Can an EU team keep LLM traces in-region with LangSmith, or does it need its own infrastructure?
LangSmith Cloud's EU region, hosted on GCP in the Netherlands, keeps trace data in the region where the account signed up, but billing information stays in the US. Self-hosted Langfuse or Opik keep prompts and traces in-region on infrastructure your team controls. The self-hosted LangSmith route is also available, but it requires an Enterprise license key on top of LangChain's Enterprise plan, so the decision turns on whether that contract and its data flows fit your residency requirements.
Before choosing, map every data flow, not only where traces rest. Ask LangChain to confirm in writing which regions hold your trace, dataset and prompt data, where support access originates, and what billing and account metadata leave the EU. Remote access from a third country, even to view data on a screen for support, counts as a transfer under EDPB Guidelines 05/2021, so support and administrative access paths belong in the assessment alongside storage. Your legal team should also review the transfer basis for the US billing relationship, since the Data Privacy Framework adequacy decision is under appeal.
With Langfuse or Opik on your own Kubernetes cluster, the trace store, prompt store and blob storage sit in a region you pick, and you decide who can reach the administrative interfaces. Langfuse needs PostgreSQL, ClickHouse, Redis or Valkey and S3-compatible storage, and Opik runs on ClickHouse, MySQL and Redis, so the operational work is yours. Confirm that your own telemetry, container registry and LLM provider calls also stay in-region, because a fully in-region tracing stack can still send data out through other components. A written scope with your platform team makes those boundaries explicit before any migration starts.
What the EU transfer rules require from a tracing platform
Trace data, prompts and user inputs often contain personal data, so every place that data is stored or accessed matters under EU law. The cards below set out the rules that decide whether a tracing platform keeps EU data in the EU, and the checks that turn those rules into evidence for your own assessment.
Article 44 transfer rule and fines
GDPR Article 44 requires every transfer of personal data to a third country, including onward transfers, to meet the conditions in Chapter V. Infringements of Articles 44 to 49 can draw fines of up to EUR 20 million or 4% of worldwide annual turnover under Article 83(5)(c). For a tracing platform, the question is whether any copy of prompts, traces or user identifiers lands outside the EEA, including in backups and support tooling. Confirm this with your legal team before choosing a region.
What EDPB counts as a transfer
EDPB Guidelines 05/2021 treat two situations as transfers: remote access from a third country, even only displaying data on a screen for support or administration, and storage in a cloud outside the EEA. A vendor whose EU region stores data in Europe can still trigger a transfer if its support engineers in another country open traces to troubleshoot. Ask the vendor where administrative and support access comes from, and whether it is logged.
Schrems II and the Privacy Shield outcome
On 16 July 2020, the Court of Justice of the EU in Case C-311/18 (Schrems II) invalidated the EU-US Privacy Shield adequacy decision 2016/1250 while holding that standard contractual clauses remained valid. Transfers to the US now rely on the EU-US Data Privacy Framework, which covers only US organizations on the Data Privacy Framework List, and an appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P. Check whether your vendor is on that list and whether your contracts still rest on a valid transfer tool.
CLOUD Act reach under 18 U.S.C. 2713
18 U.S.C. 2713, added on 23 March 2018, requires US electronic communication and remote computing service providers to preserve or disclose data in their possession, custody or control, whether that data sits inside or outside the United States. An EU region operated by a US company can therefore still be subject to a US order. EDPB Recommendations 01/2020 say that where the destination's authority powers go beyond what is necessary and proportionate, no effective technical supplementary measure can be envisioned. Ask who holds the encryption keys and who operates the service.
Data Act Article 32 on third-country access
Regulation (EU) 2023/2854, Article 32, requires providers of data processing services to take technical, organisational and legal measures that prevent third-country governmental access to non-personal data held in the Union where that access would conflict with Union or national law. It complements GDPR for trace metadata and operational logs that are not personal data. For a self-hosted platform on your own infrastructure, you control these measures directly; for a hosted vendor, request the written measures and the process for handling government requests.
Which options keep prompts and traces in the EU, and what each leaves outside
This table compares where prompts and traces are stored for each option and what still leaves the EU region, including billing, license checks, telemetry and gateway control plane traffic. Read each row with the licensing and trade-off columns, because keeping data in-region does not by itself remove every outbound flow.
| Option | Where data is stored | What still leaves the region or the network | Licensing for the self-hosted tier and trade-offs |
|---|---|---|---|
| LangSmith Cloud, EU region | Netherlands (GCP EU) for the account's data, as chosen at sign-up | Billing information stays in the US, so confirm what billing data includes for your contract | Hosted service, no self-hosting. Lowest operations load, but you rely on LangChain for hosting and access controls. |
| Self-hosted LangSmith on your Kubernetes cluster | Wherever your cluster runs, including EU regions you choose | Confirm with LangChain the license check and billing telemetry flows to its servers, and whether an offline license is available | Add-on to LangChain's Enterprise plan with a license key. Helm and Terraform are documented. Expect an enterprise contract cost plus your own cluster operations. |
| Self-hosted Langfuse | Your PostgreSQL, ClickHouse, Redis or Valkey and S3-compatible storage in your chosen EU region | Nothing required by the core stack. Confirm any outbound calls from your SSO, email or model providers in your own configuration | MIT licensed core with the same codebase as Langfuse Cloud. Some features need an Enterprise license key, such as RBAC roles, audit logs and SCIM. |
| Self-hosted Opik | Your ClickHouse, MySQL and Redis stack in your chosen EU region | Nothing required by the platform itself. Confirm any hosted Comet.com use is excluded if you need full in-region processing | Apache-2.0, and the README states the full platform, including prompt management and evaluations, can be self-hosted without a commercial license. |
| Portkey hybrid gateway | Gateway data plane runs in your VPC, so request payloads stay in your environment | Control plane traffic goes over HTTPS to control.portkey.ai, so confirm what metadata and logs that call carries | Hybrid is an enterprise deployment. Prompt management, logging, access control and PII redaction sit outside the open-source gateway. |
| LiteLLM as self-hosted gateway | Your servers in the EU region you choose, with logs sent to your own Langfuse or OpenTelemetry backend | Only the model provider calls you configure, so check each provider's region for the models you use | MIT licensed except the enterprise directory. SSO, SAML and audit logs need LiteLLM Enterprise. |
| Arize Phoenix (caution) | Self-hosted on your infrastructure, so storage is in your chosen region | Nothing required by the software itself, confirm telemetry settings with your security team | Elastic License 2.0 is source-available, not OSI open source. It restricts offering Phoenix to third parties as a hosted or managed service, which matters only if you plan to resell it. |
What LangSmith's EU region keeps in the EU and what stays in the US
LangSmith Cloud's GCP EU (Netherlands) region keeps trace data in the region where the account signed up, but billing information stays in the US. That split is the first thing to put in front of your privacy and procurement teams. Trace payloads, prompts and evaluation records are the data most likely to contain personal data, so the EU placement covers the core content. Billing records, which usually hold contact names, company details and payment-related data, sit outside the EU. Before you rely on this, confirm with LangChain in writing which data categories fall under the regional commitment, where account metadata and support tickets are processed, and whether any support access path can reach EU data from outside the EEA.
A US-linked billing and support footprint still matters for a transfer assessment. Under EDPB Guidelines 05/2021, remote access from a third country, even just displaying data on a screen for support, counts as a transfer, so a support engineer in the US viewing an EU trace would need to be assessed under Chapter V of the GDPR. Ask LangChain for its transfer mechanism, its list of sub-processors and whether any US government access request could require it to disclose EU-hosted data. The EDPB Recommendations 01/2020 are the reference point if the answer involves cloud access to data in the clear. Your records of processing and transfer impact assessment should name the specific categories, not just the region.
If your review concludes that the EU region is not enough, the same LangSmith data export can move trace data out to an S3-compatible bucket in Parquet format. Treat it as an exit route, not a residency control. Bulk export is only available on the Enterprise plan for customers who signed up after August 3, 2026, while earlier Plus customers keep access until February 1, 2027. Confirm your plan and its export entitlement before you plan a migration window, because the export is the step that determines how much of your history you can bring in-region.
Why self-hosted LangSmith needs an Enterprise license
Self-hosted LangSmith is not a free download. It is an add-on to LangChain's Enterprise plan, and it runs only with a license key issued under that plan. The deployment targets your own Kubernetes cluster and is installed with Helm charts, with Terraform also documented for provisioning. Platform teams therefore own the cluster, the storage and the upgrade cadence, while LangChain controls the entitlement that lets the software start.
- Cluster ownership: Your team provisions nodes, ingress, persistent storage and backups in the account or data center you choose.
- Helm or Terraform: Pick the install path your platform standard already uses, and confirm which chart version and Kubernetes versions the vendor supports.
- Key handling: Store the license key in your secrets manager and plan a rotation and renewal process before the first production deployment.
- Upgrade planning: Schedule chart upgrades in a maintenance window and test them in a non-production cluster first.
- Dependencies: Budget engineering time for the data services that sit behind the chart, not only the application pods.
Before committing a design, ask the vendor exactly which network endpoints the deployment contacts for license validation and usage reporting, and whether an offline license is available for your network.
For EU data residency, the license question matters because it determines what leaves your environment. A self-hosted deployment keeps trace data in your cluster, but the license workflow is a separate channel. Compliance leads should not assume that a self-hosted installation has no outbound connections until the vendor has documented them in writing. The records you need are the list of destinations, the data each one receives, and whether that data could contain personal information from prompts or outputs.
- Outbound destinations: Request the complete list of hostnames the deployment calls, including license checks and any telemetry.
- Data content: Ask whether those calls carry only license identifiers and counts, or any trace payloads, user identifiers or billing details.
- Offline option: Ask whether an offline license exists for your category of environment and what it changes in the operational model.
- Records: Keep the vendor's written answers in your transfer assessment file alongside the architecture diagram.
- Scope: Confirm that the chosen deployment does not depend on a LangChain-hosted control plane for trace storage or access.
DeployOpen prepares evidence for compliance assessments, but independent auditors and certification bodies issue any opinion on your controls.
Procurement needs to know that self-hosting LangSmith is priced and licensed as part of an Enterprise relationship, not as a standalone deployment option. The contract scope therefore covers the license key, the entitlements it unlocks and the terms for renewal and support. Ask for a quote that separates each item so you can compare it with an open-source platform that does not require a key for the full feature set.
- Contract scope: Confirm which products, deployment modes and support levels the Enterprise plan includes.
- Renewal terms: Ask how the license term, renewal notice and price adjustments work, and what happens to access if the key lapses.
- Exit terms: Check whether data export is available on your plan and under what conditions, since plan changes can alter export rights.
- Support boundaries: Clarify who handles deployment issues, the vendor, your integrator or your internal team.
- Written quote: Request line items for licensing, installation support and any recurring operational support, so each cost driver is visible.
Use these answers when you compare the Enterprise route with Langfuse or Opik, where the self-hosted feature set is available under open-source licenses.
How to deploy Langfuse or Opik in an EU region under this constraint
This sequence takes an EU team from choosing a region and accounts to a verified, in-region tracing deployment that is ready for upgrades. Each step names the check that confirms the previous one is complete.
Choose the EU region and accounts
Your platform or security team selects the EU cloud region, account or subscription, and network boundaries that will hold trace and prompt data. Record which region each service and backup uses, and confirm with your cloud provider that the account, its logs and its support access are set up under your own tenancy. Also confirm where billing and vendor telemetry go, because for LangSmith Cloud the billing information stays in the US even though trace data stays in the signed-up region. You are done when a written region map lists every component and its location.
Pick Kubernetes with Helm for production
Platform engineering chooses the deployment method. Langfuse documents Docker Compose on a single VM for testing only, without high availability, and Kubernetes with Helm or Terraform-based deployments on AWS, Azure and GCP for production. Opik offers Docker Compose through its opik.sh script for local use and Kubernetes with Helm charts for production. Pick the path your platform team can operate, and pin chart and image versions in your repository. You are done when a non-production cluster in the EU region comes up from version-controlled configuration.
Size PostgreSQL, ClickHouse and Redis
Size the data tier before provisioning. Langfuse's scaling guide lists minimum resources of 2 CPU and 4 GiB for web, worker and PostgreSQL, 1 CPU and 1.5 GiB for Redis or Valkey, and 2 CPU and 8 GiB for ClickHouse, with at least 16 GiB of ClickHouse memory for larger deployments. For Opik, the stack is ClickHouse, MySQL and Redis, and its README reports handling 40M+ traces per day. Ask your cloud team to confirm storage classes, backup schedules and replication for each database. You are done when capacity plans for each database are documented and approved.
Provision S3-compatible storage in region
Create the blob bucket in the same EU region as the cluster. Langfuse uses S3 or blob storage for event and media data, and Opik relies on its own object storage configuration, so confirm which buckets each application writes to. Restrict bucket access to the workload identity, enable encryption at rest, and disable public access. Confirm that replication and backups do not copy data to a region outside the EU unless your assessment allows it. You are done when a test write and read succeed from inside the cluster and a policy check shows no public or cross-region access.
Configure SSO and role-based access
Your identity team connects the tracing platform to your identity provider and assigns roles before any production traffic arrives. Langfuse's project-level RBAC roles, protected prompt labels, audit logs, data masking and SCIM provisioning sit behind an Enterprise license key, so confirm which controls your deployment needs before you start. Opik's README states the full platform can be self-hosted without a commercial license, so confirm which access controls your version includes. You are done when a test user from each role can sign in and their permissions match the access matrix.
Point SDKs and LangChain callbacks at the EU endpoint
Application teams update their instrumentation so traces go only to the in-region host. For Langfuse, set the host and keys in the SDKs or use its OpenTelemetry endpoint. For LangChain and LangGraph applications, point the callback configuration at the self-hosted service, and for Opik use its native LangChain and LangGraph integrations or the @track decorator for custom code. Remove or disable any LangSmith environment variables so no trace leaves through the old path. You are done when a test run appears in the in-region UI and network logs show no calls to the previous vendor endpoint.
Verify there are no third-country access paths
Privacy and security reviewers test every route by which trace data could leave the EU. Check the egress rules, DNS resolution, update channels, email or alerting integrations, and support tooling. Confirm that remote access from a third country, including screen sharing for support, is either blocked or covered by a documented transfer assessment, because the EDPB guidelines treat such access as a transfer. Also record whether any vendor or operator with access is subject to third-country law with extraterritorial reach, since the CLOUD Act can apply to providers in their possession, custody or control. Agree the outcome with legal counsel. You are done when the signed assessment and the egress test results are filed together.
Plan upgrades with the v4 data requirements
Operations teams set an upgrade process before go-live. Langfuse applies database migrations automatically at startup for minor updates within a major version, but major upgrades follow dedicated guides. The v3 to v4 guide requires ClickHouse 25.12 or later (26.4 recommended), PostgreSQL 15 or later and Redis 7.0 or later, moves to an observations-first ClickHouse data model, and advises about 3x ClickHouse disk headroom when backfilling historic data. Test the upgrade in staging against a copy of production data, and confirm the same ClickHouse and PostgreSQL version floors for Opik with its release notes. You are done when a staging upgrade completes and the rollback steps are documented.
Evidence a DPO or regulator will ask for
A data protection officer or supervisory authority will ask where personal data is processed, how it moves, and who can reach it. The cards below are inputs your team prepares for an independent assessment; they are not certifications, and DeployOpen does not issue audit reports or attestations. Each one maps to a question a transfer review already asks, so gaps surface before the review does.
Record of processing locations
List every system that stores or processes traces, prompts, datasets and user identifiers, with the region, cloud account and data center for each. For a self-hosted Langfuse or Opik deployment, that means the PostgreSQL, ClickHouse, Redis or Valkey, and blob storage locations, plus any backup copies. For LangSmith Cloud, record the region the account signed up in and separately note that billing information stays in the US. Confirm backup and disaster recovery sites are inside the EU if that is your position.
Data flow map
Draw how a trace moves from the application through SDK callbacks or OpenTelemetry exporters, into the tracing backend, then into evaluation jobs, exports and any third-party tools. Mark every hop that leaves the EU, including remote support sessions where an administrator in a third country views a screen, because the EDPB guidelines treat that as a transfer. Include where you send data to model providers, since those calls often carry the same prompts.
Transfer impact assessment and supplementary measures
Where a transfer to a third country remains, document the assessment under EDPB Recommendations 01/2020. The key question is whether the destination's public authority powers exceed what is necessary and proportionate. The Recommendations state that where a provider needs access to data in the clear and those powers go too far, no effective technical supplementary measure is envisioned. Record the decision and the reasoning, and do not treat a self-hosted deployment as an automatic answer without checking who holds administrative access.
Processor contract and subprocessor list
Collect the data processing agreement, the list of subprocessors, and each subprocessor's location and access rights for any vendor that still touches the data. For a self-hosted platform, most processing happens in your own accounts, so the contract question shifts to your hosting provider, your implementation partner and any hosted model APIs. Ask each to state where support staff can access systems and whether they can be compelled to disclose data under third-country law.
Enterprise license and feature inventory
Keep a written inventory of which features run under a commercial license key in your deployment, so the record matches what is actually switched on. For self-hosted Langfuse, the list includes project-level RBAC roles, protected prompt labels, data retention policies, audit logs and server-side data masking. Record the license status for each release, and note that the core features are available in the MIT-licensed version without limits. Review the inventory after every upgrade.
Access and retention configuration
Export the configuration that controls who sees traces and how long they live: role assignments, SSO group mappings, API key inventory, and retention settings per project. Document the retention period you chose and the reason, and show how deletion requests are carried out across the database, ClickHouse and object storage copies. Confirm that administrative access to the database and storage layers is limited and logged, since those layers hold the same personal data as the UI.
Questions EU teams ask before self-hosting LLM tracing
Is a self-hosted Langfuse deployment free?
The core product is free to run. Langfuse's repository is MIT licensed except for the ee directories, and Langfuse states that all core features and APIs are available in the MIT-licensed open source version without limits. A license key is only needed for specific enterprise features, such as project-level RBAC roles, protected prompt labels, data retention policies, audit logs, server-side data masking and SCIM. Your costs are the infrastructure and the people who run it. Langfuse's self-hosting documentation describes the components involved, and its self-hosted pricing page lists a custom-priced enterprise plan that adds support. Ask for the software license terms in writing before you assume a feature is free.
What drives the cost of self-hosting Langfuse?
Four cost lines drive the total. Infrastructure is the first: Langfuse needs web, worker, PostgreSQL, ClickHouse, Redis or Valkey and S3-compatible storage, and its scaling guide lists minimum sizes such as 2 CPU and 8 GiB for ClickHouse, with at least 16 GiB of ClickHouse memory for larger deployments. Trace volume and retention set how fast storage grows. Second, upgrades: the v3 to v4 guide requires ClickHouse 25.12 or later, PostgreSQL 15 or later and Redis 7.0 or later, and advises about 3x ClickHouse disk headroom when backfilling historic data. Third, backup and recovery of PostgreSQL and ClickHouse. Fourth, an enterprise key if you need RBAC, retention controls or SCIM. Ask any provider to price each line separately.
How long does a self-hosted Langfuse setup take?
Timing depends on scope, so no single duration applies. A test deployment on one virtual machine with Docker Compose is a different project from a production Kubernetes deployment with Helm or Terraform, high availability, backups, SSO and retention policies. Langfuse documents Docker Compose on a single VM for testing without high availability, and Kubernetes with Helm or Terraform for production on AWS, Azure and GCP. The scope questions that move the timeline are your cluster and cloud readiness, how many trace sources you instrument, whether you migrate historic data from LangSmith, and which compliance evidence you need. DeployOpen agrees timelines and deliverables in a written fixed scope before work starts.
Can our team run self-hosted Langfuse without outside help?
A team with Kubernetes, PostgreSQL and ClickHouse experience can often run it internally, but the work is ongoing. The skills needed are database operations, object storage, observability of the stack itself, upgrade planning and security configuration. Langfuse says updates within a major version apply database migrations automatically at startup, while major upgrades follow dedicated migration guides, so someone must own each one. Check whether your team can staff these tasks after go-live, not only during setup. DeployOpen plans, implements, hardens, backs up, upgrades and documents self-hosted platforms in your own infrastructure, and offers ongoing support as a retainer, so you can keep ownership and still hand off the routine work.
Does Opik avoid the license key requirement?
Yes, according to Opik's README. Opik is Apache-2.0 licensed, and the README states that the full platform, including the server backend, web application, tracing, evaluations and prompt management, can be self-hosted without a commercial license. This differs from self-hosted LangSmith, which is an add-on to LangChain's Enterprise plan and needs a license key. Opik self-hosts with Docker Compose through its opik.sh script for local use, or on Kubernetes with Helm charts for production. Its infrastructure uses ClickHouse, MySQL and Redis. Confirm the current terms in the Opik repository before you standardize on it, and check which components your deployment pulls in.
Does self-hosting remove all US exposure for EU traces?
No. Self-hosting keeps traces and prompts on infrastructure you control, but it does not change who operates your cloud account, your vendors or your support channels. Under GDPR Article 44, any transfer of personal data to a third country must meet Chapter V conditions, and EDPB Guidelines 05/2021 treat remote access from a third country as a transfer. The CLOUD Act provision at 18 U.S.C. 2713 applies to US providers regardless of where data is located, so check whether your cloud provider, managed database or support vendor is US-owned. Keep telemetry and support egress under review, and have counsel assess the exposure. DeployOpen prepares controls and evidence for assessments but does not issue audit reports or certifications.
How DeployOpen deploys self-hosted tracing under an EU residency constraint
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source tracing inside your own cloud accounts or data centers. For EU residency, we start from where each prompt, trace and billing record must sit, then build the platform to keep personal data in-region under your control.
How we scope
- We map which trace fields, prompts, user identifiers and evaluation data reach the tracing platform in your EU environment.
- We confirm the target region, cluster or VM layout, and where PostgreSQL, ClickHouse, Redis or Valkey and blob storage will live.
- The written scope fixes deliverables, the platform choice, integrations to test, and the timeline agreed before work starts.
- Engagements are fixed-scope, and ongoing upgrades and support are available as a retainer.
How we build
- We deploy the chosen platform with Helm or Terraform on your Kubernetes clusters, or Docker Compose for a non-production test.
- We configure object storage and databases in-region and document which components send or receive data outside your network.
- We wire SDK and OpenTelemetry instrumentation for your LangChain, LangGraph or custom code paths and test it end to end.
- We check licensing for each feature in use, so enterprise keys or gated features are identified before go-live.
How we hand over
- You receive architecture and data-flow documentation that shows where each category of data is stored and processed.
- We deliver runbooks for upgrades, database migrations, backups, scaling and retention settings.
- We prepare the control and evidence material your privacy, security and compliance teams need, while independent auditors and certification bodies issue any formal assessment.
- Handover includes a review with your platform team so they can operate the stack without us.
How we support
- Retainers cover platform upgrades, including the dedicated migration guides for major versions.
- We run continuous security testing of the tracing deployment and its integrations when your scope includes it.
- Support requests follow the agreed retainer terms, which you confirm in writing before engagement.
- We help you reassess residency and transfer exposure when vendors, regions or legal conditions change.
Sources and further reading
- Langfuse self-hosting ↗
- Langfuse license key ↗
- Opik GitHub repository ↗
- Regulation (EU) 2016/679 (GDPR), EUR-Lex ↗
- EDPB Guidelines 05/2021 on the interplay between Article 3 and Chapter V of the GDPR (version 2.0) ↗
- 18 U.S.C. 2713, Required preservation and disclosure of communications and records, GovInfo ↗
