Security & Compliance Overview
Langfuse treats customer data as a critical business asset. The platform is designed around encrypted transport, least-privilege access, regional hosting, and clear controls for data access and retention.
Langfuse Cloud security model
The managed service combines a security program, tenant isolation, and customer-controlled data management. Production systems are monitored and reviewed through a documented security process.
Security posture
Regular security reviews, dependency maintenance, encryption in transit and at rest, and controls aligned with SOC 2 and ISO 27001.
Tenant isolation
Product data is scoped to projects. API keys are project-scoped and authenticated requests pass through authorization checks.
Customer controls
Teams can reduce what reaches Langfuse with masking, configure retention, choose a region, and use enterprise identity controls.
Compliance
Langfuse maintains industry-aligned policies and supports customers with security, privacy, and procurement reviews.
- SOC 2 Type II controls
- ISO 27001 alignment
- HIPAA-ready deployment options
- GDPR-oriented data-processing controls
- Regional data residency
Privacy
Langfuse is designed to reduce sensitive data exposure through masking, retention controls, data deletion, and infrastructure choices. Enterprise and self-hosted deployments can add organization-specific review and control.
Data processing
Process only the trace, prompt, and evaluation data needed to provide the service.
Access control
Use project roles, API key scopes, and enterprise identity controls to restrict access.
Retention
Use data access and retention settings to align historical data with policy.
General information
Langfuse is an open-source AI engineering platform for tracing, prompt management, evaluation, and metrics. Managed cloud runs in controlled regional environments, while self-hosting gives teams direct infrastructure control.
- Managed cloud in US, EU, and Japan regions
- HIPAA-ready options
- Self-hosted open-source deployment
- Self-hosted Enterprise agreements
FAQ
Where is Langfuse Cloud hosted?
Managed deployments are available in US, EU, and Japan regions, with HIPAA-ready options for enterprise requirements.
Can I keep all trace data in my infrastructure?
Yes. Self-hosted deployments run on your infrastructure with the MIT-licensed core and your choice of storage, database, and networking controls.
How are traces protected?
Use encrypted transport, project-scoped API keys, role-based access controls, masking, and retention settings to protect sensitive trace data.
How do I request security documentation?
Enterprise security reviews and procurement questions can be sent to support@langfuse.lol.
Keep quality and control in production
Choose a paid cloud plan or deploy Langfuse on infrastructure you control.