LangChain procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ We have appointed a representative in the EU and the UK. For the EU, please contact our representative by post at INSTANT EU GDPR REPRESENTATIVE LIMITED Office 2 12A Lower Main Street, Lucan Co. Dublin K78 X5P8 Ireland, or by email at contact@gdprlocal.com. In the UK, please contact our representative by post at GDPR Local Ltd 1st Floor Front Suite 27-29 North Street, Brighton England BN1 1EB, or by email at contact@gdprlocal.com.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ (C) Protection of Customer Data. LangChain will maintain administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Customer Data. Where Customer's use of the LangSmith Platform includes the processing of Personal Data subject to the applicable data protection laws, it will be governed by the Data Processing Addendum located at langchain.com/DPA (" DPA ") that is incorporated into this Agreement by reference.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ We are headquartered in the United States. To provide and operate our services, it is necessary for us to process your personal information in the United States. If we transfer personal information across borders such that we are required to apply appropriate safeguards to personal information under applicable data protection laws, we will do so. Please contact us for further information about any such transfers or the specific safeguards applied.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ (B) For Self-Hosted Deployment Subscriptions. During the relevant Subscription Term, grant to Customer a limited, non-exclusive, non-transferable (except as set forth in Section 10.8 below), non-sublicensable, license to install and use the LangSmith Platform on Customer Infrastructure for Customer’s internal business use per applicable configuration parameters, as outlined in the Documentation, according to the Subscription Metrics, Support and other terms of the Order Form. Customer may make a reasonable number of copies of the LangSmith Platform software and Documentation for environment or data residency separation, or as otherwise specified in the Order Form. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We may retain your personal information for as long as it is reasonably needed in order to maintain and expand our relationship and provide you with our services; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of such information, the potential risk of harm from unauthorized use or disclosure of such information, the purposes for which we process it, and the applicable legal requirements. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ (A) Data Export. During a Subscription Term or within thirty (30) days thereafter upon Customer's written request (subject to Customer's configured retention period), Customer may export Customer Data from Cloud Deployments as described in the Documentation. The thirty (30) day post-termination export right does not apply to No Charge Access.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ (B) Data Deletion. Within thirty (30) days of Customer's written request following termination or expiration of this Agreement, LangChain shall delete all Customer Data in its custody and control.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Service providers. We may share your personal information with third party companies and individuals that provide services on our behalf or help us operate our Services (such as lawyers, bankers, auditors, insurers, and providers that assist with hosting, analytics, email delivery, marketing, and database management). Authorities and others. We may disclose your personal information to law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above. Business transfers. We may transfer or otherwise share some or all of our business or assets, including your personal information, in connection with a business transaction (or potential business transaction) such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution. In such a case, we will make reasonable efforts to require the recipient to honor this Privacy Policy. Affiliates: We may share personal information with our current and future affiliates, meaning an entity that controls, is controlled by, or is under common control with us. Our affiliates may use the personal information we share in a manner consistent with this Privacy Policy.” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.