Langfuse data retention policies
Setting per-project retention in self-hosted Langfuse: what the nightly cleanup deletes, what it leaves (audit logs, dataset items), how to apply one window across many projects, and archiving before data expires.
Langfuse features
Governance and operations features of self-hosted Langfuse: retention, audit, access control, masking, encryption, provisioning, backups and exports, and which of them need an Enterprise license key.
Langfuse audit logs
What self-hosted Langfuse audit logs capture, who can read and export them, and how they support security monitoring and audit evidence for an LLM observability platform.
Langfuse role-based access control and project roles
Designing organizations, projects and roles in self-hosted Langfuse: the Owner, Admin, Member, Viewer and None roles, project-level overrides, project API keys and the minimum role for exports and deletions.
Langfuse data masking for prompts and outputs
Keeping personal and sensitive data out of Langfuse traces with client-side SDK masking and the Enterprise server-side ingestion masking callback, including the fail-open versus fail-closed decision.
Langfuse encryption in transit and at rest
How a self-hosted Langfuse is encrypted end to end: TLS at the load balancer or service mesh, at-rest encryption across PostgreSQL, ClickHouse, Redis and object storage, and the SALT, NEXTAUTH_SECRET and ENCRYPTION_KEY secrets.
Langfuse headless initialization and instance management API
Provisioning a self-hosted Langfuse as code: LANGFUSE_INIT variables for the first organization, project and keys, default org and project roles for new users, and the Enterprise instance management API.
Langfuse backup and restore
Backing up each self-hosted Langfuse data store: ClickHouse snapshots or BACKUP to S3, PostgreSQL dumps, and when SeaweedFS or MinIO blob storage needs its own backups, plus why exports are not a restore path.
Langfuse scheduled export to blob storage
Archiving Langfuse observations and scores to S3, S3-compatible storage, GCS or Azure on a schedule for long-term retention or analytics, with the format, credential and ClickHouse version choices that matter when self-hosting.
