Open source LLM observability runs entirely within private enterprise networks
Platform teams operating within banks, healthcare organizations, and public sector agencies can run open-source large language model observability entirely inside their own infrastructure. Open-source LLM observability tools publish their images and Helm charts, allowing organizations to run the whole stack in their own cluster with their own databases. Organizations evaluating these platforms must examine three core factors: the specific components executed by the installation, outbound data transmissions, and enterprise security controls that require a commercial license.
LangWatch uses Apache 2.0 license for self-hosted deployments
Self-hosted deployments run the exact software binaries utilized by cloud-managed tiers, eliminating the need to outgrow a separate community edition. LangWatch operates under the Apache 2.0 license, providing unlimited members, teams, projects, traces, evaluations, simulations, and experiments without capacity restrictions. Enterprise licenses activate advanced controls such as Single Sign-On (SSO), System for Cross-domain Identity Management (SCIM), custom role-based access control (RBAC), audit logs, and extended data retention periods on existing deployments.
Competing open-source alternatives feature distinct licensing models and core capabilities. Langfuse utilizes an MIT core with select features requiring license keys, while Arize Phoenix operates under the Elastic License 2.0. OpenLIT, Opik, and Helicone also provide Apache 2.0 self-hostable frameworks, with OpenLIT functioning as a lightweight container featuring a built-in OpenTelemetry (OTLP) receiver and ClickHouse database integration.
| Observability Tool | License Type | Default Included Features | Enterprise License Additions |
|---|---|---|---|
| LangWatch | Apache 2.0 | Tracing, evaluations, prompt management, AI Gateway, ClickHouse, PostgreSQL, Redis, S3 | SSO, SCIM, custom roles, audit logs, extended data retention |
| Langfuse | MIT core | Web/worker containers, PostgreSQL, ClickHouse, Redis, S3, LLM API playground | Project-level RBAC roles, audit logs, SCIM integration |
| Arize Phoenix | Elastic License 2.0 | Single container trace collector, SQLite or PostgreSQL support, OAuth2, LDAP, RBAC | Feature gates vary by managed enterprise tier |
Component architecture inside private cloud clusters
A self-hosted LangWatch deployment executes through a single Helm chart managing the web application, background workers, AI Gateway, Langy assistant, PostgreSQL, Redis, and ClickHouse databases backed by S3 object storage. Administrators deploy the development configuration using standard Kubernetes commands:
bash
helm repo add langwatch
helm pull langwatch/langwatch –untar
helm install langwatch ./langwatch –namespace langwatch –create-namespace –set autogen.enabled=true -f langwatch/examples/overlays/size-dev.yaml –wait –timeout 10m
The development profile requires approximately 2.8 CPU cores and 6.9 GiB of memory requests. Production environments replace automatically generated secrets with custom credentials and scale ClickHouse across three or more replicated nodes. Background workers process tasks asynchronously, including cost enrichment, personally identifiable information (PII) redaction, and evaluations. PII redaction runs by default on workers prior to trace storage, utilizing Microsoft Presidio internally for strict anonymization.
Data governance and outbound network connections
A standard deployment transmits one daily usage report containing aggregate numerical counts, timestamps, release versions, and company email domains without trace contents, prompts, dataset rows, or API keys. Setting the environment variable `LANGWATCH_CONNECT_DISABLED=true` terminates all outbound requests, including daily usage reports and license verifications. Air-gapped environments mirror container images into private registries, install charts locally, and utilize signed license keys verified offline. Content-carrying services such as Instant Evals and managed model proxies remain inactive unless explicitly activated by an administrator and enabled via an enterprise license. Data privacy rules drop specific inputs, outputs, system prompts, or tool calls at ingestion while preserving token counts, latency metrics, and computed costs.
Frequently asked questions about self-hosted observability
Can self-hosted LLM observability platforms operate without any internet access?
Yes. Administrators mirror container images into private registries, apply signed license keys that verify locally, and configure `LANGWATCH_CONNECT_DISABLED=true` to block all external network traffic. Evaluators utilize private in-network language models rather than external frontier APIs.
What specific data leaves the private network during daily operations?
Unless completely disabled via environment variables, deployments transmit a single daily report consisting exclusively of aggregate operational counts, software release versions, timestamps, and organization email domain tallies without any prompt texts or trace contents.
Related reading