Braintrust or self-hosted Langfuse: which fits your LLM evaluation stack
Braintrust fits when a managed control plane is acceptable and the main constraint is getting evaluations running quickly without a platform team. If your renewal, residency review or cost change is pushing you toward self-hosting, self-hosted Langfuse is the open-source route, but it moves operational work onto your side. The decision turns on three questions: where trace and dataset data may physically live, who will operate ClickHouse, PostgreSQL and object storage, and which Langfuse features your governance model needs under an Enterprise license key.
Braintrust's self-hosting is an Enterprise option that keeps the web UI, authentication and metadata in Braintrust's control plane, so a security review must still accept that split. Self-hosted Langfuse runs the whole stack in your cloud account or data center, using the same codebase as Langfuse Cloud for core features. Before committing, confirm with your Langfuse account team or the Langfuse license key documentation which of your required controls, such as project-level RBAC, data retention policies, audit logs, server-side data masking or SCIM provisioning, need an Enterprise key. Those are the items most likely to change the cost and the support model.
Plan the operating model before the tooling. Self-hosted Langfuse depends on PostgreSQL, ClickHouse, Redis or Valkey, and S3-compatible storage, and the Langfuse v3 to v4 guide requires ClickHouse 25.12 or later and PostgreSQL 15 or later, with extra ClickHouse disk headroom during historic backfills. Name an owner for patching, backups, scaling and major upgrades, and decide whether that owner is an internal team or an implementation partner under a written scope. If nobody will own those components, Braintrust's managed service may be the honest choice even when data residency is a concern, provided the contract confirms where data is stored.
Which option fits which scenario
This table maps common buying scenarios to the option that fits best, based on what each platform documents about licensing, deployment and support. Read each row as a starting point, then confirm the named features and terms with both vendors before deciding. The main takeaway: self-hosted Langfuse fits when trace data must stay in your own environment, while Braintrust suits teams that want the vendor to run the platform.
| Scenario | Better fit | Reason |
|---|---|---|
| Small team wanting managed onboarding | Braintrust hosted | Self-hosted Langfuse requires you to run PostgreSQL, ClickHouse, Redis or Valkey and object storage before the first trace. |
| Regulated team that cannot send traces to a vendor control plane | Self-hosted Langfuse | Braintrust self-hosting is Enterprise-only and keeps the control plane with Braintrust, while Langfuse can run fully in your infrastructure. |
| Team that needs project RBAC or SCIM | Langfuse with an enterprise license key | Project-level RBAC and SCIM provisioning need a Langfuse Enterprise license key; confirm which Braintrust plan covers your identity requirements. |
| Team with no platform engineers | Braintrust hosted | Langfuse self-hosting shifts upgrades, backups and database operations to your staff or a support partner. |
| Team that needs a support SLA from day one | Braintrust or Langfuse Self-Hosted Enterprise | Langfuse's SLA and named support engineer sit in a custom-priced plan; request written terms from both vendors. |
| Team that wants core features without an enterprise contract | Open-source Langfuse | Langfuse states that core features and APIs are available without limits in the MIT-licensed version. |
| Team planning production high availability | Langfuse on Kubernetes with Helm | Langfuse documents Docker Compose on a single VM for testing only, with no high availability; production uses Kubernetes. |
| Team already operating ClickHouse and PostgreSQL | Self-hosted Langfuse | Existing database skills carry over, but ClickHouse needs at least 8 GiB memory and more for larger deployments. |
Where data lives and who controls the platform
Braintrust, Langfuse and the other platforms in this comparison differ mainly in where the control plane sits and who holds the traces, datasets and user records. The cards below separate the hosting models, the self-hosting license terms, the data residency questions, the identity options and the compliance evidence that remains your responsibility.
Braintrust's hosted control plane
Braintrust's Enterprise self-hosting keeps the web UI, authentication and metadata in Braintrust's control plane, while your cloud holds traces and datasets. Your users still sign in and manage projects through Braintrust-operated services, so those services belong in your vendor risk review. Ask Braintrust in writing which components run where, which logs it retains, and how it handles subprocessors before you rely on this split.
Langfuse's same-codebase self-hosting
Langfuse states that self-hosted deployments use the same codebase as Langfuse Cloud, and that all core features and APIs are available in the MIT-licensed version. The whole platform, including the web application, worker and databases, can run in your own accounts with no vendor-operated control plane. Confirm which features you need sit outside the enterprise directories, because those require a license key.
Data location and residency
With self-hosted Langfuse, you choose the region and account that hold PostgreSQL, ClickHouse and S3-compatible blob storage, so trace content and prompts never leave your chosen environment. Braintrust's data location depends on its hosting option and contract terms, so request its current regional commitments in writing. Map every data store, backup copy and log sink to a jurisdiction before the first production trace is sent.
Identity and SSO options
Langfuse's authentication documentation describes how self-hosted instances handle sign-in and single sign-on, and some role and user management features, including SCIM provisioning and project-level RBAC roles, need an Enterprise license key. Check which of these you need before you choose a plan, and map them to your identity provider groups. Braintrust's SSO and role model should be confirmed against its current documentation and your contract.
Compliance evidence you must produce
Self-hosting moves the evidence burden to your team. You must document access reviews, encryption settings, backup and restore tests, retention configuration and change records for each component you operate. DeployOpen can help plan and prepare these controls and evidence, but it does not issue audit reports, attestations or certifications, and an independent auditor or certification body must assess them.
Confirm Braintrust's hosting terms
Hosting models, data processing terms and retention commitments change, so treat any description on this page as a starting point. Ask Braintrust for its current hosting documentation, data processing agreement, subprocessor list and the scope of its Enterprise self-hosting, and compare the answers with your security review questionnaire. Record the answers in the contract file before you decide what the migration must replace.
How tracing, evaluations, datasets and prompts compare
This table compares the capabilities teams usually need from an LLM observability platform, with self-hosted Langfuse on one side and Braintrust on the other. Langfuse entries show whether the feature sits in the MIT-licensed core or needs an Enterprise license key. Where the Braintrust column says to confirm, check the feature with Braintrust directly before assuming parity.
| Capability | Self-hosted Langfuse | Braintrust |
|---|---|---|
| Tracing and OpenTelemetry ingestion | Core under MIT, with OpenTelemetry ingestion documented | Confirm SDK and OpenTelemetry ingestion support with Braintrust |
| Evaluations and scores | Core features under MIT, available through the same codebase as Langfuse Cloud | Confirm scorer, experiment and online scoring parity with Braintrust |
| Datasets | Core features under MIT | Confirm dataset versioning and export formats with Braintrust |
| Prompt management and protected labels | Prompt management is core under MIT; protected prompt labels need an Enterprise license key | Confirm prompt versioning and label protection on your plan |
| Role-based access control | Basic roles in core; project-level RBAC roles need an Enterprise license key | Confirm role granularity and project-level permissions with Braintrust |
| Audit logs | Need an Enterprise license key | Confirm audit log scope, export and retention with Braintrust |
| Data retention policies | Need an Enterprise license key; object storage lifecycle stays with your team | Confirm retention controls and deletion behavior with Braintrust |
| Server-side data masking | Needs an Enterprise license key | Confirm masking options and where redaction runs with Braintrust |
| SSO and SCIM provisioning | SCIM through the org management API needs an Enterprise key; check which SSO methods your edition includes | Confirm SSO methods and SCIM provisioning on your Braintrust contract |
Which Langfuse features need an Enterprise license key
Is self-hosted Langfuse free to run for core tracing and evaluations?
Yes, core features and APIs are available in the MIT-licensed open source version without limits, and self-hosted deployments run the same codebase as Langfuse Cloud. The license split applies to code inside the ee directories, which carries a separate commercial license. Only the specific controls listed in this section need an Enterprise license key, so check the license key documentation before assuming any administrative control is free. Your cost then shifts to the infrastructure and the people who operate it, which you should price from the component list rather than from the license.
Which Langfuse controls require an Enterprise license key?
The Langfuse license key documentation lists these features as needing a key in self-hosted deployments:
- Project-level RBAC roles
- Protected prompt labels
- Data retention policies
- Audit logs
- Server-side data masking
- UI customization
- Organization creators
- The org management API with SCIM
- The instance management API
Confirm this list against the current documentation before you commit, because the set of gated features can change between releases.
Can I get project-level RBAC without an Enterprise key?
Not in the open source version. Project-level RBAC roles are on the list that needs a license key, so a self-hosted instance without a key cannot assign project-scoped roles as a control. Teams that only need a single shared project can often work within the default access model, but confirm that with your own access requirements. If you need separation between business units or environments, budget for the key or plan separate deployments, and ask the vendor how the key applies to your deployment model.
Do audit logs and data retention policies come with the free version?
No, both are listed among the features that need an Enterprise license key. Audit logs matter most for security reviews and compliance evidence, while data retention policies control how long traces and related data are kept. Without a retention policy, you must manage deletion of trace data through your own process and storage tooling, and you should document that process for assessors. Ask the vendor which retention and log capabilities are available without a key so you can design the gap explicitly.
Does server-side data masking need a paid license for self-hosting?
Yes, server-side data masking is on the Enterprise key list. If your traces may contain personal data, credentials or customer content, do not treat masking as a free feature. Options include masking data in your application before it is sent to Langfuse, which keeps sensitive values out of the platform entirely, and reviewing what your instrumentation captures. Your engineers should test the masking approach with representative data before production use, and your security team should record the decision.
What does the org management API with SCIM and the instance management API mean for operations?
Both are on the list that needs an Enterprise license key. SCIM support is typically how an identity provider provisions and deprovisions users at scale, so without it you will manage user lifecycle through other mechanisms and document them for access reviews. The instance management API is used to administer the deployment programmatically. Teams that automate onboarding, offboarding or instance configuration should confirm which of these calls are available in the open source version before building around them. Langfuse's authentication and SSO documentation describes the options in more detail.
What should I confirm with Langfuse before buying an Enterprise key?
Ask for the license key scope and terms in writing, the exact features included, how the key is applied in your self-hosted environment, and what happens at renewal. Compare the key against the Self-Hosted Enterprise plan on the pricing page, which adds a named support engineer, solutions architect access and a support SLA, because those services are separate from the features. Ask whether features needed for your audit evidence are included. The total cost also includes ClickHouse, PostgreSQL, Redis or Valkey and object storage, which the key does not cover.
Who operates ClickHouse, PostgreSQL and storage
With self-hosted Langfuse, the organization or its implementation partner runs the database, analytics store, cache and object storage. Braintrust operates the equivalent layers in its managed service, so the buyer's staffing question shifts from "who runs the platform" to "who runs its data stores." A self-hosted deployment runs Langfuse Web and Langfuse Worker, plus PostgreSQL, ClickHouse, Redis or Valkey, and S3-compatible blob storage. Each one needs an owner, a patching cadence and a restore procedure before go-live. The minimum figures in the Langfuse scaling guide are 2 CPU and 4 GiB each for web, worker and PostgreSQL, 1 CPU and 1.5 GiB for Redis or Valkey, and 2 CPU and 8 GiB for ClickHouse, with at least 16 GiB of ClickHouse memory for larger deployments. Treat these as floors, not sizing. Ask your team to confirm current figures in the Langfuse scaling guide against your expected trace volume.
Scaling is where the operating load grows. Langfuse recommends scaling worker containers on CPU load, and under heavy ingestion it suggests splitting langfuse-web into separate ingestion and user interface deployments. Both changes are configuration and capacity decisions that someone must monitor. Set alerts on worker CPU, ingestion lag and ClickHouse memory and disk, and review them after each new integration goes live. Disk headroom matters most during backfills: the v3 to v4 guide advises about 3x ClickHouse disk headroom when backfilling historic data, so plan that capacity before a migration rather than during one.
Three recurring tasks belong to the buyer, whether staffed internally or contracted. The first is backups of PostgreSQL, ClickHouse and object storage, tested by restore, since trace data is the audit trail for model behavior. The second is upgrades: updates within a major version apply database migrations at startup, while major upgrades such as v3 to v4 need a dedicated migration guide, ClickHouse 25.12 or later (26.4 recommended), PostgreSQL 15 or later and Redis 7.0 or later. The third is monitoring and on-call for every component above. Braintrust carries these duties under its contract. With Langfuse, they are a budget line you must name, either as internal headcount or as a retainer with a partner, and that scope should be written down before you compare totals.
What Braintrust and self-hosted Langfuse cost to run
Braintrust and self-hosted Langfuse both carry recurring costs, but the components differ. Braintrust bills a subscription and usage, while Langfuse's core software carries no license fee and its costs sit in infrastructure, storage, staff time and any Enterprise key or support contract. Use these cards to build a like-for-like comparison.
Braintrust subscription and usage
Braintrust charges a recurring plan plus usage for processed data, scores and retained data. Each meter grows with trace volume, evaluation runs and how long you keep logs, so the bill moves with traffic. Pull the current price sheet and model your recent ingestion, scoring and retention volumes against it before comparing totals.
Enterprise contract for self-hosting
Braintrust's self-hosted option is sold as an Enterprise contract, and its control plane stays with Braintrust while your cloud holds traces and datasets. Expect a recurring fee set by negotiation. Ask whether it covers the data plane components, support response times, upgrade terms and any change in price as volumes grow, and get those terms in writing before comparing it with open-source run costs.
Langfuse software license
Core Langfuse features and APIs are MIT licensed without usage limits, so the software itself has no license fee. Features such as project-level RBAC, audit logs, data retention policies and SCIM need an Enterprise license key, which is a separate recurring commitment. Confirm which of your required controls sit behind the key and review the license terms for your planned use.
Compute for the data stores
A production deployment runs Langfuse Web and Langfuse Worker alongside PostgreSQL, ClickHouse and Redis or Valkey. Langfuse's scaling guide lists minimums of 2 CPU and 4 GiB for web, worker and PostgreSQL, 1 CPU and 1.5 GiB for Redis or Valkey, and 2 CPU and 8 GiB for ClickHouse, with at least 16 GiB of ClickHouse memory for larger deployments. These recurring cloud or VM charges grow with ingestion, so price them for your peak load.
Object storage and migration headroom
Langfuse needs S3-compatible blob storage, and storage charges recur with your retention setting. Its v3 to v4 upgrade guide advises about 3x ClickHouse disk headroom when backfilling historic data, which is a one-time cost during the migration window. Ask your cloud or storage team to size both the steady-state volume and the migration peak before you commit to a retention policy.
Staff time and external support
Your team carries the operating work: patching, monitoring, backups, on-call for the data stores and upgrades. Minor upgrades apply migrations at startup, while major upgrades follow dedicated guides and minimum versions such as ClickHouse 25.12 or later. Langfuse's Self-Hosted Enterprise plan adds a named support engineer and a support SLA at custom pricing, and a fixed-scope implementation partner can cover setup or ongoing retainers. Ask every bidder which hours their figures assume.
What moving from Braintrust to self-hosted Langfuse involves
The sequence moves traces, datasets, experiments, scores and prompts from Braintrust into a Langfuse deployment you run, and ends with the old project retired only after results match. Export details depend on your Braintrust plan and API limits, so confirm those before you start.
Inventory traces, datasets, experiments, scores and prompts
Engineering and the owners of each evaluation list what Braintrust holds for each project: production logs, datasets, experiments and their baselines, scorers, online scoring rules, and prompts. Each item gets an owner, a source project and a note on whether it is still used. The output is a written inventory that the team signs off, which becomes the checklist for every later step. Ask Braintrust to confirm your plan's export limits and API access before you size the work.
Export data from Braintrust to your own storage
An engineer with an API key that has read access pulls logs, datasets and experiments out of Braintrust, typically as JSON or Parquet through the query API, and paginates requests to stay within the request timeout. Files land in storage you control and are checksummed and row-counted against the inventory. The output is a verified archive per project. The export page covers the permissions and paging in detail, and the Braintrust plan and API limits set how long this step takes.
Stand up a non-production Langfuse deployment
The platform team deploys Langfuse in a test environment using the supported self-hosting path for your environment, with Kubernetes and Helm for production-grade work. The stack includes the web and worker containers, PostgreSQL, ClickHouse, Redis or Valkey, and S3-compatible storage, each with a named operator. Confirm which features your organization needs from the Enterprise license key list before design is locked. The output is a working test instance with backups and monitoring configured.
Re-point instrumentation to Langfuse or OpenTelemetry
Developers replace the Braintrust SDK calls in a staging branch of each application with the Langfuse SDK or with OpenTelemetry exporters that send to Langfuse. Trace structure, user and session identifiers, and model and token metadata are kept consistent so that dashboards and scores line up across both systems during the parallel run. The output is an instrumented staging service that shows traces in the new Langfuse instance. Review the Langfuse OpenTelemetry documentation before choosing the path.
Map scores, metadata and prompt versions
An evaluation lead writes a mapping table from each Braintrust score name, metadata field and prompt version to its Langfuse equivalent, including the data types and value ranges. Imported historic items are tagged with their source so they can be filtered later. Prompt versions and labels are recreated and checked against the exported text. The output is a reviewed mapping document and a test import that reproduces a sample of scores with matching values.
Rebuild evaluators and CI gates
The evaluation team recreates each scorer, whether it is code-based or an LLM-as-a-judge metric, in Langfuse experiments or in a separate evaluation runner, and reattaches the scorers to the CI pipeline that currently blocks releases. Thresholds and baselines are copied from the exported experiments rather than retuned by feel. The output is a set of evaluators that run on the same datasets and a pipeline that fails or passes on the same criteria as before.
Run both systems in parallel until results match
For a defined period agreed by the team, production traffic is traced to both Braintrust and Langfuse, and the same evaluation sets run on both. Scores, latency, cost figures and pass or fail decisions are compared in a shared report, and every difference is explained or fixed. The output is a documented match rate and a list of accepted differences signed off by the evaluation owner. Set the parallel window and acceptance criteria in writing before the run starts.
Cut over and retire the Braintrust project
The team switches production instrumentation and CI gates to Langfuse, freezes the Braintrust project for writes, and keeps read access for a retention period set by compliance. A final export is checked against the archive before anything is deleted. The output is a cutover record, updated runbooks, and a deletion decision approved by the data owner. Confirm with your legal and records teams what must be retained after the Braintrust contract ends.
Questions buyers ask before choosing Langfuse over Braintrust
How much does self-hosted Langfuse cost compared with Braintrust?
The software license is not the main cost. Self-hosted Langfuse core features are MIT licensed with no feature limits, so the recurring costs are the infrastructure (compute and storage for Langfuse Web, Langfuse Worker, PostgreSQL, ClickHouse, Redis or Valkey and S3-compatible storage) and the people who operate them. Braintrust charges per processed data, scores and retention, so its cost grows with trace volume. Ask for a quote that separates one-time setup from recurring infrastructure and operations, and model both against your own trace volume. Langfuse's self-hosted pricing page lists a custom-priced Self-Hosted Enterprise plan, so ask whether you need it before you budget for it.
How long does it take to stand up self-hosted Langfuse?
The duration depends on your target architecture, your existing Kubernetes and database platforms, and your security review process. A single-VM Docker Compose setup is documented for testing only and has no high availability, so it is quick to try but not a production baseline. A production deployment on Kubernetes with Helm or Terraform on AWS, Azure or GCP needs sizing for ClickHouse, PostgreSQL and the object store, plus backup, network and identity work. No timeline is fixed here. Agree the duration in writing as part of a fixed-scope plan.
What does our team need to run Langfuse in production?
You need people who can operate four stateful or semi-stateful components: PostgreSQL, ClickHouse, Redis or Valkey, and S3-compatible storage, alongside the two Langfuse containers. Langfuse's scaling guide sets minimum resources of 2 CPU and 4 GiB for web, worker and PostgreSQL, 1 CPU and 1.5 GiB for Redis or Valkey, and 2 CPU and 8 GiB for ClickHouse, with at least 16 GiB of ClickHouse memory for larger deployments. Your team also needs owners for monitoring, backups, capacity planning and on-call. Confirm these requirements against your own data volumes before committing to a hosting model.
Can our own engineers run Langfuse without an outside partner?
Yes, if your platform team already operates Kubernetes, PostgreSQL and ClickHouse and has the capacity to own upgrades and incidents. The Langfuse code is the same as Langfuse Cloud and the core features are MIT licensed, so nothing is blocked by licensing. The practical question is operating skill and staffing. Teams without ClickHouse experience often find the analytics store the hardest component to run well. Ongoing support, upgrades and continuous testing are available from DeployOpen as retainers if you prefer to share the load.
When is the Langfuse Enterprise license key worth asking about?
Ask for an Enterprise license key when you need features that Langfuse lists as requiring one: project-level RBAC roles, protected prompt labels, data retention policies, audit logs, server-side data masking, UI customization, organization creators, the org management API with SCIM, or the instance management API. The key is also relevant if you need the Self-Hosted Enterprise plan, which adds a named support engineer, solutions architect access and a support SLA. Compare those items against your access control, audit and identity requirements before you decide. Confirm the current terms directly with Langfuse, since the license and plan details may change.
What is involved in upgrading self-hosted Langfuse?
Updates within a major version are documented as non-disruptive, and database migrations run automatically at startup. Major upgrades follow dedicated guides, and the v3 to v4 guide is the one that changes the most. It requires ClickHouse 25.12 or later (26.4 recommended), PostgreSQL 15 or later and Redis 7.0 or later. It also moves to an observations-first ClickHouse data model and advises about 3x ClickHouse disk headroom when backfilling historic data. Plan that headroom, test the migration in a non-production environment, and check the release notes before each major change.
How does DeployOpen scope a Langfuse engagement?
DeployOpen plans, implements, integrates, hardens, backs up, upgrades, documents and supports self-hosted Langfuse inside your own cloud accounts, data centers or air-gapped networks. Most engagements are fixed-scope, so the scope, deliverables and timelines are agreed in writing before work starts. A scoping discussion typically covers your trace volume, target cloud, identity and SSO requirements, data retention, the features that need an Enterprise key, migration sources and the support model you want afterward. DeployOpen does not publish a price list, and a quote follows from the written scope.
How DeployOpen helps you evaluate, implement and migrate
DeployOpen plans, implements, hardens and supports self-hosted Langfuse inside your own cloud accounts, data centers or air-gapped networks. We start with a written scope that fits your trace volumes, evaluation workflow and license needs, so the choice between Braintrust and Langfuse rests on your environment rather than on a general comparison.
How we scope
- We confirm which Braintrust features you use: tracing, experiments, datasets, scorers and prompt management.
- We map the Langfuse features you need against the MIT-licensed core and the features that need an Enterprise license key.
- We agree deliverables, timelines and responsibilities in writing before any work starts, as all engagements are fixed-scope.
How we build
- We deploy Langfuse Web, Langfuse Worker, PostgreSQL, ClickHouse, Redis or Valkey and S3-compatible storage in your environment.
- We size each component against the documented minimums and plan ClickHouse capacity for your expected ingestion volume.
- We integrate SDK or OpenTelemetry instrumentation, test evaluations and run security checks on the deployed stack.
How we hand over
- We document architecture, configuration, backup and restore steps, and access controls for your operations team.
- We prepare control and evidence documentation for your compliance assessment, while independent auditors issue any formal report.
- We walk your engineers through upgrade procedures, including the dedicated migration guide for major versions.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- We can apply within-major-version updates and plan major upgrades, such as v3 to v4, as separate scoped work.
- We can run periodic security testing of the Langfuse deployment and its integrations to keep findings current.
