models, and said it could not confirm whether Moonshot told customers their requests were being sent to a third party. Whether a vendor may do this legally depends on its terms of service and the data-protection law of the jurisdiction involved — which is why reading the terms and the data-routing clauses matters.
It depends on the vendor and the plan. Many consumer AI chatbots use conversations for training by default unless you opt out or use a business/API tier with a no-training commitment. Anthropic separately alleged that DeepSeek used Claude's outputs — including hidden reasoning steps it calls the "thinking signature" — to train its own systems, a practice called illicit distillation. Check your vendor's policy for the exact rule that applies to you.
Five practical moves: use a business or API tier with a contractual no-training commitment; never paste sensitive personal, client, or credentials-bearing data into consumer chatbots; read the vendor's terms on data retention, third-party sharing and sub-processors; check which jurisdiction your data is processed in; and re-check the terms periodically — vendors can and do change data-routing practices. The 7-question self-check above scores where you stand today.