Networking

AWS PrivateLink

Langfuse Cloud is reached over public regional endpoints by default. Enterprise customers with a committed contract can also connect from their own AWS VPC through AWS PrivateLink, so requests from their systems to Langfuse stay on the AWS network instead of the public internet. PrivateLink is enabled per data region during onboarding. Talk to our sales team to get started.

How it works

1. You share the AWS account ID and the AWS region of the VPC that will connect.
2. We allow your account on the endpoint service for your data region and send you its service name.
3. You create an interface VPC endpoint to that service and enable private DNS on it. The regional hostname, for example jp.cloud.langfuse.com, then resolves to the endpoint inside your VPC.
4. We accept the connection and run a test request with you.

SDKs, API keys, and OpenTelemetry exporters keep their existing configuration because the hostname does not change. The interface endpoint runs in your AWS account, and AWS bills its hourly and data processing charges to you.

What PrivateLink covers

• Requests your systems send to Langfuse Cloud: SDK and OpenTelemetry ingestion, the public API, and the web app.
• VPCs in the same AWS region as your Langfuse data region, and VPCs in other AWS regions through cross-region PrivateLink where AWS supports it.

If you require private connectivity and infrastructure fully controlled by your organization, consider self-hosting Langfuse. Book time with us to discuss the best solution for your security needs.

Langfuse Cloud Egress IP Addresses

Langfuse Cloud makes outbound API calls from our infrastructure on behalf of users for features like LLM-as-a-judge evaluations or blob storage exports. For enhanced security, you may want to whitelist these IP addresses in your firewall or security group settings to allow these specific connections.

The IP addresses are as follows:

Contact

For questions regarding networking, please talk to us.