Telemetry System

How Rhesis collects and stores usage analytics from cloud-hosted and self-hosted instances, for developers and contributors working on the telemetry pipeline.

Telemetry uses OpenTelemetry (OTEL) for tracing and metrics. It is enabled by default for self-hosted deployments (opt-out via OTEL_RHESIS_TELEMETRY_ENABLED=false) and always enabled for cloud deployments, where consent is covered by the Terms & Conditions.

User and organization IDs are hashed with SHA-256 before storage, and sensitive attributes (passwords, tokens, secrets) are stripped at the collector. See What we collect for the full list.

Architecture

OpenTelemetry Collector — receives OTLP telemetry from instances, filters sensitive attributes, and forwards to the processor. Config lives in apps/otel-collector/otel-collector-config.yaml.
Telemetry Processor — gRPC service (apps/telemetry-processor) that parses spans and writes structured rows to the analytics database.
Analytics Database — a separate PostgreSQL database, isolated from operational data with its own access controls and backups.

What we collect

User activity — login/logout events, session duration, deployment type, hashed user and organization IDs.
Endpoint usage — API paths, HTTP methods, status codes, request duration, timestamp.
Feature usage — feature name (e.g. test-run, test-set, endpoint), action (created, viewed, updated, deleted), timestamp, deployment context.

The collector deletes password, token, api_key, secret, and authorization attributes before anything is stored. We never collect credentials, PII (emails, usernames, IP addresses, device IDs), or test content and other user-generated data.

ID hashing

User and organization IDs are one-way hashed before storage — the same ID always produces the same hash (so events can be correlated) but the hash cannot be reversed:

Example Hashing
# SHA-256 hash truncated to 16 characters
hash = hashlib.sha256(id_str.encode()).hexdigest()[:16]
# "user-123-456-789" -> "a1b2c3d4e5f6g7h8"

Ports

OpenTelemetry Collector

4317 — OTLP gRPC receiver
4318 — OTLP HTTP receiver (used by the frontend)
8889 — Prometheus metrics (exposed by the Helm Service)
13133 — health check

Telemetry Processor

4317 — gRPC server for traces from the collector

Database schema

The analytics database uses three tables sharing a common base (id, user_id, organization_id, timestamp, deployment_type, event_metadata).

`user_activity`

Column	Type	Description
`id`	UUID	Primary key
`user_id`	VARCHAR(32)	Hashed user ID
`organization_id`	VARCHAR(32)	Hashed org ID
`event_type`	VARCHAR(50)	Event type (login, logout)
`timestamp`	TIMESTAMP	Event time
`session_id`	VARCHAR(255)	Session identifier
`deployment_type`	VARCHAR(50)	cloud / self-hosted
`event_metadata`	JSONB	Additional context

`endpoint_usage`

Column	Type	Description
`id`	UUID	Primary key
`endpoint`	VARCHAR(255)	API endpoint path
`method`	VARCHAR(10)	HTTP method
`user_id`	VARCHAR(32)	Hashed user ID
`organization_id`	VARCHAR(32)	Hashed org ID
`status_code`	INTEGER	HTTP status
`duration_ms`	DOUBLE PRECISION	Request duration
`timestamp`	TIMESTAMP	Request time
`deployment_type`	VARCHAR(50)	cloud / self-hosted
`event_metadata`	JSONB	Additional context

`feature_usage`

Column	Type	Description
`id`	UUID	Primary key
`feature_name`	VARCHAR(100)	Feature identifier
`user_id`	VARCHAR(32)	Hashed user ID
`organization_id`	VARCHAR(32)	Hashed org ID
`action`	VARCHAR(100)	Action type
`timestamp`	TIMESTAMP	Action time
`deployment_type`	VARCHAR(50)	cloud / self-hosted
`event_metadata`	JSONB	Additional context

Environment variables

Backend and frontend

Set in .env or .env.docker:

.env
OTEL_RHESIS_TELEMETRY_ENABLED=true   # 'false' to opt out (self-hosted; default true)
OTEL_DEPLOYMENT_TYPE=self-hosted     # 'self-hosted' | 'cloud'
OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4318/  # collector endpoint
OTEL_SERVICE_NAME=rhesis             # service identifier
OTEL_PROCESSOR_ENDPOINT=telemetry-processor:4317  # collector -> processor (internal)
OTEL_API_KEY=your-api-key            # authenticates the collector to the processor

Telemetry is skipped entirely when OTEL_EXPORTER_OTLP_ENDPOINT is unset.

Telemetry processor

The processor requires the analytics database credentials (or a full ANALYTICS_DATABASE_URL) and the matching OTEL_API_KEY:

.env
ANALYTICS_DB_USER=analytics-user
ANALYTICS_DB_PASS=secure-password
ANALYTICS_DB_HOST=postgres-analytics
ANALYTICS_DB_PORT=5432
ANALYTICS_DB_NAME=rhesis-analytics
# Or: ANALYTICS_DATABASE_URL=postgresql://user:pass@host:port/rhesis-analytics

OTEL_API_KEY=your-api-key   # must match the collector's OTEL_API_KEY
PORT=4317                   # gRPC listen port