Anonymous Usage Metrics
Collection is off by default. A Shield360 installation sends nothing back to us unless its operator turns usage metrics on. There is no in-app settings toggle; it is controlled by environment variables on the Shield360 deployment.
How to turn it on
Section titled “How to turn it on”Both of these are needed, then restart Shield360 so the change takes effect:
TELEMETRY_ENABLED=trueNEXT_PUBLIC_POSTHOG_API_KEY=<your PostHog project key>TELEMETRY_ENABLED must be exactly true. Unset, false, or any other value keeps collection off, and so does a missing PostHog key: with no key, the browser analytics provider is never loaded, server-side events are dropped before any request is made, and the daily install snapshot is not scheduled. The .env.example, Docker Compose files and Kubernetes manifests all ship with TELEMETRY_ENABLED=false.
How to turn it off again
Section titled “How to turn it off again”Set TELEMETRY_ENABLED=false (or remove it) and restart. That stops browser analytics, server-side usage events and the daily install snapshot.
What identifies an install (anonymously)
Section titled “What identifies an install (anonymously)”| Signal | What it is |
|---|---|
| User | An opaque user id - never your email, name, or password |
| Organization / project | Opaque organization and project group ids - never names or member emails |
| Install | A stable random install_id per Shield360 deployment |
| Environment | Ordinary analytics context such as browser, OS, and approximate location |
What we track
Section titled “What we track”Only when turned on, Shield360 sends:
- Active usage - opaque user / organization / project activity, login and registration, and page path visits as people use the UI
- Feature adoption - create/update/delete-style signals for prompts, rules, evaluations, dashboards, contexts, OpenGround, and database configurations (ids and counts, not names or contents)
- Auto features - whether Auto Pricing and auto evaluation are turned on, and run outcomes
- SDK-facing API use - success/failure when applications fetch prompts or Vault secrets through Shield360 (the Shield360 server records this; the SDK packages do not phone home on their own)
- Daily install snapshot - once per day, aggregate totals for that install: Shield360 version, counts of users / organizations / projects / database configs, whether auto pricing or auto evaluation is configured, and high-level ingestion volume counts
We never send emails, names, passwords, secrets, API keys, prompt or rule text, or the contents of your spans and traces.
Where metrics are stored
Section titled “Where metrics are stored”Usage metrics are sent to PostHog for secure storage and product analytics.
Frequently asked questions
Section titled “Frequently asked questions”Is anything sent if I do nothing?
No. Collection is off unless TELEMETRY_ENABLED=true and a PostHog key are both set.
Is there a UI switch?
No. Turn it on or off with TELEMETRY_ENABLED on the Shield360 process, then restart.
Does disabling this stop my own OpenTelemetry traces?
No. This only controls Shield360’s anonymous product usage metrics. Your application’s OTLP traces, metrics, and logs are separate.