Skip to main content
LangWatch is open-core. The Apache 2.0 self-hosted floor gives you a single trace store, append-only event log, persona-aware chrome, governed CLI flow, and 30-day retention, enough to satisfy basic auditability and PII redaction. Going beyond that, multi-source ingestion, multi-class retention, anomaly detection, OCSF/SIEM export, tamper-evidence, requires an Enterprise license. This page is the canonical self-hosted compliance map. Skim it before you commit to a deployment plan; the right tier for your org depends on which mechanisms you actually need on day one.
Pairs with: AI Governance → Compliance architecture. That page documents the underlying substrate; this page narrows it to “what runs in your self-hosted box without buying anything else”.

​
TL;DR: open-core split

The split is enforced at three layers, see Open-core licensing for the layered enforcement (UI gating + tRPC middleware + service-layer defense-in-depth + CLI 402 envelope), and Per-file license headers for the canonical SPDX header text on each tier.

​
SOC 2 Type II: what self-hosted underwrites

SOC 2 Type II asks for operating-effectiveness evidence over a 6-12 month window that your security controls work as designed. The self-hosted Apache 2.0 floor gives you the controls + the audit-evidence machinery for the common-criteria baseline: Bottom line: self-hosted Apache 2.0 is sufficient for the access-control + 30-day-monitoring portions of SOC 2 CC. Detection (CC7.1) and long-window monitoring (CC7.2 ≥1y) and incident-response export (CC7.4) and change-mgmt audit (CC8.1) all require Enterprise.

​
ISO 27001: same shape

ISO 27001 Annex A controls map onto the same self-hosted-vs-Enterprise boundary as SOC 2 above. The Apache 2.0 floor gives you A.5 (policies), A.8 (asset management, tenant boundaries), A.9 (access control), A.12.4 (logging, 30-day window). Anomaly detection (A.12.4 ≥6-month retention), SIEM export (A.16 incident management), and SCIM (A.9.2 user lifecycle) require Enterprise.

​
GDPR: Art. 32 + Art. 30 mapping

If your processor agreement requires retention longer than 30 days OR a named breach-notification mechanism (Art. 33’s “without undue delay, where feasible, not later than 72 hours”), Enterprise is the right tier even for non-EU customers because GDPR’s extra-territorial scope applies.

​
HIPAA: most uses

HIPAA’s covered-entity vs business-associate split + the §164.312 technical safeguards map cleanly onto the open-core split:
  • §164.312(a)(1) Access control: Apache 2.0 RBAC catalog + per-project tenancy
  • §164.312(b) Audit controls: Apache 2.0 event_log @ 30d retention
  • §164.312(b) ≥6yr retention: Enterprise seven_years retention class
  • §164.312(c)(1) Integrity: Enterprise tamper-evidence (post-GA follow-up)
  • §164.312(d) Authentication: Apache 2.0 SSO (env-configured) + Personal IDE keys
  • §164.312(e) Transmission security: Apache 2.0 (TLS at gateway + dataplane)
HIPAA-most-uses: covered entities with PHI in LLM traces should treat Apache 2.0 as the floor for technical safeguards; the §164.312(b) 6-year audit-log requirement and §164.312(c)(1) integrity (when you need cryptographic tamper-evidence) push toward Enterprise. For BAAs with explicit retention clauses, Enterprise is required.

​
EU AI Act: Art. 12 logging + Art. 18 record-keeping

The EU AI Act’s high-risk-AI logging requirements (Art. 12) and the provider/deployer record-keeping (Art. 18) map onto:
  • Art. 12(1) automatic recording of events: Apache 2.0 unified trace store + 30d retention
  • Art. 12(2)(a) period of operation: Apache 2.0 (trace timestamps in event_log)
  • Art. 12(2)(b) reference DB used: Apache 2.0 (gen_ai.system + gen_ai.request.model attrs on each span)
  • Art. 12(2)(c) input data check: Apache 2.0 (prompt + tool-call payloads on traces, redacted via Presidio)
  • Art. 12(2)(d) human oversight: Enterprise anomaly-rule dispatch (so a person reviews flagged events) + OCSF/SIEM forwarding
  • Art. 18(1) record-keeping ≥10y: This is Enterprise’s 10y retention class (note: shipped as seven_years today; 10y class is on the post-GA roadmap).
Most enterprise-deploying-an-LLM-agent uses fall under Art. 12 (1-3 year retention windows). Art. 18 record-keeping for high-risk systems explicitly requires the Enterprise retention extension.

​
What’s intentionally unavailable on Apache 2.0

Not “limited”, intentional design boundaries that keep the open-core floor narrow enough to be free-as-in-beer-AND-as-in-speech:
  • Anomaly detection + dispatch is Enterprise. The detection is the thing you pay for.
  • Multi-class retention is Enterprise. 30 days is sufficient for CC7.2 monitoring + Art. 30 GDPR processing-records-baseline.
  • OCSF/SIEM export is Enterprise. Apache 2.0 customers can still pull traces from the trace store via the same query API the dashboard uses; what’s gated is the normalised OCSF event stream with cursor pagination + tenant-isolated read endpoints.
  • Custom roles via CustomRolePermissions JSON is Enterprise. The default 5-role RBAC catalog (ADMIN, MEMBER, EXTERNAL + per-resource view/manage actions) is Apache 2.0.
  • SCIM provisioning is Enterprise. Apache 2.0 customers can still use SSO (Okta, Auth0, Azure AD) for sign-in.

​
Migrating from Apache 2.0 to Enterprise

There’s no schema migration. Adding an Enterprise license to a running self-hosted deployment unlocks the gated UI surfaces (<EnterpriseLockedSurface> flips to render the page content) and removes the router-layer requireEnterprisePlan middleware’s 403, CLI 402 responses for those procedures + endpoints. Existing data, traces, event_log rows, RoleBinding entries, AiToolCatalogEntry rows, is unchanged. For the upgrade path:
  1. Provision your Enterprise license (contact sales).
  2. Set LANGWATCH_LICENSE (or equivalent, see your contract) in your self-hosted env.
  3. Restart the control-plane pod, pnpm dev (no migration needed).
  4. The previously-gated surfaces light up immediately. Existing <EnterpriseLockedSurface> wraps detect the plan flip on next page render.
Downgrade is symmetric (drop the env var, restart). All data stays queryable; gated surfaces re-gate.

​
Where to next