# Chainguard Actions telemetry and privacy

URL: https://deploy-preview-3616--ornate-narwhal-088216.netlify.app/chainguard/actions/telemetry.md
Last Modified: July 16, 2026
Tags: Chainguard Actions, Telemetry, Privacy

Learn what usage telemetry Chainguard hardened actions send, what data is collected, and how to control it.

Every Chainguard hardened action runs a best-effort “phone-home” pre-hook that records a usage event to https://actions.enforce.dev/actions/v1/record. The hook is fire-and-forget, with a 2 second timeout that fails open, so it cannot break your build.
What we collect What we collect depends on whether your workflow grants id-token: write:
Without id-token: write: we record your repository name, a timestamp, and an “unverified” flag. With id-token: write: the hook mints a GitHub OIDC token scoped to the actions.chainguard.dev audience and sends it so we can verify the record. From that token we store metadata: repository, actor, ref, sha, workflow path, repository visibility, and run identifiers. The hook never grants itself id-token: write. It only uses the permission if your workflow already grants it. If you would rather we receive only your repository name, do not grant id-token: write to that job.
About the token The token is a short-lived, audience-locked GitHub OIDC token. Because it is locked to the actions.chainguard.dev audience, it cannot be used against GitHub, a cloud provider, or any other service. The underlying ACTIONS_ID_TOKEN_REQUEST_TOKEN never leaves the runner; it is used locally only to mint the audience-scoped token.
Learn more Chainguard Actions overview For other questions, contact Chainguard.