LangChain LangSmith vs Langfuse for hybrid/self-hosted: can we keep traces in our VPC and still get dashboards/evals?

Most teams asking about LangSmith vs Langfuse for hybrid or self-hosted are really asking one thing: can we keep every trace inside our own VPC and still get real dashboards, evals, and workflows—not just a barebones database with JSON blobs. The short answer: yes, but the how and what-you-get are different between the two.

Quick Answer: LangSmith and Langfuse both support hybrid/self-hosted patterns where traces stay in your VPC. With LangSmith Enterprise you can run the full stack (traces, dashboards, evals, deployment runtime) in your own cloud, while Langfuse gives you an MIT-licensed core that you host and wire into your own infra. The tradeoff is depth of agent-specific features and eval workflows vs how much you want to assemble yourself.

The Quick Overview

• What It Is: A comparison of LangChain’s LangSmith vs Langfuse for teams that want observability, evaluations, and agent operations without sending traces out of their own environment.
• Who It Is For: Platform and ML teams building serious agents (multi-step, tool-using, long-running) who need VPC data residency, security controls, and trace-first visibility.
• Core Problem Solved: “We can’t ship agents into production unless we can keep traces local, understand exactly what happened in each run, and continuously evaluate quality—without copying logs to a third-party SaaS.”

How It Works

For both LangSmith and Langfuse, the underlying pattern is the same: you instrument your agent stack so every LLM call, tool invocation, and intermediate step becomes a “trace” or “run.” Those traces are sent to a backend that stores them, indexes them, and powers dashboards, evals, and debugging.

Where they differ is:

• LangSmith: Agent-focused, trace-first platform built by the same team that maintains LangChain, LangGraph, and Deep Agents. It’s framework-agnostic but optimized for complex agents. Enterprise and BYOC options let you keep all data in your own environment while still using the full LangSmith UI, evals, and deployment runtime.
• Langfuse: Open-source observability + prompt management + evals. You self-host the backend (often in your VPC) and plug it into your LLM stack via callback handlers and SDKs. You assemble the surrounding workflows (datasets, eval orchestration, runtime) yourself.

At a high level:

1. Instrumentation:

   • LangSmith uses SDKs (Python, TypeScript, Go, Java) and OpenTelemetry-friendly wrappers to capture traces, runs, threads, and tool calls—regardless of whether you’re using LangChain, a custom framework, or a bare OpenAI/Anthropic SDK.
   • Langfuse uses callback handlers and libraries that plug into LangChain, OpenAI SDK, LlamaIndex, LiteLLM, Vercel AI SDK, Haystack, and Mastra to capture traces without rewriting business logic.

2. Storage in Your VPC:

   • LangSmith Enterprise/BYOC can be deployed onto your Kubernetes cluster (AWS, GCP, Azure) so trace data never leaves your environment. For strict compliance teams, you keep storage, networking, and access in your own cloud.
   • Langfuse is MIT-licensed (core) and designed to be self-hosted. You run the application and its database in your VPC and fully control data residency.

3. Dashboards, Evals, and Runtime:

   • LangSmith layers trace analytics, evaluation workflows (including LLM-as-judge calibrated with human feedback via Align Evals), annotation queues, and a durable deployment runtime for agents on top of your traces—all available in the same self-hosted or BYOC stack.
   • Langfuse gives you observability, prompt management, and evals in one place. You get dashboards and evaluation support, but you typically pair it with your own deployment/runtime system and additional tooling for advanced agent behaviors.

Features & Benefits Breakdown

Core Feature	What It Does	Primary Benefit
VPC / Self-Hosted Deployment	LangSmith Enterprise/BYOC runs in your Kubernetes cluster; Langfuse core is self-hosted in your infra.	Keep traces, prompts, and logs entirely inside your own cloud while still getting dashboards and evals.
Trace-First Observability	Captures detailed step-by-step traces: prompts, model responses, tool calls, and branching logic. LangSmith emphasizes agent timelines and threads; Langfuse focuses on LLM observability for many stacks.	Understand exactly what your agent did, in what order, and why—so you can debug real production failures, not just guess from logs.
Integrated Evaluations & Improvement Loops	Both platforms support evals; LangSmith turns traces into datasets, runs offline/online evals, calibrates LLM-as-judge with human feedback, and connects directly to deployment. Langfuse provides eval & prompt management capabilities you integrate into your own pipelines.	Move from “we have traces” to “we’re systematically improving quality and catching regressions before they hit production.”

Ideal Use Cases

• Best for teams running complex agents in production (LangSmith): Because you get an end-to-end agent engineering platform—tracing, datasets, evals (including multi-turn), annotation queues, and a durable deployment runtime—with options to keep everything inside your VPC.
• Best for teams wanting open-source observability they can customize (Langfuse): Because the MIT-licensed core gives you an extensible, self-hosted base for traces, prompt management, and evals that you can wire into your own infra and tooling.

LangSmith vs Langfuse: VPC, Hybrid, and Self-Hosted Options

LangSmith deployment and data residency

LangSmith is built to work in two modes:

• Hosted LangSmith (smith.langchain.com):

  • Data stored in GCP us-central-1 or europe-west4.
  • Best if you’re comfortable with SaaS but want strong controls (SSO/SAML, SCIM, RBAC/ABAC, audit logs, encryption) and framework-agnostic tracing.

• Enterprise / BYOC / Self-Hosted LangSmith:

  • We deploy LangSmith into your Kubernetes cluster on AWS, GCP, or Azure.
  • Traces, datasets, eval results, and deployment state live entirely in your environment.
  • You control VPC networking, VPC peering, private ingress, and integration with your internal systems.
  • Same UI, same APIs, same trace-first workflows—just running on your infra.

In all modes:

• LangSmith is framework agnostic: it works with LangChain, OpenAI SDK, Anthropic, and any custom stack through a traceable wrapper and SDKs.
• LangSmith does not use your data to train models. Production traces are for your debugging, evals, and agents—not for us.

Langfuse deployment and data residency

Langfuse is:

• Open-source core (MIT, except ee folders):
  • You self-host the backend, typically in your VPC.
  • You own the database, storage, and retention policies.
• Commercial/enterprise options:
  • Free tier for their hosted service (50k units/month, 2 users).
  • Enterprise from $2,499/month if you want support and additional features.

This means:

• You can deploy Langfuse wherever you run your other infra (EKS/GKE/AKS, on-prem, etc.).
• You can keep all traces and prompts in your own network, assuming your applications send data to the Langfuse instance inside that network.
• Some users report occasional bugs in self-hosted setups, so you should plan for operational overhead and maintenance.

“Hybrid” setups

Teams often end up with a hybrid mix:

• Hybrid with LangSmith:

  • Agents and internal tools run in your VPC.
  • LangSmith runs inside your VPC (Enterprise) or at smith.langchain.com.
  • For Enterprise/BYOC, nothing leaves your environment.
  • For hosted, you send traces over TLS to LangSmith’s SaaS; you can keep sensitive data redacted at the SDK level.

• Hybrid with Langfuse:

  • Your applications and Langfuse backend both run in your cloud.
  • You may still rely on external model APIs (OpenAI, Anthropic, etc.), but the observability layer stays local.
  • You own upgrades, scaling, and operations for Langfuse itself.

How LangSmith Works in a VPC-Centric Architecture

When you deploy LangSmith into your own cluster, you’re not just hosting a database; you’re hosting the full agent engineering platform:

1. Trace ingestion inside your VPC

   • Instrument applications via LangSmith SDKs or OpenTelemetry; every run includes:
     • Model calls (prompts/outputs, tokens, latency)
     • Tool calls and arguments
     • Branching/looping logic
     • Multi-turn chat threads
   • These events are sent to your LangSmith instance via internal networking—no data leaves your controlled environment.

2. Trace exploration, debugging, and analytics

   • Use LangSmith’s UI to:
     • View run timelines: see each step and tool call in order.
     • Inspect threads: follow multi-turn conversations end-to-end.
     • Slice by tags, models, tools, customers, or environments.
   • Analytics dashboards summarize:
     • Error rates, latency, token usage.
     • Tool performance and failure hot spots.
     • Model performance across traffic segments.

3. Evaluation and alignment workflow

   • Convert production traces into datasets with a few clicks or via API.
   • Run offline evals with:
     • LLM-as-judge evaluators.
     • Custom code-based metrics.
   • Use Align Evals to calibrate LLM-as-judge with human corrections and few-shot examples.
   • Route tricky traces to annotation queues for subject matter experts.
   • Run online evals on live traffic to monitor regressions in real time.

4. Deployment and runtime inside your VPC

   • Use LangSmith Deployment for:
     • Durable checkpointing and memory.
     • Exactly-once execution for long-running agents.
     • Versioning and rollbacks.
     • Native protocol support (A2A, MCP).
   • Fleet/Agent Builder lets non-technical teams define agents and tools, with:
     • OAuth-based tool connections.
     • Tool-level approvals and human-in-the-loop controls.
   • All of this runs inside your infra, governed by your security policies.

This is the key design choice: traces are the system of record for what your agents do, and LangSmith turns those traces into datasets, evals, and deployment decisions—all without needing to export data out of your VPC.

How Langfuse Works in a VPC-Centric Architecture

With Langfuse, you typically do more assembly yourself, but the core pattern is similar:

1. Self-host the Langfuse backend

   • Deploy Langfuse (app + DB) in your VPC or cluster.
   • Handle:
     • Database provisioning.
     • Scaling and backups.
     • Upgrades and patching.
   • Wire IAM and networking to match your security posture.

2. Instrument your LLM stack

   • Use Langfuse’s callback handlers and libraries with:
     • LangChain.
     • OpenAI SDK.
     • LlamaIndex.
     • LiteLLM.
     • Vercel AI SDK.
     • Haystack.
     • Mastra.
   • This lets you capture traces without modifying core business logic.

3. Use observability, prompt management, and evals

   • View traces in the Langfuse UI: prompts, responses, timings.
   • Manage prompts centrally.
   • Run evaluations (e.g., correctness, toxicity) with their eval features.
   • Combine Langfuse signals with your own pipelines and dashboards.

Here, Langfuse is one component in a larger stack you assemble: you’ll likely plug it into your own deployment runtime, CI/CD, and external evaluation or analytics systems.

Limitations & Considerations

• Operational overhead (Langfuse, and any self-hosted stack):
  Running Langfuse in your VPC gives you control, but you own uptime, upgrades, and bug triage. Users report occasional bugs in self-hosted setups, so plan engineering time for maintenance.

• End-to-end agent workflows (Langfuse vs LangSmith):
  Langfuse gives you strong observability, prompt management, and evals. If you want a tightly integrated loop—from trace to dataset to eval to deployment & rollback—for complex agents, you’ll need to assemble more pieces yourself compared to LangSmith’s built-in agent runtime and eval workflows.

Pricing & Plans

This is where the decision often becomes practical: how do you pay for each option and what do you get?

• LangSmith:

  • Hosted tiers with generous free usage and paid plans (seat-based plus pay-as-you-go traces).
  • Enterprise / BYOC / self-hosted options for teams that need:
    • VPC or on-prem deployment.
    • US/EU residency, hybrid, and self-hosted data control.
    • Extended retention (e.g., beyond 14 days up to 400+ days).
    • Enterprise security controls (SSO/SAML, SCIM, RBAC/ABAC, audit logs).
  • Designed for teams that want an end-to-end agent engineering platform in one place and don’t want to maintain multiple stitched-together systems.

• Langfuse:

  • Free tier (hosted): 50k units/month, 2 users.
  • Enterprise (hosted or supported): from $2,499/month.
  • Open source core (MIT): no license fee for self-hosting, but you pay in infra and engineering time.
  • Best for teams that are comfortable owning the observability stack and want open-source flexibility.

Because pricing changes, it’s worth checking each vendor’s current page and talking to sales if you’re planning a large-volume or strict-compliance deployment.

Plan Fit (Conceptual)

• LangSmith Enterprise / BYOC: Best for teams needing end-to-end agent engineering in their VPC—trace-first observability, evals, datasets, annotation queues, and a durable runtime—with enterprise security and admin controls.
• Langfuse Self-Hosted + Your Stack: Best for teams wanting an open-source observability and eval layer they can deeply customize and integrate, and who are fine owning upgrades and operational risk.

Frequently Asked Questions

Can we keep all traces inside our VPC and still get full dashboards and evals with LangSmith?

Short Answer: Yes. With LangSmith Enterprise/BYOC, you can deploy LangSmith into your own Kubernetes cluster so traces never leave your environment while keeping the full UI, dashboards, evals, and deployment runtime.

Details:
In an Enterprise/BYOC setup:

• All trace data, datasets, eval results, and deployment state live in your VPC (AWS, GCP, or Azure).
• You access LangSmith via internal or VPN-secured endpoints, just like any internal app.
• You still get:
  • Rich trace timelines and thread views.
  • Analytics dashboards across traces.
  • Offline and online evals, including multi-turn and LLM-as-judge calibrated with human feedback.
  • Annotation queues for human review.
  • LangSmith Deployment with memory, checkpointing, exactly-once execution, versioning, and rollbacks.
• LangSmith integrates with your existing security stack: SSO/SAML, SCIM, RBAC/ABAC, audit logs, encryption at rest and in transit.

Can we keep all traces inside our VPC and still get dashboards and evals with Langfuse?

Short Answer: Yes. Langfuse’s MIT-licensed core is designed for self-hosting, so you can run it in your VPC and use its dashboards and evals locally.

Details:
To keep data in your VPC with Langfuse:

• Deploy the Langfuse backend and database into your cloud environment (EKS/GKE/AKS or equivalent).
• Configure your applications to send traces to that internal endpoint using Langfuse SDKs and callback handlers.
• Use the Langfuse UI inside your network to:
  • Explore traces and logs.
  • Manage prompts centrally.
  • Run evaluations on your LLM outputs.
• You are responsible for:
  • Scaling and performance tuning.
  • Upgrades and bug fixes.
  • Integration with your identity and access control systems.
• If you want enterprise support, you can layer their commercial offering on top of your self-hosted or hybrid setup.

Summary

If your question is, “Can we keep traces in our VPC and still get dashboards and evals?” the answer is yes for both LangSmith and Langfuse—but the tradeoffs are different:

• LangSmith is built for teams serious about agents: trace-first, framework-agnostic, with evals, annotation queues, and a durable runtime designed for long-running, tool-using agents. Enterprise and BYOC options let you run the full experience in your own VPC, so you don’t sacrifice visibility or workflows to meet security requirements.

• Langfuse is a strong open-source choice if you want LLM observability, prompt management, and evals that you can self-host and customize. You keep all data inside your infra but take on more operational and integration work, especially if you’re building complex agents and need an end-to-end improvement loop.

If you’re optimizing for deep agent workflows, trace-first debugging, and integrated evals + deployment in a secure VPC setup, LangSmith Enterprise is usually the more complete answer. If you’re optimizing for open-source flexibility and DIY observability, Langfuse is a solid component in a broader stack.

Next Step

Get Started