LangSmithOnboarding

BYOC Onboarding Overview

Understand what LangSmith BYOC involves and how setup works in your AWS account.

Relevant Tools
Admin Readiness Review→RBAC & SCIM Guide→ABAC Policy Builder→
Onboarding Partner Your assigned Customer Engineer owns your onboarding experience and is available to help if you have questions.

What is LangSmith BYOC?

LangSmith BYOC ("Bring Your Own Cloud") runs your data plane inside your own cloud account, while LangChain operates it for you:

  • Control Plane — Managed by LangChain. Handles authentication, billing, and org configuration.
  • Data Plane — Runs inside your own cloud account. Holds your traces, prompts, datasets, and secrets. LangChain provisions and operates this for you via a scoped, customer-granted access role — no infrastructure work required on your end beyond initial account setup.
Today
BYOC currently supports AWS, with support for additional clouds planned.

This gives you the operational simplicity of Cloud — automatic upgrades, scaling, and monitoring handled by LangChain — while keeping your data inside infrastructure you own and control.

How Setup Works

Full step-by-step setup instructions live in the official BYOC documentation — the summary below is a brief overview of what the process involves, not a complete walkthrough.

  1. Sign up and create your organization, same as LangSmith Cloud — your Customer Engineer needs your Organization ID to enable BYOC for your org.

    Important
    The organization you create must live in the AWS US region (https://aws.smith.langchain.com) — BYOC data planes are AWS-only today, so an org created in a GCP region (US, EU, or APAC) cannot be enabled for BYOC. Check with your Customer Engineer if you're unsure which region your org is in.

  2. Provision a dedicated AWS account and apply LangChain's BYOC Terraform module to create the IAM role LangChain will use. This is the only infrastructure you apply directly — no credentials are exchanged.

  3. Register your data plane in Settings > Infrastructure, using the role ARN, External ID, region, and VPC CIDR from step 2.

  4. LangChain provisions the rest. Your data plane moves through Requested → Provisioning → Active, visible in Settings > Data Planes.

  5. Set up private connectivity (Tailscale, PrivateLink, or VPC peering) to reach your data plane's endpoint.

Full Documentation & Support

The complete BYOC reference — architecture, security model, setup walkthrough, break-glass access, and migration guidance — lives in the official BYOC documentation.

If anything is unclear or something seems stuck, reach out to your account team or LangChain support.

Next: Configure Your Organization

With your data plane provisioned, use the Admin Readiness Review to work through org configuration — SSO, SCIM, workspace design, roles, ABAC policy, API keys, data retention, and more. Your Customer Engineer will guide you through each topic.