Trust Centre
You’re in safe hands.
Everything about engaging with RIVER. Your questions answered, your data protected, and a team who has your back.
100% NZ built. Māori and Pacific owned. Enterprise proven, sovereign deployments.
Straight answers to what we get asked most.
An AI-first command centre: the secure place your organisation runs on. It replaces the scatter of disconnected tools, spreadsheets and chat threads your team works around today with one web application built for you. It understands your data, your processes and your domain, and it compounds: each workflow you add and each system you connect makes the next one land faster.
It is not a chatbot bolted onto what you already have, and not an off-the-shelf product with your logo on it. Your instance is yours alone, hosted securely in our cloud or your own, and operated by RIVER. You get the platform, the work to build it, and the ongoing operations, support and governance that keep it running.
Our standard terms (clause 1) set out exactly what the agreement covers.
If a month passes and we cannot point to something we delivered against your roadmap, you do not pay for it. Where hosting is bundled into your monthly, hosting still runs, so the difference is free.
The risk sits with us, not you. A delivery means something real you can point to at your review: a capability running that was not before, a workflow live, an integration in place, a job that was manual now automated. Not a status update, and not a meeting. It assumes the few things only you can give us: agreed access, your data, and one person on your side who can make a call.
Weeks, and every phase ships something. The Readiness Check tells you where you stand in minutes. Your first capability, working with your real data, is live within weeks as the first module of your command centre.
There is no strategy-only phase where nothing gets built, and no year of consulting before anything runs. You get an early, real win you can take to your board.
You choose where it lives, and it stays yours. Most start on RIVER's cloud in New Zealand or Australia for speed. You can move to sovereign New Zealand hosting, your own cloud, or a fully self-managed setup, and the platform is built to migrate between them. For a Māori or Pacific organisation, where data carries real obligations to your people, that sovereign option is one of the standard choices.
Your data is never used to train public AI models, and where we use third-party AI services we configure them to prevent that too. Access is controlled by role, your data is encrypted in transit and at rest, and activity is logged. The full detail sits on our Security and Governance page.
Your data, your workflows and your IP are yours outright, always. So is the instance we build for you, with code-access options if your team wants to inspect or extend it. The one thing we keep is our core engine, Catalyst, the framework that lets us keep building fast for you and for every client.
And you are never locked in. If you leave, we give you a full export of your data, configurations and workflows in standard formats, and the platform can stay available read-only through the transition. If you would rather keep running it without us, there is a real, priced pathway to fork your instance and take it fully independent, on a perpetual licence. Our standard terms set it all out - ownership under clause 6, your exit under clause 8, and going independent under Module F.
A platform that keeps improving, and a technology partner on call. Each month brings named work off your roadmap: an integration, a new screen, a report, a workflow automated. Hosting, monitoring, security and support sit underneath it, always on.
You choose the mix. A month can be build, a coaching series for your team, or direction work for your leadership, and you can move faster or slower a tier at a time. Something real ships every month, or that month is free.
There is no timesheet and no per-seat charge. Add people, add a report, add another feed, and the monthly does not move.
A person on our team who already knows your platform, not a ticket queue in another timezone. A member of our senior team champions your project from the first call and stays with you once it is live, so the people fixing a problem are the people who built the thing.
We are New Zealand based, and support runs to agreed response targets: business-hours cover on a pilot, and on a production platform we can add defined uptime targets and on-call escalation. You always have a human to reach, and a clear way to escalate if you need one.
We are one. RIVER is Māori and Pacific owned, and that shapes how we work, not just who we are. We treat your data as taonga, with the obligations of kaitiakitanga that come with it. Sovereign New Zealand hosting is on the table, because for many of the organisations we serve, data leaving the motu is not an option.
If tikanga, iwi governance or data sovereignty matter to your board, they are first-class in the conversation from the start, never an afterthought bolted on for the pitch.
It answers from sources you approve, shows where each answer came from, and says it does not know rather than guessing. We curate what it reads rather than pointing it at everything, because searching everything at once returns confident, conflicting answers, which is worse than no answer.
Anything consequential keeps a person in the loop, earning more autonomy as the evidence comes in. Our standard terms (clause 5) set out how AI is used and where responsibility sits.
We have been building for New Zealand and Australian organisations for more than fifteen years, across 1,000+ projects. RIVER is Māori and Pacific owned and built to last, not a startup betting the company on one round of funding.
And if the worst ever happened, you are still covered. Because you own your instance and can hold a perpetual licence to run it independently, your platform does not depend on us being here. Your continuity is written into the agreement, not left to trust.
Access is by role, and the AI respects it. A person sees the pages their role allows, and the AI only answers from knowledge that role can reach, so leadership content stays with leadership. Where we connect to a system like SharePoint, your existing permissions carry through.
Have a different question? Contact us or
The documents behind the answers.
Everything your procurement and legal teams need, in one place.
Terms of Engagement
Our standard engagement terms. Covers scope, delivery, data handling, IP ownership, and exit.
Privacy Policy
How we collect, use, and protect personal data under the NZ Privacy Act 2020.
Security & Governance
Deployment models, access controls, data protection, AI governance, and incident response.
Procurement FAQ
Common enterprise purchasing questions, data, ownership, deployment, SLAs, and exit.
The same terms for everyone, in every engagement.
Clear terms, transparent pricing, and a clean exit if you ever need one. None of it is negotiated deal by deal.
- You own your data, your workflows and your IP. Always. We keep only the Catalyst platform, which is what lets us ship improvements across every client.
- We never train public models on your data. And we configure every third-party AI provider to prevent training on it too.
- Sovereign hosting, or your own cloud. Three deployment models, from RIVER-managed in New Zealand or Australia to fully customer-managed.
- Clear terms, and a clean exit. Published terms, capped liability, and a full export of your data in standard formats if you ever leave.
Your data, handled plainly.
A plain-language summary of how we handle data across AI engagements.
Your data stays yours
You own your data, your workflows and your IP. Always.
No training on your data
We don’t use client data to train public AI models, and we configure third-party providers to prevent it.
Choose your deployment
RIVER Cloud, your own cloud, or fully customer-managed. Your call, and the platform migrates between them.
Enterprise access controls
Role-based access, SSO and multi-factor sign-in, and exportable audit logs as standard.
A clean exit, always
A full export of your data in standard formats on termination, then deletion once you confirm.
NZ and AU compliance
Built for the New Zealand Privacy Act 2020 and the Australian Privacy Principles.
Built to the frameworks enterprise security expects.
Our controls, AI governance and operational practices are built to these standards. Independent certification is in progress.
Information Security
ISO 27001
- Formal risk assessment on every engagement
- MFA, role-based access and least-privilege across all systems
- Encryption in transit and at rest, with documented incident response
AI Governance
ISO 42001
- Human oversight on AI outputs, especially high-stakes decisions
- Model selection on requirements, not vendor lock-in
- Data-quality governance and no-training provider configurations
Trust Services
SOC 2 Type II
- Security, availability, confidentiality and privacy criteria
- Controls tested over a sustained period, not a point in time
- Independent verification once the audit begins