Pick the LangSmith region at sign-up, because an organization cannot change it later, and mask restricted fields in the SDK before they leave your application. Move to hybrid, BYOC (bring your own cloud) or self-hosted Enterprise only when trace data must stay in your network. The checklist covers privacy terms, regions, what survives retention, masking, hosting, access control and the network path.
When you need this
- Security or legal must approve sending prompts, retrieved documents, and model output to a third party.
- You serve regulated data or customers with data residency or zero-retention terms.
- A team wants to trace agents that handle customer data.
Evaluation criteria
Training and privacy terms
Does LangChain use your traces?
Look forLangChain's pricing FAQ states LangSmith does not use your data to train models and that traces, prompts, and outputs stay private to your organization. Its regions FAQ states GDPR compliance, SOC 2 Type 2 certification, and HIPAA compliance, with a DPA available through support.
Region
Where does your trace data live?
Look forChoose the region at sign-up. Options are GCP us-central1 in Iowa, europe-west4 in the Netherlands, australia-southeast1 in Sydney, or AWS us-east-2 in Ohio. Organizations cannot change regions later. Payment and billing data stays in the US, and LangChain has no EU contracting entity. All regions use the same US-dollar pricing.
What stays after retention ends
What is deleted, and what is kept?
Look forAccount for records that outlast trace retention. LangSmith deletes inputs and outputs shortly after retention ends and keeps some metadata indefinitely for analytics and billing. Dataset copies never expire. Enterprise workspace retention ranges from 30 to 180 days.
Mask before sending
Which fields must never be traced?
Look forHide inputs and outputs entirely, or mask them by rule or regex. Redact secrets with the SDK anonymizer, run Presidio or Amazon Comprehend for PII, or skip tracing per request with conditional tracing. Masking runs in the SDK, before data leaves your application.
Hosting option
Does trace data need to stay in your network?
Look forSelf-hosted LangSmith is an Enterprise add-on on Kubernetes, with ClickHouse for traces, PostgreSQL, Redis or Valkey, and blob storage, and LangChain recommends external managed datastores for production. BYOC runs LangSmith services in your AWS account while LangChain operates them. Hybrid applies to LangSmith Deployment, where Agent Servers run in your infrastructure and send traces to the cloud or a self-hosted instance. One developer ruled LangSmith out in 2026 for this reason and picked a self-hosted open-source tracer.
Access control
Who can see which traces?
Look forWorkspaces separate teams and environments. Enterprise adds workspace RBAC with custom roles, attribute-based access control (ABAC) that can hide PII-tagged resources from specific users, and custom SSO over SAML or OIDC. Developer and Plus offer Google and GitHub sign-in.
Network path
Does traffic cross the public internet?
Look forEnterprise customers can connect over AWS PrivateLink or GCP Private Service Connect. LangChain publishes the egress IP addresses its services use, for allowlisting your own model endpoints.
Questions to ask vendors
- Which projects can receive raw prompts and outputs, and which must mask them?
- Which region did we sign up in, and does it meet every customer contract?
- Do any of our customers' terms require that their requests are never traced?
- Do we need self-hosting, or does a regional cloud instance with masking satisfy the review?
- Who can read production traces today?
Red flags
- Production traces of customer conversations in a project the whole organization can read.
- Signing up in the default US region when contracts require EU residency, since regions cannot be changed later.
- Treating base retention as a deletion guarantee for data that was also added to a dataset.
- Retrieved documents with personal data traced without masking.
Products in this piece
Sources
- Official documentation
- 10
- Public source
- 1
- LangSmith plans and pricing
- LangSmith docs: Regions FAQ
- LangSmith docs: Cloud (SaaS) architecture and regions
- LangSmith docs: Usage and billing (retention tiers and rate limits)
- LangSmith docs: Data purging for compliance
- LangSmith docs: Prevent logging of sensitive data in traces
- LangSmith docs: Self-hosted LangSmith
- LangSmith docs: Hybrid
- LangSmith docs: LangSmith for Enterprise
- LangSmith docs: Data storage and privacy
- autonomous-dev issue #1452: self-hosted OTel observability for multi-agent tracing, not LangSmith (Aug 6, 2026)