LangChain Extends LangSmith BYOC Beta to Azure and Google Cloud
On November 3, 2026, LangChain announced that LangSmith's BYOC (Bring Your Own Cloud) deployment mode is now available in beta on Microsoft Azure and Google Cloud, after previously being generally available only on AWS. BYOC keeps data-plane components such as traces, prompts, datasets, and agent deployments within the customer's own cloud account and virtual network, while LangChain handles orchestration, scaling, and platform updates. All three clouds support the Managed Deep Agents endpoint, and the data-plane LLM Gateway supports models from 11 providers out of the box, as well as any OpenAI- or Anthropic-compatible endpoint.
Body
LangChain announced on November 3, 2026 that LangSmith Bring Your Own Cloud (BYOC) is now available in beta on Microsoft Azure and Google Cloud, expanding the managed deployment option beyond AWS, where it is generally available.
BYOC keeps sensitive LangSmith data and agent deployments in the customer’s cloud account. The company behind the platform, LangChain, manages the data plane, including orchestration, scaling, and platform updates. It is intended for organizations that want the data residency and network isolation of self-hosted LangSmith without operating the full platform themselves.
AWS was the earlier launch. LangChain’s August 12, 2026 announcement introduced BYOC for enterprises seeking a managed deployment inside their own AWS account and VPC, particularly teams with strict data-governance requirements.
How BYOC Divides LangSmith
BYOC separates the platform into a LangChain-operated control plane and a customer-owned data plane. The control plane contains authentication, organization and workspace configuration, billing metadata, hashed API keys, and static interface assets. The data plane contains traces, prompts, datasets, experiments, agent deployments, and workspace secrets.
An organization can maintain several data planes in different accounts and regions, with workspaces inside each one. That structure allows separation by region, environment, or business unit. A platform team could run production and staging in separate AWS accounts while a business unit standardized on Azure operates its own deployment.
The model also changes the upgrade burden associated with self-hosted LangSmith. Teams with strict compliance boundaries previously needed platform engineers to patch stateful services, configure databases, run schema migrations, and coordinate custom Helm rollouts. With BYOC, data remains in the customer’s virtual network while LangChain manages scaling, schema updates, and runtime dependencies.
LangChain said AWS customers cited continuous upgrades, faster access to new LangSmith features than the self-hosted release cycle, and automatic scaling as the main benefits.
Cloud Architecture and Security Responsibilities
All three clouds support Managed Deep Agents endpoints in BYOC data planes, but the implementations use each provider’s own networking and security building blocks.
On Azure, the data plane runs in a dedicated virtual network with a private AKS API endpoint. Istio and KEDA are deployed through Helm for ingress routing and event-driven scaling, and system telemetry goes to Azure Monitor. LangChain lists LangSmith Sandboxes support on Azure as coming soon. Google Cloud data planes can run in any region at launch, although they are managed from LangSmith’s US control plane; namespace-scoped resource names are intended to avoid collisions with existing infrastructure.
AWS supports an existing VPC, with the database placed in subnets the customer chooses. Security teams can attach their own security groups to application roles, allowing the data plane to fit existing ingress and egress inspection policies.
On AWS, two PrivateLink connections carry communication between the planes, and LangChain does not reach the customer environment over the public internet. Sensitive-data requests go directly from the browser or client to the customer data plane. The cross-account IAM role can provision and manage infrastructure, but it holds no s3:GetObject permission on the trace bucket, no rds-db:connect permission to PostgreSQL, and no elasticache:Connect permission to Redis.
On AWS, the shared responsibility model leaves cloud-account governance, internal connectivity, access policies, customer-side security monitoring, and compliance controls with the customer. LangChain operates and updates managed components. Incident troubleshooting may require customer-approved break-glass access, with a post-access summary covering timestamps, actions taken, and any data accessed.
Migration and Access
For organizations moving from self-hosted LangSmith, the open-source migration tool copies users and roles, datasets, experiments, prompts, annotation-queue configuration, automation rules, dashboards, and Fleet resources. It copies rather than moves data, leaving the source instance unchanged and live. The migration documentation also leaves manual work: deployed agents must be redeployed, Insights reports do not transfer between instances, and Fleet migrations require re-entering secret values and reconnecting per-user OAuth connections.
Traces, runs, and feedback follow a separate process operated by LangChain with internal tooling. Trace migration is supported on AWS, while the open-source tool does not migrate traces.
The Terraform modules behind BYOC and the migration tool are public. LangChain said the data-plane LLM Gateway supports models from 11 providers out of the box, plus any OpenAI- or Anthropic-compatible endpoint. Provisioning a BYOC data plane on AWS, Azure, or Google Cloud requires contacting LangChain sales.
For enterprises, the practical effect is a wider choice of where to place the data boundary without transferring cloud governance: LangChain can operate LangSmith in more places, while customer teams still own account controls, monitoring, compliance, and several migration tasks.