Skip to main content
Two separate things happen to data as requests flow through Manifest: what your own instance records for the dashboard, and what a self-hosted install reports back to the project. This page covers both.

​
What Manifest stores

Manifest keeps metadata about each request: model, provider, tier, token counts, cost, latency, and a scrubbed error message. It does not keep the message bodies. Prompts and completions are never written to the database, inline image data is stripped out, and error text is scrubbed for secrets before it lands. Your agents’ conversations stay between you and the provider. The usage and cost views in the dashboard are built from that metadata alone. See Observability for what that record looks like in practice.

​
Anonymous telemetry

Once a day, each self-hosted install sends us a small anonymous report. That’s how we know whether anyone’s actually using the thing, and which providers are popular enough to deserve more work. It’s aggregates, never content: no prompts, no messages, no keys, nothing tied to a user. Fifteen fields total.
This section applies to self-hosted installs only. Manifest Cloud has no separate telemetry report — your usage is already in your own dashboard.

​
What gets sent

† Optional. Installs running older Manifest versions omit these fields; receivers should feature-detect on presence rather than on schema_version. Cost values are derived from the same input_tokens / output_tokens we already ship, multiplied by Manifest’s per-model pricing table — no new data leaves the box, just a rolled-up dollar figure for what’s already disclosed.

​
Never sent

Tenant IDs, user IDs, emails, API keys, prompts, message contents, model names, custom provider URLs, OAuth client IDs, hostnames, raw IPs. The ingest takes a SHA-256 of your IP and throws the original away; we keep the hash so we can rate-limit bad actors without knowing where they actually live.

​
When

  • Once every 24 hours, per install.
  • The first report is delayed by a random 0–24h offset, so a fleet of containers rebooted together doesn’t all hit the endpoint at the same minute.
  • Off by default when NODE_ENV != production. Dev machines are never going to accidentally send.
  • If the endpoint is down, we log it and try again on the next hourly tick. Your proxy keeps serving requests — the sender never gets in the way.

​
Turning it off

Put this in your .env (or docker-compose.yml) and restart the container:
The sender checks the flag before doing anything else. No database read, no DNS lookup, no request leaves the box.

​
Sending it somewhere else

If you’d rather run your own fleet dashboard, point TELEMETRY_ENDPOINT at a URL you control: