Langfuse Cloud can pass a security review once you pick the right region at sign-up and mask sensitive fields in the SDK. It does not replicate traces to a second region, so keep your own copy of any trace you are required to retain. The checklist covers where data lives, masking, the access controls on each plan, and what a regional outage loses, for a Cloud review or a decision to self-host.
When you need this
- Security or legal must approve sending prompts, retrieved documents, and model output to a third party.
- You serve regulated data, health data, or customers with data residency terms.
- Your organization asks what changed when ClickHouse acquired Langfuse.
Evaluation criteria
Region
Where does your trace data live?
Look forChoose the Cloud region at sign-up. US runs in Oregon, EU in Ireland, Japan in Tokyo, and HIPAA in Oregon, on AWS and ClickHouse Cloud. Regions share no accounts or data. Moving to another region means a new account and a migration of traces, prompts and datasets.
Regional outage
What is lost if a region is lost?
Look forLangfuse copies Postgres backups to a second region within the same jurisdiction, with a 10-minute recovery point and 12-hour recovery time. It does not replicate ClickHouse traces or uploaded media, so if a region is lost for good, Langfuse cannot recover its historical traces. Export the records you must keep to your own blob storage.
Compliance
Which reports and agreements are available?
Look forPro and above include annual SOC 2 Type II and ISO 27001 audit reports, plus penetration tests. Every plan has a GDPR DPA. Pro and above in the HIPAA region offer a BAA, which you must sign before sending PHI. Self-hosting needs no Langfuse BAA, and your team owns the safeguards.
Mask before sending
Which fields must never be traced?
Look forSDK masking functions redact data before it leaves the application on every plan. Self-hosted Enterprise adds server-side masking at ingestion.
Retention and deletion
How long is data kept, and what survives deletion?
Look forCloud data access lasts 30 days on Hobby, 90 on Core, and 3 years on Pro and Enterprise. Project retention policies require Pro or a self-hosted Enterprise key, and they delete traces, observations, scores, and media nightly. Audit logs and dataset items survive, so a dataset copy outlives its source trace.
Access control
Who can see which traces?
Look forAll plans have organization roles. Pro with Teams or Enterprise adds project roles and enterprise SSO with enforcement. Enterprise includes SCIM and audit logs. Self-hosted OSS includes enterprise SSO. Project roles and audit logs require a license key.
Network path
Does traffic cross the public internet?
Look forCloud uses public regional endpoints. Enterprise customers with committed contracts can use AWS PrivateLink where the region supports it. Langfuse publishes egress IPs for LLM judges and exports so you can allowlist model endpoints.
Ownership
What changed under ClickHouse?
Look forClickHouse acquired Langfuse in January 2026. Langfuse states that it plans no licensing changes. Cloud endpoints and contracts stay the same. Security, privacy and legal contacts now use ClickHouse addresses, and the policies live in the ClickHouse Trust Center.
Questions to ask vendors
- Which region did we sign up in, and does it meet every customer contract?
- Which projects can receive raw prompts and outputs, and which must mask them?
- Do we keep our own copy of the traces we would need after a regional loss?
- Who can read production traces today, and do we need project-level roles?
- Would self-hosting pass the security review with fewer conditions than Cloud?
Red flags
- Signing up in the default EU region when contracts require US or Japan residency, or the reverse.
- Sending PHI before the BAA is signed in the HIPAA region.
- Treating retention as a deletion guarantee for data also saved to a dataset.
- Relying on Langfuse Cloud as the only copy of traces you must keep.
Products in this piece
Sources
- Official documentation
- 11
- Public source
- 1
- Langfuse security and compliance
- Langfuse docs: Data regions and availability
- Langfuse docs: HIPAA and the BAA
- Langfuse docs: Masking
- Langfuse docs: Data masking (self-hosted)
- Langfuse docs: Data retention
- Langfuse docs: Data deletion
- Langfuse docs: Access control (RBAC)
- Langfuse docs: Networking and IP ranges
- Langfuse pricing
- Langfuse blog: Langfuse joins ClickHouse (Jan 16, 2026)
- digithings issue #4928: self-hosted Langfuse on Cloudflare, cut LangSmith (Oct 1, 2026)