LangSmith is now available as a bring your own cloud deployment on @awscloud. Ke

LangChain's managed LangSmith deployment lets enterprises keep sensitive agent records in their own Amazon Web Services account while LangChain operates the infrastructure. Its August 12 announcement places traces, prompts, datasets and agent runtime data in the customer's private cloud environment.

The service still depends on a control plane in LangChain's cloud for authentication, configuration, billing metadata and the frontend. The two environments communicate through AWS PrivateLink. This arrangement separates where sensitive application data resides from who maintains the platform, giving teams a managed option without making the deployment fully independent of LangChain's service.

“BYOC gives enterprises a managed LangSmith deployment that runs in their own AWS account and VPC. Sensitive application data, including traces, datasets, experiments, prompts, agent deployments, and sandbox data, stays in the customer's AWS environment.”

LangChain

“Agent traces and runtime data often include PII, PHI, customer records, internal API responses, tool outputs, and other sensitive context.”

LangChain

“A self-hosted deployment needs dedicated infrastructure support to size and maintain databases, manage Kubernetes, configure networking, apply upgrades, monitor reliability, handle backups, and support the deployment over time.”

LangChain

“Communication between the control plane and data plane uses AWS PrivateLink and does not cross the public internet.”

LangChain

“Wherever AWS supports it, permissions are limited to resources with the managed_by=langsmith tag and specific name prefixes. The role does not include data-read permissions such as s3:GetObject on the trace bucket, rds-db:connect to PostgreSQL, or elasticache:Connect to Redis.”

LangChain