Langfuse
Observability · langfuse.com · last read 2026-11-09
At a glance
- Is Langfuse GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Langfuse itself publishes, each answer linked to its source and the date we read it.
- Does Langfuse have a data processing agreement (DPA)?
- Yes. Langfuse publishes a data processing agreement at clickhouse.com. It describes how a new subprocessor is announced but states no notice period. Source and date
- How does Langfuse transfer personal data out of the EU?
- Langfuse's agreement relies on the EU standard contractual clauses and the UK transfer addendum. Source and date
- Who are Langfuse's subprocessors?
- Langfuse lists 8 third-party subprocessors; 6 of them name at least one processing country outside the EEA. We last read the list on 2026-11-09. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | ClickHouse, Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | Langfuse GmbH |
| LEI | — |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | clickhouse.com · 2026-11-09 |
Data location
No data-location observation recorded yet.
The same question for every vendor: where SaaS vendors store EU data.
Langfuse's subprocessor list names AWS for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
8 third parties · 9 of the vendor's own group companies · 6 with a country outside the EEA · all read 2026-11-09
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services (AWS) | — | Cloud hosting and infrastructure provider |
| AWS Bedrock | — | Generative AI services |
| Github, Inc. | US | Support escalations |
| Google LLC (Workspace) | US | Email and office applications |
| kapa.ai, Inc. | US | Support deflection with AI |
| Pylon Labs, Inc. | US | Customer support chat platform |
| Salesforce, Inc. | US | Customer support case management, messaging services (Slack) |
| Waypoint Tech Inc. | US | Support knowledge management |
Langfuse's own group companies listed as subprocessors (9)
| Company | Country | Purpose |
|---|---|---|
| ClickHouse Australia Pty Ltd | AU | Provision of technical services, support services, and supporting the provision, management and maintenance of the Langfuse Cloud Services |
| ClickHouse BV | NL | Provision of technical services, support services, and supporting the provision, management and maintenance of the Langfuse Cloud Services |
| ClickHouse GmbH | DE | Provision of technical services, support services, and supporting the provision, management and maintenance of the Langfuse Cloud Services |
| ClickHouse India Private Limited | IN | Provision of technical services, support services, and supporting the provision, management and maintenance of the Langfuse Cloud Services |
| ClickHouse KK | JP | Provision of technical services, support services, and supporting the provision, management and maintenance of the Langfuse Cloud Services |
| ClickHouse Pte Ltd | SG | Provision of technical services, support services, and supporting the provision, management and maintenance of the Langfuse Cloud Services |
| ClickHouse UK Co. Ltd. | GB | Provision of technical services, support services, and supporting the provision, management and maintenance of the Langfuse Cloud Services |
| ClickHouse, Inc. | US | Provision of technical services, support services, and supporting the provision, management and maintenance of the Langfuse Cloud Services |
| Langfuse GmbH | DE | Provision of technical services, support services, and supporting the provision, management and maintenance of the Langfuse Cloud Services |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-11-09 · clickhouse.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | Advance notice of Sub-Processor changes, via the mechanisms at the weblinks in Section 4.1; period not stated |
| If you object to one | Written objection within 10 calendar days of notice, giving reasonable data-protection grounds; parties discuss in good faith; if unresolved, ClickHouse either does not appoint the new Sub-Processor or lets Customer suspend or terminate the affected Services (sole remedy) |
| Breach notification | promptly |
| Audit | On written request, at reasonable intervals: copies of ClickHouse's most recent third-party audit reports or certifications, subject to confidentiality; on request, external Sub-Processor audit reports where permitted |
| Audit | On-site audit if third-party certifications/audit info is insufficient or required by law or supervisory authority; no more than once per year with at least three weeks' notice (unless emergency); during business hours; customer reimburses reasonable costs; may use non-competitor Third-Party Auditor under NDA at customer's cost |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
We found no version number or date in the agreement as we read it.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
No certification claims transcribed yet.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under ClickHouse, Inc.; Langfuse; Langfuse GmbH
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under ClickHouse, Inc.; Langfuse; Langfuse GmbH
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under ClickHouse, Inc.; Langfuse; Langfuse GmbH
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under ClickHouse, Inc.; Langfuse; Langfuse GmbH
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under ClickHouse, Inc.; Langfuse; Langfuse GmbH
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under ClickHouse, Inc.; Langfuse; Langfuse GmbH
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: no security.txt at the well-known path (read 2026-11-09)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| dpa | Public | full | 200 | 2026-11-09 |
| subprocessors | Public | full | 200 | 2026-11-09 |
History
Nothing has moved since we started watching this vendor on 2026-11-09. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.