Product telemetry

Product telemetry is off by default. CodeLotse sends nothing unless an instance admin enables it, and you can always see the exact payload before and after it is sent.

When it can be enabled

All of the following must hold:

• Edition self_hosted (the enterprise edition never sends telemetry).
• QUAVON_PRODUCT_TELEMETRY=allowed (default). disabled turns it off for good; the API refuses to enable it.
• QUAVON_PRODUCT_TELEMETRY_URL is set (https, no credentials in the URL). There is no default endpoint, so a fresh installation cannot send anything.
• A preview exists (the worker builds one daily).

Only instance admins can enable or disable it (GET/PUT /api/instance/telemetry, permission instance:manage). Every change is written to the audit log (telemetry.enable, telemetry.disable), and every send attempt as telemetry.sent. Refusals return a field error on enabled with the reason disabled_by_operator, enterprise_edition, no_endpoint or preview_missing.

What is collected

One JSON report, validated against a strict schema; nothing else can be added.

Field	Content
schemaVersion	1
instanceId	Random UUID created when telemetry is enabled and deleted when it is disabled; not derived from any installation data
version	Release version (git SHA of the build)
edition	Always self_hosted
deployment	compose, helm or other (QUAVON_DEPLOYMENT)
periodStart, periodEnd	The last 7 days
counts	Tenants, active installations, repositories, and in the period: review runs, published findings, triage runs, fix runs, assignments. Each as a bucket: 0, 1-5, 6-20, 21-100, 101-500, 501+
features	Per feature (review, triage, reply, fix, acceptance, SAST, assignment, learning): on if any repository uses it beyond shadow mode, shadow if only in shadow mode, otherwise off
llmProviders	Kinds of configured model providers (for example anthropic, openai)
sandboxBackend	Sandbox backend of the most recent run in the period, or null
loginProviders	github and/or oidc

Never included: names or URLs of tenants, organisations, repositories or hosts, logins, e-mail addresses, IP addresses, code, findings, prompts, model names, credentials or exact counts.

How it is sent

The worker builds the report every day and stores it as the preview, also while telemetry is disabled; a disabled instance sends nothing. When enabled, the worker sends at most once every 7 days: one POST with content-type: application/json whose body is exactly the stored preview of that run, 10 s timeout, no redirects, no cookies, no retries before the next daily run. The result is stored as lastSentAt/lastStatus.

How to verify

1. GET /api/instance/telemetry (or the instance settings screen) shows the preview, the endpoint and the last status.
2. Compare the preview with what your endpoint or an egress proxy receives; the bodies are identical.

How to turn it off

• Disable it in the instance settings (PUT /api/instance/telemetry with {"enabled": false}); the instance id is deleted.
• To make enabling impossible, set QUAVON_PRODUCT_TELEMETRY=disabled in deploy/compose/.env (Compose) or the chart values (Helm) and restart the API and the worker. The air-gap profile sets this.