LangSmith Agent Engineering Platform by LangChain (BYOC)

LangSmith Bring Your Own Cloud (BYOC) gives enterprises a fully managed LangSmith deployment that runs inside their own AWS account and VPC. Sensitive application data - including traces, datasets, experiments, prompts, agent deployments, and sandbox data - stays in your AWS environment. LangChain provisions and operates the deployment, handling monitoring, upgrades, scaling, and cluster lifecycle management.

Teams taking AI agents from pilot to production often hit a common blocker: agent traces and runtime data include PII, PHI, customer records, internal API responses, tool outputs, and other sensitive context. These teams need LangSmith's observability, evaluation, deployment, and management capabilities, but they also need data to remain inside the cloud boundary they already govern.

With LangSmith BYOC on AWS, you can:

• Keep sensitive data in your own AWS account and VPC - no traces, datasets, or prompts leave your environment
• Spend less time on infrastructure and more time building, evaluating, and improving agents
• Scale agent development across teams and regions while keeping agents close to private systems
• Connect agents to internal systems - databases, private APIs, and on-premises resources over existing network paths

BYOC is available across 15 AWS regions in the US, EU, and APAC.

A BYOC deployment runs across two planes:

Control Plane (LangChain's cloud): Handles authentication, user management, workspace configuration, billing metadata, and the LangSmith frontend. It provisions, monitors, and orchestrates customer data planes. The control plane does not hold sensitive application data.

Data Plane (your AWS account): Contains the VPC, private Amazon EKS cluster, databases, object storage, and all sensitive LangSmith data. Communication between planes uses AWS PrivateLink and does not cross the public internet. The EKS cluster is private with no public API server endpoint and no public IPs on worker nodes.

Every BYOC data plane includes:

• A dedicated VPC in your AWS account
• A private Amazon EKS cluster with no public endpoints
• Daily backups for Amazon RDS and the trace store, written to Amazon S3 in your account
• Autoscaling for LangSmith services and node capacity
• Multi-AZ Amazon RDS and Amazon ElastiCache with automatic failover
• Auditable operational access with logs in your account via Amazon CloudWatch and Amazon S3

LangChain provisions infrastructure using Crossplane. You create an IAM role with a provided Terraform module, scoped to infrastructure management with permissions limited to resources tagged managed_by=langsmith.

• Observability: Tracing, projects, dashboards, and alerts
• Evaluation: Datasets, experiments, evaluators, and annotation queues
• Insights: Automatic analysis of traces to surface usage patterns and failure modes
• Context Hub: Prompts, memory, and other context files
• Agent Deployment: Deploy and manage agents inside your data plane
• Sandboxes: Code execution on a dedicated node group in your account
• LLM Gateway: Centralized model access with spend, rate limit, and data protection policies
• Fleet: Build and run no-code agents
• SmithDB: Observability backend for trace data, persisting to Amazon S3 in your account

LangChain handles infrastructure upgrades, LangSmith version upgrades, scaling, patching, backups, and health monitoring. Setup requires applying a Terraform module and creating a data plane in LangSmith. Additional data planes can be created across environments, AWS accounts, and regions with organization-level configuration carried across deployments.

LangSmith BYOC is designed for teams in financial services, healthcare, cybersecurity, and large enterprises with strict data governance requirements. LangSmith BYOC is available on AWS for customers on the LangSmith Enterprise plan.