Source: LangChain — 2026-08-12
Summary
LangSmith's Bring-Your-Own-Cloud (BYOC) deployment model is now generally available on AWS for LangSmith Enterprise customers, spanning 15 AWS regions across the US, EU, and APAC. The architecture runs the entire data plane — observability, evals, deployment, sandboxes, and the LLM Gateway — inside the customer's own AWS account and VPC, while LangChain operates a separate control plane outside that boundary to handle provisioning, upgrades, and scaling. The split means customer data and inference traffic never leave the customer's cloud account, while LangChain still manages the operational burden of keeping the platform current.
Key Takeaways
- BYOC is now GA (not beta) on AWS specifically, for LangSmith Enterprise customers, covering 15 regions across three geographies: US, EU, and APAC.
- The data plane — observability, evals, deployment infrastructure, sandboxes, and the LLM Gateway — runs entirely inside the customer's own AWS account and VPC, not LangChain's infrastructure.
- LangChain's control plane sits outside the customer's VPC boundary and handles provisioning, upgrades, and scaling remotely, without needing direct access to the data plane's contents.
- This is a meaningful compliance lever: sensitive prompts, traces, and model outputs stay inside a boundary the customer already controls and audits, rather than transiting a third-party vendor's cloud.
- The regional spread (15 AWS regions) suggests LangChain is targeting data-residency requirements directly — customers can pin deployment to a region for regulatory reasons.
- GA status follows a private beta period, marking BYOC as production-ready rather than early-access — a signal LangChain expects enterprise adoption to scale now.
Reel Script
Hook: Every enterprise security review for an AI vendor eventually hits the same question: where does our data actually go? LangSmith just answered it for AWS customers by putting the entire product inside your own cloud account — not a private subnet, your account.
Core Concept: BYOC stands for Bring-Your-Own-Cloud, and the mechanism is a split between a "data plane" and a "control plane." The data plane is everything that touches your actual traffic — observability logs, evaluation runs, the deployed agents themselves, sandboxed execution, and the LLM Gateway that routes model calls. In LangSmith's BYOC model, all of that runs inside your own AWS account and VPC, the private network boundary AWS gives every customer. The control plane is the operational layer — provisioning new resources, pushing upgrades, scaling capacity — and that stays with LangChain, running outside your VPC. Think of it like a landlord who manages the building's systems remotely but never gets a key to your actual apartment: LangChain can keep the platform patched and scaled without your prompts, traces, or customer data ever crossing into infrastructure they control. That's the opposite of a typical SaaS model, where all of it — data and operations — sits on the vendor's side.
Hands-On: The diagram worth drawing is two boxes. Box one is the customer's AWS account, and inside it sits a dashed-line VPC boundary containing five things: observability, evals, deployment, sandboxes, and the LLM Gateway — that's the data plane, and everything in it is under the customer's IAM policies, network rules, and audit logs. Box two, drawn outside the VPC boundary entirely, is LangChain's control plane, connected to box one by a thin arrow labeled "provisioning, upgrades, scaling." No arrow carries customer prompt data back to box two. Multiply box one by however many of the 15 supported regions a company operates in — US, EU, APAC — and each regional deployment keeps its data pinned to that AWS region, which is what makes this useful for a company under GDPR or a similar residency rule rather than just a nice-to-have.
Takeaway: For any enterprise that's been blocked from adopting an agent framework because "it has to stay in our VPC" is a hard requirement, this GA release removes that specific blocker on AWS — it's a real architectural boundary, not a compliance checkbox. If your security team has been the reason LangSmith adoption stalled, this is worth re-raising with them directly.