LangChain is splitting the LangSmith architecture into a management controller and an isolated data plane managed by clients within AWS, Azure, and Google Cloud. The BYOC model moves computation closer to enterprise system data, removing the engineering overhead of updating Helm charts and databases within closed perimeters.
LangSmith Bring Your Own Cloud is officially operational on AWS and available in beta on Microsoft Azure and Google Cloud. Autonomous agent development teams face a rigid trade-off between information security requirements and infrastructure operating costs. Compliance regulations previously forced companies to deploy dedicated LangSmith instances to control sensitive prompts, agent trajectories, and datasets within their perimeter.
This approach protected telemetry from leaking outside the corporate network, but demanded dedicated platform engineers for infrastructure patching, database tuning, and schema migrations. Splitting the platform into a control plane and an isolated data plane eliminates this operational tax without forcing the transfer of proprietary logs to the vendor.
Control plane and telemetry separation
The architecture separates management metadata from enterprise agent workloads. LangChain hosts and administers the control plane, which stores credentials, workspace settings, billing metadata, hashed API keys, and static interface elements.
"You own the data plane, which holds all sensitive information: from traces, prompts, and datasets to experiments, agent deployments, and workspace secrets."
Clients retain full control over the data plane containing trajectories, prompts, datasets, experiments, agent deployments, and workspace secrets. Customers deploy multiple data planes across various cloud accounts and regions to isolate workspaces from one another. Platform teams separate production and test environments or run independent workloads on Azure for business units utilizing different cloud providers. LangChain manages orchestration, scaling, and updates directly inside the client's cloud account.
Multi-cloud infrastructure and migration costs
Cloud deployments utilize native network services and provider access management tools. AWS infrastructure operates within a virtual private subnet, allowing security teams to position databases inside isolated subnets and enforce policies on application roles. On Azure, the data plane functions inside a virtual network with an AKS private endpoint, routing incoming traffic through Istio and scaling resources via KEDA. Google Cloud deployments launch in any region, utilizing namespaces to isolate workloads from existing infrastructure and connect to the LangSmith control plane in the US.
"Migration happens in two steps. Step 1 involves preparing the BYOC data plane. Step 2 transfers workspace resources using our open-source migration tool."
Transitioning from standalone setups to the managed BYOC model executes in two phases: preparing the data plane and migrating workspace resources via an open-source migration tool with zero service downtime. The language model gateway runs directly within the data plane with support for enterprise provider keys.
The answer to reducing security overhead costs lies in shifting infrastructure administration risks to the vendor while preserving legal control over sensitive data arrays inside a proprietary VPC.
The BYOC model alters the unit economics of deploying agentic systems by shifting platform administration costs to the vendor while preserving perimeter security. For engineering leadership, this architecture removes the need to allocate dedicated platform resources for infrastructure maintenance, lowering total cost of ownership for enterprise AI deployments.
How the picture shifted
Engineering teams used to manually maintain isolated environments to protect sensitive prompts and execution traces, but LangChain now manages the infrastructure directly inside client environments across AWS, Azure, and Google Cloud. While in late August the company capped runaway spending and stripped private identifiers at an external gateway, the BYOC model keeps the entire data plane inside the enterprise perimeter. Platform teams offload database maintenance and routine patching while retaining workspace secrets and internal datasets within their own cloud accounts. The intricate separation of control and data planes neatly illustrates that enterprises still refuse to trust vendor clouds with their raw prompt logs.
Our stories: LangSmith LLM Gateway Blocks Agent Cost Spikes and PII (August 20); LangSmith Engine: Automating AI Agent Debugging & Traces (September 8).