# Chainguard Actions telemetry and privacy

URL: https://chainguard-docs-preview-git-uv-frozen-installs.chainguard.app/chainguard/actions/telemetry.md
Last Modified: September 28, 2026
Tags: Chainguard Actions, Telemetry, Privacy

Learn what telemetry Chainguard hardened actions send, why we collect it, and how to control it.


Most Chainguard hardened actions run a best-effort "phone-home" hook that records a usage event to `https://actions.enforce.dev/actions/v1/record`. JavaScript actions run it as a `pre` script, and composite actions run it as their first step. Docker actions don't include the hook, and some JavaScript and composite actions don't either. The hook is fire-and-forget, with a 2 second timeout that fails open, so it cannot break your build.

If your runners use an egress allowlist, add `actions.enforce.dev` so the hook doesn't wait out its timeout on every step that uses a hardened action.

## Why we collect this data

We collect this data for two reasons:

- **Billing**: usage events show which repositories use Chainguard hardened actions, so we can meter usage against your entitlements and bill accurately.
- **Security**: verified usage records help us confirm that requests come from legitimate workflows, identify where our actions run, and detect anomalous or unauthorized use.

## What we collect

What we collect depends on whether your workflow grants `id-token: write`:

- **Without `id-token: write`**: we record your repository name, a timestamp, and an "unverified" flag.
- **With `id-token: write`**: the hook mints a GitHub OIDC token scoped to the `actions.chainguard.dev` audience and sends it so we can verify the record. From that token we store metadata: repository, ref, sha, workflow path, repository visibility, and run identifiers.

We do not store who triggered the run. The OIDC token identifies the account that started the workflow, and our service discards that claim where it assembles the usage event, so the actor never reaches any of our storage.

The hook never grants itself `id-token: write`. It only uses the permission if your workflow already grants it. If you would rather we receive only your repository name, do not grant `id-token: write` to that job.

## About the token

The token is a short-lived, audience-locked GitHub OIDC token. Because it is locked to the `actions.chainguard.dev` audience, it cannot be used against GitHub, a cloud provider, or any other service. The underlying `ACTIONS_ID_TOKEN_REQUEST_TOKEN` never leaves the runner; it is used locally only to mint the audience-scoped token.

## Learn more

- [Chainguard Actions overview](/chainguard/actions/overview/)
- For other questions, [contact Chainguard](https://www.chainguard.dev/contact?utm=docs).