GovernAtlasSubmit your product ↗
Discover platforms/Langfuse

GOVERNATLAS / PRODUCT DOSSIER

Langfuse

Langfuse documents tracing, prompt version management, datasets and evaluation workflows.

Explore the product ↗Add to comparison ↗

01 / CONTEXT & SCOPE

Understand the proposition.
Define the boundary.

The decision to make

Evaluate whether traces, prompt versions, datasets and evaluation results can support one reproducible release decision. A trace explains a run; a dataset supports repeated comparisons. Your team needs an explicit relationship between those two forms of evidence.

What this record does not establish

Documented tracing and evaluation workflows do not establish the validity of your metrics, retention configuration, hosting choice or permission boundaries. Confirm the proposed edition and environment.

6 current sources · 7 published assertions
Source coverage is a research boundary, not a quality score.

02 / YOUR EVALUATION

Turn interest into a useful trial.

Open the evaluation playbook ↗
A

A test worth running

Preserve a failed trace, add a sanitized version of the case to a fixed evaluation dataset and compare two prompt versions. Inspect how the result identifies the model, prompt, inputs and scoring configuration. Include a trace with redacted content to test the effect on later investigation.

GovernAtlas editorial proposal. We have not performed this test.

B

Evidence to bring back

  1. Reconstruct a comparison from fixed dataset and prompt identifiers rather than a screenshot of aggregate scores.
  2. Demonstrate how sensitive inputs are removed or restricted while retaining enough context for authorized investigation.

03 / DOCUMENTED EVIDENCE

Read the claim. Inspect the basis.

Each statement retains its classification and preserved source. A vendor assertion is not an independent test result.

01
vendor asserted

Langfuse's GDPR documentation directs users to its DPA and personal-data management guidance, and identifies privacy@clickhouse.com for data-subject requests. Buyers still need to reconcile the current contracting entity, agreement, processing roles and transfer terms for their chosen service.

Source, dates & preserved provenanceLangfuse — Cloud security: gdpr ↗

Authority: vendor owned
Observed 2026-11-02 · Reviewed 2026-11-02 · current until 2026-12-02

Artifact SHA-256: 85e8799037c63117156c41084598a80c3ad457a59eadd5d1f9dc6b0409f64fe7

The hash identifies the preserved capture. The live source may have changed.

02
vendor asserted

Langfuse states that Langfuse Cloud is ISO 27001 certified and offers its certificate on request to Pro, Team or Enterprise customers. The captured page does not establish issuer, certificate number, expiry or detailed ISMS scope; it is not independent certificate validation or coverage of self-hosted systems.

Source, dates & preserved provenanceLangfuse — Cloud security: iso27001 ↗

Authority: vendor owned
Observed 2026-11-02 · Reviewed 2026-11-02 · current until 2026-12-02

Artifact SHA-256: a9f05c6a40699d97155177c0e76430ebaa382d25844fcf0a74ed1a5a2c84e088

The hash identifies the preserved capture. The live source may have changed.

03
vendor asserted

Langfuse documents completion of a SOC 2 Type II audit for Langfuse Cloud and makes the report requestable on Pro, Team or Enterprise plans. GovernAtlas has not reviewed the restricted report, period, auditor opinion or exceptions; this statement is not an assessment of self-hosted installations.

Source, dates & preserved provenanceLangfuse — Cloud security: soc2 ↗

Authority: vendor owned
Observed 2026-11-02 · Reviewed 2026-11-02 · current until 2026-12-02

Artifact SHA-256: f68258799bfdf07cbf575ca771976262777d2f395cdfe8ad9367213c9ee0f0cf

The hash identifies the preserved capture. The live source may have changed.

04
vendor asserted

Langfuse's compliance FAQ states that its cloud offering supports SOC 2 Type II, ISO 27001 and GDPR requirements and offers a HIPAA-ready region. These remain supplier assertions; GovernAtlas has not inspected an auditor's report or determined regulatory compliance.

Source, dates & preserved provenanceLangfuse — Compliance FAQ ↗

Authority: vendor owned
Observed 2026-11-02 · Reviewed 2026-11-02 · current until 2026-12-02

Artifact SHA-256: 3c77194c037ce273a99bba4afbe0b9ecc9fe18f7e7ad7d7b8f15143e6151f1af

The hash identifies the preserved capture. The live source may have changed.

05
vendor asserted

Langfuse says its HIPAA cloud region is separate from its other cloud regions. Its documentation distinguishes self-hosting, where safeguards are the customer's responsibility, from Langfuse-operated cloud infrastructure. This distinction does not establish HIPAA compliance of a self-hosted deployment.

Source, dates & preserved provenanceLangfuse — HIPAA region and BAA requirements ↗

Authority: vendor owned
Observed 2026-11-02 · Reviewed 2026-11-02 · current until 2026-12-02

Artifact SHA-256: 266b66a7892176cd472e1c2326c8dfe18c199e7a13ab5d70d449d701cde8e785

The hash identifies the preserved capture. The live source may have changed.

06
vendor asserted

Langfuse's HIPAA documentation describes a dedicated cloud region for healthcare workloads in Oregon (AWS us-west-2), eligible on Pro plans or higher, and instructs customers to complete a signed BAA before processing PHI. Scope: this specified cloud service; an executed customer agreement and deployment compliance have not been verified.

Source, dates & preserved provenanceLangfuse — HIPAA region and BAA requirements ↗

Authority: vendor owned
Observed 2026-11-02 · Reviewed 2026-11-02 · current until 2026-12-02

Artifact SHA-256: 266b66a7892176cd472e1c2326c8dfe18c199e7a13ab5d70d449d701cde8e785

The hash identifies the preserved capture. The live source may have changed.

07
vendor asserted

Langfuse documents tracing, prompt version management, datasets and evaluation workflows. Scope: vendor documentation only; edition and availability boundaries require confirmation.

Source, dates & preserved provenanceLangfuse — official product or documentation page ↗

Authority: vendor owned
Observed 2026-10-14 · Reviewed 2026-10-15 · current until 2026-11-13

Artifact SHA-256: ea3d0bb045c5795fd57a68d547b3dac4a6d1f36687ab65c76c116c59e9caa402

The hash identifies the preserved capture. The live source may have changed.

Source register

Langfuse — Cloud security: gdpr ↗vendor owned · captured 2026-11-02
Langfuse — Cloud security: iso27001 ↗vendor owned · captured 2026-11-02
Langfuse — Cloud security: soc2 ↗vendor owned · captured 2026-11-02
Langfuse — Compliance FAQ ↗vendor owned · captured 2026-11-02
Langfuse — HIPAA region and BAA requirements ↗vendor owned · captured 2026-11-02
Brand asset provenance

Organization identity asset from its official website; inclusion does not imply endorsement.

Official website ↗ · Original asset ↗

04 / BEFORE YOU COMMIT

Better questions.
A clearer decision.

Resolve these with the provider and your own evaluation team.

01

Which trace fields can be redacted before ingestion, and how is retention configured?

02

What deployment, retention and access-control evidence supports the intended use?

03

What underlying assurance documents are available, and which claims remain unverified?

Regulatory applicability requires a separate, current determination. Inclusion is not certification.

COMPLIANCE / CLAIMS, SCOPE & GAPS

Start with the requirement.
Inspect the support.

Prepare your vendor review ↗

These labels describe this dossier’s current evidence coverage. A published mention may be a framework mapping, a qualified assertion or a limitation; it is not a compliance finding.

HIPAA

Published mention available

US healthcare privacy & security

Vendor documents BAA availability

Pro or higher, dedicated Oregon HIPAA cloud region, signed BAA before PHI. Other cloud regions are outside this documented path.

Read the source-attributed statement

Langfuse's compliance FAQ states that its cloud offering supports SOC 2 Type II, ISO 27001 and GDPR requirements and offers a HIPAA-ready region. These remain supplier assertions; GovernAtlas has not inspected an auditor's report or determined regulatory compliance.

vendor asserted

Langfuse — Compliance FAQ ↗
Read the source-attributed statement

Langfuse says its HIPAA cloud region is separate from its other cloud regions. Its documentation distinguishes self-hosting, where safeguards are the customer's responsibility, from Langfuse-operated cloud infrastructure. This distinction does not establish HIPAA compliance of a self-hosted deployment.

vendor asserted

Langfuse — HIPAA region and BAA requirements ↗
Read the source-attributed statement

Langfuse's HIPAA documentation describes a dedicated cloud region for healthcare workloads in Oregon (AWS us-west-2), eligible on Pro plans or higher, and instructs customers to complete a signed BAA before processing PHI. Scope: this specified cloud service; an executed customer agreement and deployment compliance have not been verified.

vendor asserted

Langfuse — HIPAA region and BAA requirements ↗

Explore HIPAA evidence ↗

GDPR

Published mention available

EU personal data protection

Data-processing documentation

Inspect the current DPA, subprocessor chain, deletion settings and transfer assessment; a privacy contact alone does not establish compliance.

Read the source-attributed statement

Langfuse's GDPR documentation directs users to its DPA and personal-data management guidance, and identifies privacy@clickhouse.com for data-subject requests. Buyers still need to reconcile the current contracting entity, agreement, processing roles and transfer terms for their chosen service.

vendor asserted

Langfuse — Cloud security: gdpr ↗
Read the source-attributed statement

Langfuse's compliance FAQ states that its cloud offering supports SOC 2 Type II, ISO 27001 and GDPR requirements and offers a HIPAA-ready region. These remain supplier assertions; GovernAtlas has not inspected an auditor's report or determined regulatory compliance.

vendor asserted

Langfuse — Compliance FAQ ↗

Explore GDPR evidence ↗

SOC 2

Published mention available

Assurance report · not a law

Vendor-reported assurance

Request the current report and reconcile cloud service boundaries, reporting period, subservice organizations and customer controls.

Read the source-attributed statement

Langfuse documents completion of a SOC 2 Type II audit for Langfuse Cloud and makes the report requestable on Pro, Team or Enterprise plans. GovernAtlas has not reviewed the restricted report, period, auditor opinion or exceptions; this statement is not an assessment of self-hosted installations.

vendor asserted

Langfuse — Cloud security: soc2 ↗
Read the source-attributed statement

Langfuse's compliance FAQ states that its cloud offering supports SOC 2 Type II, ISO 27001 and GDPR requirements and offers a HIPAA-ready region. These remain supplier assertions; GovernAtlas has not inspected an auditor's report or determined regulatory compliance.

vendor asserted

Langfuse — Compliance FAQ ↗

Explore SOC 2 evidence ↗

ISO 27001

Published mention available

Information security management standard

Vendor-reported assurance

Obtain the actual certificate and current scope, then verify issuer, dates, covered entity, services and locations.

Read the source-attributed statement

Langfuse states that Langfuse Cloud is ISO 27001 certified and offers its certificate on request to Pro, Team or Enterprise customers. The captured page does not establish issuer, certificate number, expiry or detailed ISMS scope; it is not independent certificate validation or coverage of self-hosted systems.

vendor asserted

Langfuse — Cloud security: iso27001 ↗
Read the source-attributed statement

Langfuse's compliance FAQ states that its cloud offering supports SOC 2 Type II, ISO 27001 and GDPR requirements and offers a HIPAA-ready region. These remain supplier assertions; GovernAtlas has not inspected an auditor's report or determined regulatory compliance.

vendor asserted

Langfuse — Compliance FAQ ↗

Explore ISO 27001 evidence ↗

For HIPAA-regulated use, request service-specific BAA eligibility, processing scope and responsibility details. Missing evidence here does not establish noncompliance. Payment cannot alter these evidence labels.

KEEP THE RECORD USEFUL

A dossier should stand up to scrutiny.

Have a source that changes this picture? Submit it for editorial review.

Raise an evidence issue ↗