Langfuse Technical and Organisational Measures (TOMs)
Langfuse implements the following technical and organisational measures (TOMs) to protect the confidentiality, integrity, and availability of data.
Latest revision: October 17th, 2025 | download as PDF
1. Confidentiality
1.1 Physical Access Control
Preventing unauthorised persons from gaining access to data‑processing systems.
Technical Measures
- Locking systems
- Lockable storage containers
Organisational Measures
- Physical Security Policy
- Visitors accompanied by employees
- Information Security Policy
1.2 Logical Access Control
Preventing data‑processing systems from being used by unauthorised persons.
Technical Measures
- Login with username and strong password or SSO where available
- Encryption of devices
- Enforced MFA where applicable
- Automatic desktop lock
Organisational Measures
- User‑permission management
- Creating user profiles
- Information Security Policy
1.3 Authorisation Control
Ensuring employees can only access data subject to their authorisation and cannot read, copy, modify or remove Personal Data without permission.
Technical Measures
- Logging of access to applications or databases (entering, changing, deleting data)
- SSH‑encrypted access
- TLS encryption in transit
Organisational Measures
- Minimum number of administrators
- Management of user rights by administrators
- No shared accounts where technically feasible
- Information Security Policy
1.4 Separation Control
Ensuring data collected for different purposes is processed separately.
Technical Measures
- Separation of production and test environments
- Multi‑tenancy of relevant applications
Organisational Measures
- Control via authorisation concept
- Determination of database rights
- Information Security & Data‑Protection Policies
2. Integrity
2.1 Transfer Control
Ensuring Personal Data cannot be read, copied, altered or removed by unauthorised persons during electronic transmission or transport/storage on media.
Technical Measures
- Provision via encrypted connections (SFTP, HTTPS, secure cloud stores)
Organisational Measures
- Information Security & Data‑Protection Policies
2.2 Input Control
Ability to verify whether and by which user Personal Data has been entered, modified or removed.
Technical Measures
- Manual or automated logging of database access
- Traceability through individual user names (not groups)
Organisational Measures
- Assignment of rights based on an authorisation concept
- Information Security Policy
3. Availability and Resilience
3.1 Availability Control
Protecting Personal Data against accidental destruction or loss.
Technical Measures
- Hosting in certified data centres by reputable cloud providers (e.g. AWS)
- Using multiple availability zones within a cloud region
- Backup concept
- Use of as many fully managed services as feasible to reduce downtimes
- Monitoring and alerting for capacity and functioning of core processes
- Using highly available and horizontally scalable architectures where possible
Organisational Measures
- Business continuity and disaster‑recovery plan
- Information Security Policy
3.2 Recoverability Control
Rapid restoration of availability and access after an incident.
Technical Measures
- Backup monitoring and reporting
- Automated restoration tools
- Regular recovery tests with logged results
Organisational Measures
- Recovery concept aligned to data criticality and Client specs
- Information Security Policy
4. Regular Review, Assessment and Evaluation
4.1 Data‑Protection Management
- Central documentation of data‑protection regulations accessible to employees
- Privacy Officer appointed
- Annual review of TOMs and updates
- Staff trained and bound to confidentiality
- Regular awareness trainings
- Processes for information obligations (Art 13/14 GDPR)
- Formal DSAR process
- Data protection in corporate risk management
4.2 Incident Response Management
- Email security gateway, anti‑malware, and filtering controls with regular updates
- Documented incident‑response process covering authority notifications
- Formalised procedure for handling incidents
- Involvement of Privacy Officer and CTO
- Ticket‑based documentation and follow‑up of incidents
4.3 Data Protection by Design and Default
- No more Personal Data collected than necessary
- Privacy‑friendly default settings in software
4.4 Order Control (Sub‑Processors)
- Vendor due‑diligence and DPAs/SCCs in place
- Monitoring of subcontractors
- Audit rights over contractors
- Secure deletion of data after contract end
5. Organisation and Staff
- Information‑security as a core corporate objective
- Employees bound to confidentiality and data secrecy
- External parties subject to NDA before work commences