GraphOS Data Privacy and Compliance

Apollo's top priority is ensuring the privacy and security of your data and your customers' data. No Apollo tool or library running in your environment sends any data to GraphOS unless you configure it to do so. Features that potentially send highly sensitive data require additional opt-in.

Does GraphOS store operation result data returned by my graph?

No. Your graph's operation results never even reach any Apollo-managed service, with one important exception: cloud supergraphs use a GraphOS Router, which passes results directly from your subgraphs to requesting clients, without logging, persisting, or sending those results to any other system (other data like operation metrics are persisted).

Which tools send data to GraphOS?

The GraphOS Router, Apollo Server, the Rover CLI, and the legacy Apollo CLI have opt-in features that send data to GraphOS.

The Rover CLI also collects anonymous usage data by default. You can turn this off.

The Apollo Kotlin IDE plugin also collects anonymous usage data by default. You can turn this off.

If you have a cloud supergraph, its router is hosted and managed by GraphOS, and it automatically enables metrics reporting. Learn about data collection for cloud supergraphs.

Apollo Client libraries do not send data to GraphOS.

How does GraphOS ingest data?

All data sent to GraphOS is sent to an endpoint with one of the following base URLs:

Current URLs

Active legacy URLs

If your environment uses a corporate proxy or firewall, you might need to configure it to allow outbound traffic to these domains. Note that data might be sent to multiple endpoints in a given domain.

Which types of data do the GraphOS Router and Apollo Server send to GraphOS?

You can configure both the GraphOS Router and Apollo Server to report certain data to GraphOS for each operation resolved by these libraries. These types of data include:

• Several fields besides data from every operation response

  • Neither the GraphOS Router nor Apollo Server ever sends the data field of an operation response to GraphOS.

• The normalized query operation string for every executed operation

• Trace data indicating the execution time for every resolver in the operation

• The values of operation GraphQL variables and HTTP headers

These types of data are covered in the subsections below.

In addition, you can configure a standalone instance of Apollo Server to report its schema to GraphOS.

Operation response fields

Let's walk through the default behaviors of the GraphOS Router and Apollo Server when reporting fields in a typical GraphQL response:

1// GraphQL Response
2{
3  "data": { ... },  // NEVER sent to GraphOS
4  "errors": [ ... ] // Can be sent to GraphOS, used to report on errors for operations and fields.
5}

response.data

As mentioned, the GraphOS Router and Apollo Server never send the contents of this field to GraphOS. The responses from your graph stay internal to your application.

response.errors

Both the GraphOS Router and Apollo Server can report certain error information to GraphOS, but the exact behavior varies:

GraphOS Router

Currently, the GraphOS Router reports only which fields in an operation produced errors. Other error details (such as messages) are masked in reports to GraphOS.

You cannot currently configure the GraphOS Router to report any additional error details.

Apollo Server 4

By default, Apollo Server 4 reports only which fields in an operation produced errors.

You can configure Apollo Server 4 to provide additional error details (such as error messages and extensions). To do so, provide the sendErrors option to Apollo Server's usage reporting plugin.

Apollo Server 2 and 3

By default, Apollo Server versions 2 and 3 report all error details to GraphOS, including messages and extensions.

You can use the usage reporting plugin's rewriteError option to filter or transform errors before they're stored in GraphOS. Use this to strip sensitive data from errors or filter "safe" errors from Studio reports.

Query operation strings

The GraphOS Router and Apollo Server both report a normalized string representation of each query operation to GraphOS. By default, this normalization algorithm strips out string literals that are passed as arguments. However, we highly recommend that users do not include sensitive data (such as passwords or personally identifiable information) in operation strings. Instead, include this information in GraphQL variables, which you can send selectively.

Operation traces

If you're using the GraphOS Router, your subgraphs can include operation trace data in each of their responses to the router. This data includes timing information for each resolver that contributed to the operation.

To check which subgraph libraries support federated traces, consult the FEDERATED TRACING entry in this table.

You can configure the GraphOS Router to include this trace data in its reports to GraphOS (learn how). By doing so, you can visualize the performance of your operations in GraphOS Studio, broken down by resolver.

If you're using a standalone instance of Apollo Server, you can also configure it to report operation traces to GraphOS.

GraphQL variable values

This section pertains to the values of variables that are included in GraphQL operations. The names of these variables are included in operation strings that are sent to GraphOS.

Apollo Server 2.7.0 and later

In Apollo Server 2.7.0 and later, none of an operation's GraphQL variable values are sent to GraphOS by default.

You can set a value for the usage reporting plugin's sendVariableValues option to specify a different strategy for reporting some or all variable values.

Apollo Server prior to 2.7.0

In versions of Apollo Server 2 prior to 2.7.0, all of an operation's GraphQL variable values are sent to GraphOS by default.

If you're using an earlier version of Apollo Server, it's recommended that you update. If you can't update for whatever reason, you can use the privateVariables reporting option to specify the names of variables that should not be sent to GraphOS. You can also set this option to false to prevent all variables from being sent. This reporting option is deprecated and will not be available in future versions of Apollo Server.

GraphOS Router

By default, the GraphOS Router does not send an operation's GraphQL variable values to GraphOS.

To enable variable value reporting in the GraphOS Router, see this section.

HTTP headers

Regardless of your server configuration, GraphOS never collects the values of the following HTTP headers, even if they're sent:

• Authorization

• Cookie

• Set-Cookie

You can, however, configure reporting options for all other HTTP headers.

Apollo Server 2.7.0 and later

In Apollo Server 2.7.0 and later, none of an operation's HTTP headers is sent to GraphOS by default.

You can set a value for the usage reporting plugin's sendHeaders option to specify a different strategy for reporting some or all your HTTP headers.

Apollo Server prior to 2.7.0

In versions of Apollo Server 2 prior to 2.7.0, all of an operation's HTTP headers (except the confidential headers listed above) are sent to GraphOS by default.

If you're using an earlier version of Apollo Server, it's recommended that you update. If you can't update for whatever reason, you can use the privateHeaders reporting option to specify the names of variables that should not be sent to GraphOS. You can also set this option to false to prevent all headers from being sent. This reporting option is deprecated and will not be available in future versions of Apollo Server.

GraphOS Router

By default, the GraphOS Router does not send an operation's HTTP header values to GraphOS.

To enable header reporting in the GraphOS Router, see this section.

Other GraphOS Router data

The router collects and reports the following data:

• The execution command that was run (excluding any identifiable arguments such as file-system paths or profile names)

• The version of router that was executed

• The configuration properties which have been referenced, but limited to types which could not contain personally identifiable information (for example, certain scalar types; a property which is set to true not the value if it is a string)

• A unique, anonymized machine identifier, which is the same for every command run on the same machine

• A unique, anonymized session identifier, which is different for every command

• The SHA-256 hash of the directory that router was executed from

• The SHA-256 hash of the contents of the supergraph schema

• The operating system router was executed on

• The CI system router was executed on, if any

Requesting deletion of data

To request the deletion of specific data from your Apollo organization, please email support@apollographql.com with the subject Data deletion request.

In your email, please include the following:

• A description of the data that needs to be deleted

• An approximate timestamp of when that data was reported to Apollo

• The ID of the graph that the data is associated with

You can also request that members of your organization be removed from marketing outreach. To do so, provide the email addresses of those members in your email.

To learn more, go to the Privacy Policy.

Configuring the router to opt out of data collections

You can configure your router to opt out of data collection by setting the APOLLO_TELEMETRY_DISABLED environment variable to true in every environment where you run the router.

Policies and agreements

To learn about other ways that Apollo protects your data, go to our Legal and Privacy page and read our Terms of Service and Privacy Policy.