Data Security when using Langfuse Cloud

[nithin1995]

We are evaluating Langfuse cloud vs self host options. We are primarily worried to use langfuse cloud because our data might contain PII information. We want to know more details about Data security practices, Data storage and encryption details etc. Can you help me?

[dosubot[bot]]

Langfuse Cloud employs several data security practices and encryption methods to protect data, including PII information:

1. Data Encryption:

   • All data at rest and in transit is encrypted using TLS.
   • Services like Elasticache (Redis), Aurora (Postgres), Clickhouse, and S3 use AES-256 encryption.
   • Sensitive data is further protected with application-level encryption:
     • API keys are hashed using SALT.
     • Langfuse Console JWTs are encrypted via NEXTAUTH_SECRET.
     • LLM API credentials and integration credentials are encrypted using ENCRYPTION_KEY.
     • Encryption for LLM Calls, Traces, and Spans is in progress.

2. Infrastructure:

   • The database and application run on AWS infrastructure, managed by Supabase and Vercel, with data regions in Oregon (AWS us-west-2) for the US and Ireland (AWS eu-west-1) for the EU.

3. Security Measures:

   • Point-in-Time Recovery (PITR) with database backups and Write Ahead Log.
   • Single Sign-On (SSO) with Google, GitHub, and Azure, with options for enforcing SSO and requiring 2FA for organizations on the Team plan and above.
   • End-to-end encryption (mutual TLS) is available for advanced traffic management and observability.

4. Privacy and Compliance:

   • Langfuse does not use customer data for model training and treats it confidentially.
   • GDPR compliant with a Data Processing Agreement (DPA) available for Pro and Team plans.
   • SOC 2 Type II and ISO 27001 certified, with reports and certificates available for Team plans.
   • HIPAA compliance is not available, but can be attained by self-hosting on your own infrastructure/VPC.

5. Configuration and Deployment:

   • Langfuse provides a .env.prod.example file for configuring environment variables, including encryption keys and database URLs, ensuring secure deployment practices.
   • The ENCRYPTION_KEY must be 256 bits, 64 string characters in hex format, generated via openssl rand -hex 32.

These measures ensure that PII and other sensitive data are handled securely within Langfuse Cloud ^{[1][2][3][4][5]}.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[nithin1995]

Will the data be used for any internal purpose?

[marcklingen]

Will the data be used for any internal purpose?

I'd refer to section 10 of the terms, tldr: the data is not used to train any models or classifiers and kept confidential