Label Studio on AWS, Azure, Google Cloud and Oracle OCI: The 2026 Solution Architect’s Guide

By Shrenik Parekh · Updated October 27, 2026 · 11 min read

TL;DR for solution architects

Label Studio by HumanSignal has become a practical default for teams that need a labeling platform that is not tied to one cloud. That matters in 2026: AWS has closed SageMaker Ground Truth to new customers, and Microsoft retired Azure ML data labeling on September 30, 2026.

Here is what this guide gives you:

Editions and price: a free open-source Community Edition, a hosted Starter Cloud plan, and a custom-priced Enterprise edition that is also sold through AWS Marketplace.
One architecture, four clouds: Label Studio runs on Kubernetes with PostgreSQL and Redis, so the same design maps to Amazon EKS, Azure AKS, Google GKE and Oracle OKE.
Security, observability, audit and governance patterns you can reuse regardless of cloud.
A decision table to pick the right edition and hosting model.

Background on the wider market: see my multi-cloud data labeling guide for how AWS, Azure, Google Cloud and Oracle compare on native labeling services.

1. Why architects are choosing Label Studio

Three reasons come up repeatedly:

Portability. The platform is deployable on any Kubernetes cluster, in any region, including your own data center. Your labels, projects and guidelines are not locked to one cloud service that might be sunset.
Multimodal coverage. Text, images, audio, video, time series and LLM evaluation workflows run in one tool, so you do not need a separate annotation product per data type.
Storage-native integration. It connects to Amazon S3, Google Cloud Storage and Azure Blob Storage, so raw data can stay where it already lives. Per the Label Studio storage documentation, Redis and local storage are also supported, and Databricks UC Volumes are Enterprise-only.

2. Editions and pricing

Edition	Hosting	Price	Best for
Community Edition	Self-hosted by you	Free, open source	Engineering-led teams that can run Kubernetes or Docker
Starter Cloud	Hosted by HumanSignal	Plans listed from $149/month on the official pricing page; free trial available	Small teams that want zero infrastructure work
Enterprise	HumanSignal compliant cloud or your own on-prem or cloud environment	Custom quote; also purchasable through AWS Marketplace on contract terms	Regulated or large-scale programs needing SSO, RBAC, audit logs and SLAs

Price caution: third-party review sites quote different Starter prices ($50, $99 and $149 per month appear in 2026 listings). Use HumanSignal’s pricing page as the source of truth and request a written quote.

What you pay beyond the license (self-hosted):

Kubernetes compute (nodes or managed control plane fees)
Managed PostgreSQL and Redis
Object storage and data transfer
Observability and log retention
Annotator time, which usually dwarfs all of the above

If your company has committed cloud spend on AWS, the Marketplace route lets you apply that committed spend to Label Studio Enterprise. I did not find equivalent Azure, Google Cloud or Oracle marketplace listings for Enterprise, so on those clouds expect a direct contract. Verify before you plan procurement.

3. Reference architecture

Label Studio needs PostgreSQL for projects, annotations and users, and Enterprise on Kubernetes also needs Redis. The Enterprise Kubernetes guide lists Kubernetes 1.17+, Helm 3.6.3+, Redis 6.0.5+ and PostgreSQL 11.9+ as prerequisites.

Annotators / SMEs  →  SSO (SAML/OIDC)  →  Ingress + TLS + WAF
                                              │
                                  Label Studio on Kubernetes
                                   │            │          │
                         PostgreSQL (managed)  Redis    ML backend (pre-labels)
                                   │
                  Object storage (raw data + exports), via IAM / workload identity
                                   │
                  Training pipelines, feature stores, model registry

Component mapping by cloud

Layer	AWS	Azure	Google Cloud	Oracle OCI
Kubernetes	EKS	AKS	GKE	OKE
PostgreSQL	RDS / Aurora PostgreSQL	Azure Database for PostgreSQL	Cloud SQL / AlloyDB	OCI Database with PostgreSQL
Redis	ElastiCache	Azure Cache for Redis	Memorystore	OCI Cache
Object storage	S3	Blob Storage	Cloud Storage	Object Storage
Keys and secrets	KMS, Secrets Manager	Key Vault	Cloud KMS, Secret Manager	Vault
Identity	IAM roles for service accounts	Entra ID, managed identity	Workload Identity	IAM, instance and workload principals
Ingress and WAF	ALB, WAF	Application Gateway, Front Door	Cloud Load Balancing, Cloud Armor	Load Balancer, WAF
Monitoring	CloudWatch, Managed Prometheus	Azure Monitor, Managed Prometheus	Cloud Monitoring, Managed Service for Prometheus	Monitoring, Logging
Audit	CloudTrail	Activity Log	Cloud Audit Logs	Audit
Catalog	Glue Data Catalog	Purview	Dataplex	Data Catalog

Product names and regional availability change; confirm each in the provider’s documentation.

Storage identity matters. Enterprise adds IAM-based connections: IAM roles for AWS S3, Service Principal for Azure Blob Storage, and workload identity federation for Google Cloud Storage. That lets you avoid long-lived access keys. On Oracle OCI there is no dedicated connector in the documentation I reviewed; many teams use OCI Object Storage’s S3-compatible API through the S3 connector with a custom endpoint. Test this early in a pilot.

4. Convenience: how fast can you get running?

Path	Time to first project	Use when
`pip install label-studio` on a laptop	Minutes	Evaluating the UI and labeling config
Docker with PostgreSQL	Under an hour	Team pilot on one VM
Helm on Kubernetes	Hours to a day	Production, any cloud
Starter Cloud or Enterprise cloud	Same day	You want HumanSignal to run it

The community Helm chart is added with helm repo add heartex https://charts.heartex.com/, and a minimal install with an external database looks like this, adapted from the Chainguard deployment guide:

# label-studio-values.yaml (sketch; use your managed PostgreSQL)
postgresql:
  enabled: false
global:
  pgConfig:
    host: "<managed-postgres-endpoint>"
    dbName: "labelstudio"

Enterprise supports TLS to PostgreSQL (pgSslMode: verify-full) and to Redis, per the Kubernetes guide. Enable both in production.

Accelerators for application teams:

ML backend: connect a model so it pre-labels tasks and humans correct them.
API, SDK and webhooks: create projects, import tasks and trigger downstream training when annotations are submitted.
Cloud storage sync: point projects at buckets and export results back to the same storage.

More on related patterns in my post about MLOps pipeline design.

5. Security

Control	Community	Starter Cloud	Enterprise
Self-host in your own network	Yes	No (hosted)	Yes (or hosted)
Role-based access control	No	Yes	Yes, with customizable permissions
SSO (SAML, LDAP, SCIM)	No	Basic SSO listed by some sources	Yes
Activity logs (system of record of user actions)	No	Not listed	Yes
SOC 2 and HIPAA reporting	N/A	Not listed	Yes, per HumanSignal

Source for the Community and Enterprise rows: Label Studio edition comparison and the HumanSignal pricing page. Confirm Starter Cloud details with HumanSignal.

Architect’s hardening checklist (all clouds):

Private cluster endpoints; ingress only through a WAF-protected load balancer.
TLS everywhere, including PostgreSQL and Redis.
Customer-managed keys for database, cache and bucket encryption.
Workload identity instead of static cloud keys.
SSO with MFA through your identity provider; Label Studio documents integration with IdPs such as Okta, Microsoft Entra ID and Ping Identity.
Network policies and egress controls so labeling pods cannot reach the internet by default.
Mask or redact PII before data reaches annotators.
Separate projects and workspaces by data sensitivity.

6. Global availability and data residency

Self-hosted (Community or Enterprise): available in any region where you can run Kubernetes and PostgreSQL. This is the strongest answer to data-residency rules such as GDPR.
HumanSignal cloud: regional availability is set by HumanSignal; I could not verify a public region list, so ask for it in writing.
Workforce: HumanSignal Data Services states it supplies expert annotators with native speakers across 91 countries, useful for multilingual labeling.
Latency: deploy in the region closest to your annotators and keep raw data in the region where it must stay; annotators work through the browser.

7. Applications, databases, observability, auditability and governance

Applications

Treat labeling as a service your pipelines call. A common pattern: new data lands in object storage, an event creates tasks through the API, the ML backend pre-labels them, annotators review, and a webhook publishes a “dataset version ready” event to training.

Databases

PostgreSQL holds annotations, projects and users. Use a managed, multi-zone instance with automated backups, point-in-time recovery and encryption.
Keep raw payloads in object storage and reference them by URI.
Export labels (JSON, COCO, CSV and so on) into your lake or warehouse on a schedule so analytics and audits do not depend on the labeling database.
Test restore, not just backup.

Observability

Track these in one dashboard:

Platform: pod restarts, CPU and memory, request latency, PostgreSQL connections and replication lag, Redis memory.
Throughput and quality: tasks completed per hour, review rejection rate, annotator agreement, label distribution drift.
Cost: infrastructure cost and cost per accepted label.

Use OpenTelemetry for traces and metrics, and OpenLineage to link labeling jobs to training runs. See also my guide to observability for data and AI pipelines.

Auditability

Combine three evidence sources:

Label Studio Activity Logs (Enterprise) for who did what in the tool.
Cloud audit logs (CloudTrail, Activity Log, Cloud Audit Logs, OCI Audit) for infrastructure and storage access.
Dataset versions and lineage to prove which labels trained which model.

Export all three to immutable storage with a retention period set by your policy.

Governance

Align controls with the NIST AI Risk Management Framework and ISO/IEC 42001:

Data classification and approval before data enters a project.
Quarterly access reviews for annotators, contractors and admins.
Versioned labeling guidelines and a dataset card for every release.
Retention and deletion rules for raw data, labels and annotator records.
Vendor due diligence if you use external annotation services.

8. Quality: verification and validation

Verification (did we follow the process?): schema checks, gold-set accuracy, inter-annotator agreement, reviewer sign-off, duplicate and PII checks. Review workflows are an Enterprise capability.
Validation (is the data fit for purpose?): train on the dataset and test against an independently labeled, production-like holdout; check class balance and subgroup coverage.

Track kappa or Krippendorff’s alpha per task type, and release a dataset only when both checks pass.

9. Which option fits you?

Your situation	Suggested path
Small team, no platform engineers	Starter Cloud
Strong Kubernetes skills, tight budget, low compliance burden	Community Edition on EKS, AKS, GKE or OKE
Regulated data, need SSO, RBAC, audit logs, SLA	Enterprise, self-hosted in your cloud or HumanSignal compliant cloud
AWS shop with committed spend	Enterprise through AWS Marketplace
Data must stay in a specific country	Self-hosted in an in-country region
Migrating off Ground Truth or Azure ML labeling	Export labels and metadata first, rebuild label configs, validate with a gold set

Frequently asked questions

Is Label Studio free? The Community Edition is open source and free to self-host. Hosted and Enterprise plans are paid.

Does Label Studio work on AWS, Azure, Google Cloud and Oracle OCI? Yes in the sense that you can run it on Kubernetes or VMs on any of them and connect S3, Blob Storage or Cloud Storage. Oracle Object Storage is typically reached through its S3-compatible API, so test it.

Can I buy Label Studio through a cloud marketplace? Label Studio Enterprise is listed on AWS Marketplace. I did not confirm listings on the other three clouds.

Is it a replacement for SageMaker Ground Truth or Azure ML data labeling? It covers the labeling tool and workflow. Managed workforce services are separate; HumanSignal offers Data Services, or you can use your own annotators.

What does it need to run? Kubernetes (or Docker), PostgreSQL, and for Enterprise on Kubernetes, Redis.

Key takeaways

Label Studio gives architects a cloud-neutral labeling layer at a time when native cloud options are shrinking.
The same Kubernetes, PostgreSQL, Redis and object-storage pattern works on EKS, AKS, GKE and OKE.
Enterprise adds the security and audit features regulated teams need; verify edition details in writing.
Pair tool-level logs with cloud audit logs and dataset lineage for audit readiness.

References and further reading

HumanSignal, Label Studio and pricing.
HumanSignal, Label Studio Enterprise now on AWS Marketplace (December 9, 2025).
AWS Marketplace, Label Studio Enterprise by HumanSignal.
Label Studio docs, Deploy Label Studio Enterprise on Kubernetes.
Chainguard, Label Studio container deployment guide.
AWS, Service Availability Updates, June 30, 2026.
Microsoft, Azure ML data labeling retirement notice.
NIST, AI Risk Management Framework; ISO, ISO/IEC 42001.
OpenTelemetry and OpenLineage.

Prices, features and regions change often. Verify with each vendor before purchasing or finalizing an architecture.