Skip to main content
LangWatch is open-core. The Apache 2.0 self-hosted floor gives you a single trace store, append-only event log, persona-aware chrome, governed CLI flow, and 49-day default retention, enough to satisfy basic auditability and PII redaction. Going beyond that, multi-source ingestion, extended retention, anomaly detection, OCSF/SIEM export, tamper-evidence, requires an Enterprise license.
The 49-day window in the tables below is the retention LangWatch applies by default. It is not a period any of these frameworks prescribe.What you can set instead depends on the plan, per organization, team or project. Paid cloud plans choose 35 or 63 days. Enterprise plans and licensed self-hosted deployments choose those or any whole number of weeks from 49 days up, and a self-hosted platform administrator can keep data indefinitely. The free plan and an unlicensed self-hosted deployment stay on the default. See Data Retention and Pricing.
The right tier for your organization depends on which mechanisms you need on day one, so read the map below before you commit to a deployment plan.
Pairs with: AI Governance → Compliance architecture. That page documents the underlying substrate; this page narrows it to “what runs in your self-hosted box without buying anything else”.

​
TL;DR: open-core split

The split is enforced at three layers, see Open-core licensing for the layered enforcement (UI gating + tRPC middleware + service-layer defense-in-depth + CLI 402 envelope), and Per-file license headers for the canonical SPDX header text on each tier.

​
SOC 2 Type II: what self-hosted underwrites

SOC 2 Type II asks for operating-effectiveness evidence over a 6-12 month window that your security controls work as designed. The self-hosted Apache 2.0 floor gives you the controls + the audit-evidence machinery for the common-criteria baseline: Bottom line: self-hosted Apache 2.0 is sufficient for the access-control + 49-day-monitoring portions of SOC 2 CC. Detection (CC7.1) and long-window monitoring (CC7.2 ≥1y) and incident-response export (CC7.4) and change-mgmt audit (CC8.1) all require Enterprise.

​
ISO 27001: same shape

ISO 27001 Annex A controls map onto the same self-hosted-vs-Enterprise boundary as SOC 2 above. The Apache 2.0 floor gives you A.5 (policies), A.8 (asset management, tenant boundaries), A.9 (access control), A.12.4 (logging, 49-day window). Anomaly detection (A.12.4 ≥6-month retention), SIEM export (A.16 incident management), and SCIM (A.9.2 user lifecycle) require Enterprise.

​
GDPR: Art. 32 + Art. 30 mapping

If your processor agreement requires retention longer than the 49-day default OR a named breach-detection mechanism that feeds your Art. 33 notification (its “without undue delay, where feasible, not later than 72 hours” clock starts when you become aware), Enterprise is the right tier. Self-hosted, a license is what opens a longer window at all. This reaches customers outside the EU as well, but only where Art. 3 puts them in scope: processing in the context of the activities of an establishment in the EU, an offer of goods or services to people in the EU, or monitoring of their behavior in the EU. One retention clause to state explicitly in DPAs: billing spend records (the per-request metering ledger under Billing & spend events) are kept for a fixed 13 months, outside tenant retention policies, on every deployment with the ClickHouse spend path. They carry ids, quantities, and cost, never prompt or response content, and they exist so invoiceable evidence survives operational retention shortening. Map them as financial records with their own fixed lifetime.

​
HIPAA: most uses

HIPAA’s covered-entity vs business-associate split + the §164.312 technical safeguards map cleanly onto the open-core split:
  • §164.312(a)(1) Access control: Apache 2.0 RBAC catalog + per-project tenancy
  • §164.312(b) Audit controls: Apache 2.0 event_log @ 49d retention
  • §164.316(b)(2)(i) 6-year documentation retention: Enterprise extended retention policies (multi-year windows)
  • §164.312(c)(1) Integrity: Enterprise tamper-evidence (post-GA follow-up)
  • §164.312(d) Authentication: Apache 2.0 SSO (env-configured) + Personal IDE keys
  • §164.312(e) Transmission security: Apache 2.0 (TLS at gateway + dataplane)
HIPAA-most-uses: covered entities with PHI in LLM traces should treat Apache 2.0 as the floor for technical safeguards. Read the two retention rules apart: §164.312(b) requires an audit-control mechanism and sets no period for the logs themselves, while §164.316(b)(2)(i)‘s six years covers the documentation the rule requires you to keep, not the traces. What pushes trace retention to multi-year windows is a BAA clause or another obligation you have taken on. That, with §164.312(c)(1) integrity when you need cryptographic tamper-evidence, is what points to Enterprise.

​
EU AI Act: Art. 12 logging + Art. 18 record-keeping

The EU AI Act’s high-risk-AI logging requirements (Art. 12) and the provider/deployer record-keeping (Art. 18) map onto:
  • Art. 12(1) automatic recording of events: Apache 2.0 unified trace store + 49d retention
  • Art. 12(2)(a) period of operation: Apache 2.0 (trace timestamps in event_log)
  • Art. 12(2)(b) reference DB used: Apache 2.0 (gen_ai.system + gen_ai.request.model attrs on each span)
  • Art. 12(2)(c) input data check: Apache 2.0 (prompt + tool-call payloads on traces, redacted via Presidio)
  • Art. 12(2)(d) human oversight: Enterprise anomaly-rule webhook dispatch (it delivers the flagged event to a URL you control; the human review of what arrives there is your receiving process, not something LangWatch performs or records today), with OCSF/SIEM forwarding of governance events alongside it. The two are separate paths: anomaly alerts arrive over the webhook, never as a record in the OCSF export
  • Art. 18(1) record-keeping ≥10y: Enterprise extended retention policies, with windows set in years to match the record-keeping clause your assessment requires.
Most enterprise-deploying-an-LLM-agent uses fall under Art. 12 (1-3 year retention windows). Art. 18 record-keeping for high-risk systems explicitly requires the Enterprise retention extension.

​
What’s intentionally unavailable on Apache 2.0

These are deliberate design boundaries that keep the Apache 2.0 floor free to run and free to modify:
  • Anomaly detection + webhook dispatch is Enterprise. The detection is the thing you pay for. Webhook is the only destination type; Slack, PagerDuty and email are not implemented, so route through your own receiver if you need them.
  • Extended retention is Enterprise. The default window is sufficient for CC7.2 monitoring + Art. 30 GDPR processing-records-baseline.
  • OCSF/SIEM export is Enterprise. Apache 2.0 customers can still pull traces from the trace store via the same query API the dashboard uses; what’s gated is the normalised OCSF event stream with cursor pagination + tenant-isolated read endpoints.
  • Custom roles via CustomRolePermissions JSON is Enterprise. The default 5-role RBAC catalog (ADMIN, MEMBER, EXTERNAL + per-resource view/manage actions) is Apache 2.0.
  • SCIM provisioning is Enterprise. Apache 2.0 customers can still use SSO (Okta, Auth0, Azure AD, AWS Cognito, OneLogin) for sign-in.

​
Migrating from Apache 2.0 to Enterprise

There’s no schema migration. Adding an Enterprise license to a running self-hosted deployment enables the gated UI surfaces (<EnterpriseLockedSurface> flips to render the page content) and removes the router-layer requireEnterprisePlan middleware’s 403, CLI 402 responses for those procedures + endpoints. Existing data, traces, event_log rows, RoleBinding entries, AiToolCatalogEntry rows, is unchanged. For the upgrade path:
  1. Provision your Enterprise license (contact sales).
  2. Set LANGWATCH_LICENSE (or equivalent, see your contract) in your self-hosted env.
  3. Restart the control-plane pod, pnpm dev (no migration needed).
  4. The previously-gated surfaces become available immediately. Existing <EnterpriseLockedSurface> wraps detect the plan flip on next page render.
Downgrade is symmetric (drop the env var, restart). All data stays queryable; gated surfaces re-gate.

​
Where to next

Last modified on October 12, 2026