Privacy-safe telemetry

When enabled, dexgate may record a small set of product signals (for example: that a free policy self-check ran, or that a paid workspace produced its first governed decision). CLI telemetry is off unless you opt in. We do not collect source code, secrets, claim tokens, shell transcripts, or raw policy evidence.

This page describes what may be sent when site analytics or CLI opt-in is enabled.

Principles

No source code, shell transcripts, secrets, tokens, claim codes, action payloads, raw policy evidence, or customer file paths.
CLI: off unless DEXGATE_TELEMETRY_OPT_IN=1 (or DEXGATE_TELEMETRY=1).
Adapter POSTs require header X-Dexgate-Telemetry-Opt-In: true (consent only — not authentication).
For OpenClaw 1.0.16 and later, paid CLI milestones use a registered installation identifier bound to the authenticated customer workspace. Milestones are signed by the CLI and validated by Dexgate before they are counted. Raw workspace, runtime, gateway, credential, claim, and action identifiers are not transmitted.
Paid-activation counting requires: Dexgate-issued installId, HMAC signature, unique eventId, and a server-side paid workspace binding — not client-supplied tenant strings.
Claim tokens are never transmitted to analytics, telemetry, logs, referrer headers, or third-party scripts. Claim pages use an opaque random analytics event_id that cannot be converted back into the claim URL.
Telemetry credentials are separate from runtime credentials and cannot authorize enforcement operations.

Integrity controls (DG-GTM-002)

The adapter telemetry endpoint is an intentional public interface. Opt-in records consent; it does not prove an event came from a legitimate installation. Paid-activation metrics use these controls:

Registered install identity — POST /api/telemetry/installations/ (opt-in header required) returns a Dexgate-generated installId (opaque, workspace-bindable) and a telemetry-only secret. Client-generated hashes are not treated as identity for activation counting.
Workspace binding — after sign-in, the console accepts telemetry_install_id (query or form) and associates that install with the authenticated organization. Unbound installs may be stored but do not count as paid activation.
Event signing — paid milestones (first_governed_decision, second_governed_decision) must include eventId, occurredAt, and signature (HMAC-SHA256 over eventId|eventName|packageName|occurredAt|installId).
Strict schemas — unknown top-level fields are rejected; metadata is allowlisted; claim tokens and secrets are stripped.
Rate limits — per install id, network source, and event type.
Replay protection — unique eventId (server-side dedupe) and a short occurredAt acceptance window.
Server-derived commercial state — plan and paid status come from the bound workspace, not from CLI-provided plan fields.

Fabricated first_governed_decision posts with only the opt-in header are rejected (401) and never count as paid activation.

Paid-activation funnel (DG-GTM-001)

The commercial funnel is measured end-to-end so activation—not just Stripe starts—drives optimization:

Free policy self-check completed
Claim result viewed
Workspace created
Plan selected
Stripe checkout started
Purchase completed
Runtime healthy
First governed decision
Second governed decision on another day
30-day retained workspace

Critical commercial metric: percentage of paid workspaces reaching first_governed_decision within 24 hours, 7 days, and 30 days of purchase.

Events we may record (site + CLI)

Event	Where	When	Payload (allowed)
`install` / free start CTA	site	Click free policy self-check / get started	page_path, utm_*, label
`local-hardening-check` / `local_hardening_check`	CLI	Free policy self-check completes (never a paid-activation milestone; not proof of live OpenClaw enforcement)	status, mode, source; optional local install label only
`decision_category` (metadata)	CLI	With free check	first_check \| high_risk_blocked \| read \| edit \| shell_readonly
`high-risk-blocked`	CLI	Free policy self-check blocks git push-class action in assess	decision=deny, reasonCode, status, mode, source
`claim_view`	site	Open a claim page	event_id (random), page_type=claim
`workspace_created`	site	Magic-link creates a new workspace	plan (if intended), billing_cycle, org_hash
`plan_selected`	site	Buyer selects Production/Team for checkout	plan, billing_cycle
`checkout_started`	site	Stripe Checkout session created	plan, billing_cycle
`trial_start_click`	site	Paid pilot CTA after free value	label, page_path (claim paths redacted)
`completed_purchase`	site	Checkout success / provisioning	plan, billing_cycle, days_from_free_start
`runtime_downloaded`	site	Console runtime bundle download	plan, source=console_downloads
`runtime_healthy`	runtime / CLI	First healthy machine heartbeat (or CLI signal)	plan, source=heartbeat
`first_governed_decision`	CLI (1.0.16+) + site	First paid governed check succeeds (opt-in, signed, paid-bound install)	`installId` (opaque workspace-bound installation identifier), `eventId`, `occurredAt`, `signature`, governed=true, mode, status
`second_governed_decision`	CLI (1.0.16+)	Governed check on a later calendar day (same integrity rules)	same as first: `installId`, `eventId`, `occurredAt`, `signature`, governed=true, mode
`first_evidence_viewed`	site	Console evidence section / export	plan, source=console_evidence
`seven_day_active` / `thirty_day_active`	site	Paid workspace used after 7 / 30 days	window
`pilot_application_started` / `pilot_application_completed`	site	Founding pilot form view / submit	source=founding_teams

CLI opt-in (OpenClaw 1.0.16+)

With telemetry opted in, a successful paid openclaw-trusted-mode-check (ENFORCED_OK against a non-local licensed runtime) registers a Dexgate installation identifier, signs the paid milestone, and can count for activation only after the install is bound to your authenticated workspace. Free assess never emits first_governed_decision.

set DEXGATE_TELEMETRY_OPT_IN=1
# Free assess never emits first_governed_decision:
npx --yes --package=@dexgate/openclaw-trusted-mode@1.0.18 dexgate-assess
# After paid configure (console-issued URL + token), on ENFORCED_OK:
npx openclaw-trusted-mode-check --json
# 1.0.16 registers installId, signs first_governed_decision (or second_governed_decision on a later day),
# and prints a console bind URL: /console/?telemetry_install_id=<installId>

Endpoints:

POST https://dexgate.ai/api/telemetry/installations/ — issue installId + telemetry-only secret
POST https://dexgate.ai/api/telemetry/adapter-events/ — event ingest (strict schema + integrity for paid milestones)

Current OpenClaw npm pin is @dexgate/openclaw-trusted-mode@1.0.18 (see the compatibility matrix). Signed paid-activation install identity requires 1.0.16+.

Operational acceptance (before commercial use of metrics)

Verify these before relying on telemetry for pricing, onboarding, or acquisition decisions:

Telemetry disabled produces zero CLI telemetry requests.
A free local assessment cannot emit first_governed_decision.
A simulated or unauthenticated / local runtime response cannot emit it.
A genuine ENFORCED_OK result from the licensed runtime can emit it when the user opted in (1.0.16+ signed install path).
An unbound installation cannot count as paid activation.
Replayed milestones are rejected or deduplicated (eventId uniqueness + replay window).
A second governed decision is counted only on a later calendar day (documented rule).
Payloads contain no source code, action body, shell transcript, claim token, runtime credential, or raw evidence.
Plan and paid-workspace status are derived server-side rather than trusted from the CLI.

What we never collect

Source files, diffs, or repository contents
Environment secrets, API keys, runtime tokens, customer credentials
Claim codes / claim URL path segments (bearer access to free-decision results)
Full shell history or action payloads
Raw policy evidence documents
Personal emails from the free assess CLI
Raw workspace, runtime, gateway, or action identifiers used as public activation identity (paid counting uses opaque installId)

See also Privacy and Compatibility matrix.