Magento 2 & Adobe Commerce · Verifiable against the public repository
Magento 2 and Adobe Commerce ship a reporting subscription that switches itself on. Once a store has signed up, it builds an encrypted archive of customer, order and catalogue data every night and tells advancedreporting.rjmetrics.com the file is ready to collect. None of it is hidden — Adobe documents it and there is a switch in the Admin. It is simply on unless someone turns it off. This page sets out what the code does, file by file, so you can check your own store.
What is installed
Advanced Reporting is not an extension someone added. It is part of the core codebase, and the magento/product-community-edition metapackage requires all seven modules in every 2.4.x release. Adobe's developer documentation lists the same seven for both Adobe Commerce and Magento Open Source.
The engine. It handles the subscription and sign-up, schedules the nightly collection, encrypts the archive, and provides the API endpoint the reporting service calls to find it.
CustomerAnalytics, SalesAnalytics, QuoteAnalytics, CatalogAnalytics, WishlistAnalytics and ReviewAnalytics. Each declares in its own etc/reports.xml which tables and columns go into the archive.
Sign-up activates an Admin integration called Magento Analytics user, limited to the Analytics API, and gives its access token to the reporting service so it can locate each night's archive.
On by default
The install does not ask. A data patch writes the setting straight into the database and starts the sign-up process in the same step.
public function apply()
{
$this->moduleDataSetup->getConnection()->insert(
$this->moduleDataSetup->getTable('core_config_data'),
[
'path' => $this->subscriptionEnabledConfigPath,
'value' => Enabledisable::ENABLE_VALUE,
]
);
$this->subscriptionHandler->processEnabled();
return $this;
}In the same file, $subscriptionEnabledConfigPath is 'analytics/subscription/enabled'. Enabledisable::ENABLE_VALUE is 1.
01
processEnabled() checks whether the store already holds an Advanced Reporting token. A new install does not, so it schedules the analytics_subscribe cron job for minute 0 of every hour and sets an attempts counter to 24.
02
Each run takes one off the counter and posts the store's secure base URL, with an access token for the integration user, to /signup. When a token comes back, the hourly schedule is removed. If the 24 attempts run out first, the job stops and the status shows Failed.
03
A second patch, ActivateDataCollection, schedules analytics_collect_data from the default Time of day to send data, 02,00,00: daily at 02:00. The job only builds an archive once the status is Enabled — that is, once a token has been received.
public const CRON_STRING_PATH = 'crontab/analytics/jobs/analytics_subscribe/schedule/cron_expr';
public const CRON_EXPR_ARRAY = [
'0', # Minute
'*', # Hour
'*', # Day of the Month
'*', # Month of the Year
'*', # Day of the Week
];
private $attemptsInitValue = 24;
Adobe's documentation lists what sign-up needs: the site on a public web server, a valid SSL certificate, secure URLs for the storefront and Admin, and cron running. That describes an ordinary live store. The three jobs — analytics_subscribe, analytics_update and analytics_collect_data — run in their own cron group, analytics, declared in Analytics/etc/crontab.xml.
The archive
Each data module lists its fields in etc/reports.xml. The two reports built around people are customers and order addresses. They are narrower than people tend to assume, so it is worth being exact.
| customers CustomerAnalytics · customer_entity |
order_addresses SalesAnalytics · sales_order_address |
|---|---|
| entity_id | entity_id |
| created_at | customer_id |
| firstname | firstname |
| middlename | middlename |
| lastname | lastname |
| email — SHA1 | city |
| store_id | region |
| — | country_id |
Street address, postcode and phone number. The order address report stops at city, region and country.
Email is never in plain text. It is hashed with SHA1() inside the database query. There is no salt, so the same address always gives the same hash.
The endpoints
The service addresses are set in Analytics/etc/config.xml. The store starts each exchange. The archive itself is not posted anywhere — the service is told it is ready, and collects it.
| Setting in config.xml | Address |
|---|---|
| signup | https://advancedreporting.rjmetrics.com/signup |
| update | https://advancedreporting.rjmetrics.com/update |
| otp | https://advancedreporting.rjmetrics.com/otp |
| report | https://advancedreporting.rjmetrics.com/report |
| notify_data_changed | https://advancedreporting.rjmetrics.com/report |
| bi_essentials | https://dashboard.rjmetrics.com/v2/magento/signup |
ExportDataHandler writes each report into the system temp directory and packs them into data.tgz.Cryptographer encrypts the archive with AES-256-CBC. The key is a SHA-256 hash of the Advanced Reporting token — the token the service issued at sign-up.FileRecorder writes the encrypted file to pub/media/analytics/<SHA-256 of the time>/data.tgz and deletes the previous archive. The temporary files are deleted in a finally block.notify_data_changed. That request carries no customer data.GET /V1/analytics/link, which requires the Analytics API permission held by the integration user. The response is the archive's URL in the media directory and the initialisation vector needed to decrypt it.The file has to be somewhere the service can fetch it, which is why it sits under the media directory rather than a private one. It is encrypted, its folder is named with a SHA-256 hash of the time it was written, and the address and decryption vector are handed over through an authenticated API call.
$ dig +short advancedreporting.rjmetrics.com
prod-nlb-ma-etl-service-0728d878abad9a3c.elb.us-east-1.amazonaws.com.
44.207.154.102The hostname the store signs up with and notifies is an alias for an Amazon Web Services load balancer in us-east-1, the US East (N. Virginia) region. That was the result in September 2026; DNS can change, so run the command yourself.
The load balancer's name was chosen by whoever runs it: prod-nlb-ma-etl-service. Read plainly, that is a production network load balancer for an ETL service, and the Analytics module's own code comments refer to the reporting service as "MA".
The DNS record tells you where the store's sign-up and notification requests go. The code does not show where the service collects the archive from.
"An Adobe Commerce or Magento Open Source instance collects data that Adobe Commerce Reporting uses to build the advanced reports. All the data are stored in an encrypted archive file which is securely transferred to Adobe Commerce Reporting."
Source: Adobe Commerce developer documentation — Data collection for advanced reporting. The documentation does not name a country or region. The DNS record is the only place one appears.
Check your own store
No code and no database. You need Admin access, and for step 3, file access through your hosting control panel or SFTP.
Step 1
In the Admin, go to Stores > Settings > Configuration > General > Advanced Reporting. Under Advanced Reporting Service is a line that reads Subscription status: and one of four values.
Step 2
Go to System > Extensions > Integrations. An integration named Magento Analytics user with the status Active means the sign-up step has run and an access token for that integration exists.
Step 3
Open pub/media/analytics/ in your hosting file manager, or run:
ls -la pub/media/analytics/A folder with a 64-character name holding data.tgz is the most recent encrypted archive, waiting to be collected. Each export replaces the one before, so the folder's date tells you when the last export ran. Unlike the status line, this is a file you can see.
Step 4
On macOS or Linux:
dig +short advancedreporting.rjmetrics.comOn Windows, nslookup advancedreporting.rjmetrics.com gives the same answer.
If step 1 says Enabled and step 3 finds an archive, your store is taking part. If someone decided that, nothing needs to change.
Switching it off
There are two levels. Which is right depends on whether you might want the dashboard later.
Level 1
In Stores > Settings > Configuration > General > Advanced Reporting, set Advanced Reporting Service to Disable and save. The change runs processDisabled(), which deletes the nightly collection schedule. The collection job also refuses to build an archive unless the status is Enabled.
What the switch leaves in place:
pub/media/analytics/If you are not going to use the feature, review all three.
Level 2
The seven modules are not in your project's own require list — they come in through magento/product-community-edition. So composer remove has nothing to act on, and deleting them from vendor/ lasts only until the next composer install. A replace entry in the root composer.json tells Composer not to install them, and it holds through upgrades.
"replace": {
"magento/module-analytics": "*",
"magento/module-catalog-analytics": "*",
"magento/module-customer-analytics": "*",
"magento/module-quote-analytics": "*",
"magento/module-review-analytics": "*",
"magento/module-sales-analytics": "*",
"magento/module-wishlist-analytics": "*"
}Then update your lock file and run bin/magento setup:upgrade — on a staging copy first. In the 2.4-develop branch no other core module declares a dependency on these seven, but check your third-party extensions before you deploy.
Either level means giving up Advanced Reporting — the reports behind the Reports > Business Intelligence > Advanced Reporting menu and the Go to Advanced Reporting button on the Admin dashboard. If your team uses those reports, keep it on. The point is not that it is wrong to use it. It is that someone should decide.
Common questions
It is the service address that Magento 2 and Adobe Commerce use for Advanced Reporting, set in the core Analytics module's etc/config.xml. A store signs up there, and each night it notifies that address that a new encrypted data archive is ready to collect. In September 2026 the hostname resolved to an Amazon Web Services load balancer in the us-east-1 (US East, N. Virginia) region.
Yes. When the Analytics module is installed, a data patch writes analytics/subscription/enabled = 1 and schedules hourly sign-up attempts, up to 24. Adobe lists a public web server, a valid SSL certificate, secure URLs and running cron as what sign-up needs. On a store that meets those, sign-up runs without anyone doing anything, and once it succeeds a nightly export at 02:00 follows.
The customers report contains customer ID, account creation date, first, middle and last name, store ID and a SHA1 hash of the email address. The order addresses report contains first, middle and last name, city, region and country, but not street, postcode or phone. The orders report adds the customer's name, a SHA1 hash of their email, order totals and shipping method, and the carts report includes the customer's name. The archive is encrypted before the reporting service collects it.
In the Admin, go to Stores > Settings > Configuration > General > Advanced Reporting, set Advanced Reporting Service to Disable and save. That removes the nightly collection schedule. It does not remove the token already issued, the Magento Analytics user integration or the last archive in pub/media/analytics/. To remove the feature entirely, list the seven analytics modules under replace in your root composer.json, because the product metapackage otherwise installs them again.
Both. The modules are part of the open-source magento/magento2 codebase, the magento/product-community-edition metapackage requires all seven in every 2.4.x release, and Adobe's developer documentation describes Advanced Reporting as used by both Adobe Commerce and Magento Open Source.
Sources
Files in the magento/magento2 repository, branch 2.4-develop (OSL-3.0), paths relative to app/code/Magento/.
Written by John Fu, Mainstack (Perth). Checked against the 2.4-develop branch in September 2026.
There is an ongoing discussion on LinkedIn.
We build and support commerce systems for Australian retailers and wholesalers, and we read the code before we tell you what it does. Tell us what your store runs and we will work through what it sends, and to whom. We're in Perth.
Book a 30-min consult