LangSmith BYOC becomes generally available on AWS
LangChain has made LangSmith Bring Your Own Cloud generally available on Amazon Web Services, giving Enterprise customers a managed deployment that runs inside their own AWS account and VPC. The company says sensitive data, including traces, prompts, datasets and agent deployments, remains in the customer’s AWS environment.
- LangSmith BYOC is generally available on AWS for Enterprise customers.
- Sensitive LangSmith data remains in the customer’s AWS account and VPC.
- LangChain manages provisioning, upgrades, scaling, backups and monitoring.
- BYOC is available across 15 AWS regions in the US, EU and APAC.
- The deployment supports observability, evaluation, agent deployment and related LangSmith features.
Managed LangSmith inside a customer’s cloud boundary
LangSmith BYOC is designed for organizations that need the data residency and network isolation of a self-hosted platform without taking on the full burden of operating it. LangChain provisions and manages the deployment, including monitoring, upgrades, scaling, patching, backups and cluster lifecycle management.
The customer owns the AWS account, VPC, databases, object storage and sensitive application data. The data plane runs in that account and contains a private Amazon Elastic Kubernetes Service cluster, databases, storage and LangSmith runtime data. That data includes traces, prompts, datasets, experiments, evaluators, annotation queues, sandboxes and agent deployments.
LangChain says the control plane, which runs in its cloud, handles functions such as authentication, user management, workspace configuration, billing and usage metadata, and the LangSmith frontend. It does not hold sensitive application data. Communication between the two planes uses AWS PrivateLink and does not cross the public internet.
Built for regulated and security-sensitive workloads
BYOC is aimed at teams whose agent traces and runtime data can contain personally identifiable information, protected health information, customer records, internal API responses and tool outputs. The company highlights financial services, healthcare, cybersecurity and large enterprises with strict data governance requirements as potential use cases.
Because the data plane runs in the customer’s VPC, agents and sandboxes can connect to internal databases, private APIs and on-premises systems through existing network paths. The Amazon EKS cluster has no public API server endpoint, and worker nodes have no public IPs.
Operational access is designed to be auditable. LangSmith audit logs remain in the data plane, Amazon EKS audit logs go to Amazon CloudWatch in the customer’s account, and VPC flow logs are stored in an Amazon S3 bucket owned by the customer. The provisioning role is scoped to infrastructure management and does not include data-read permissions such as access to objects in the trace bucket or connections to PostgreSQL and Redis.
Availability, regions and supported features
BYOC is available to Enterprise customers across 15 AWS regions in the US, EU and APAC. Customers apply a Terraform module to create the IAM role used for provisioning, then create a data plane in LangSmith. LangChain provisions the VPC, EKS cluster, databases, storage, ingress and in-cluster services.
Available capabilities include tracing, dashboards and alerts, datasets and experiments, evaluators, annotation queues, Insights, Context Hub, LangSmith Deployment, Sandboxes, LLM Gateway, Fleet and SmithDB. The source also says Managed Deep Agents, the LLM auth proxy and Engine support BYOC.
Additional data planes can be created across environments, AWS accounts and regions. Organization-level settings such as users and roles carry across deployments, allowing teams to expand adoption without creating a separate operating model for every group. LangChain says customers should contact the company to discuss BYOC and consult its documentation for more detail.
LangChain: LangSmith BYOC on AWS is generally available
