Privacy & Security Policy 

Client Data 

During implementation, clients are provided with their own private data stores. 

• All client data, including all uploaded contracts, will be stored on their dedicated data stores 

• ThoughtRiver may not access client data without permission (e.g. for a support request) 

• Client data is backed up continually to private data stores at a second site to facilitate disaster recovery and data restore 

• All client data is encrypted at rest and in transit; different client’s data stores employ different encryption keys 

Contextual Interpretation Engines 

ThoughtRiver’s AI or Contextual Interpretation Engines are housed in our distributed architecture as shared services. During contract analysis: 

• Contract data is sent to the AI Engines for predictions and training 

• All resultant information is recorded back to the client data stores 

• The AI Engines do not record any client-identifiable data  

Clients may request that ThoughtRiver perform machine learning training on their contracts to extend the capabilities of the out-of-the-box predictions. Where this occurs, a copy of the customer data will be taken into a separate private data store accessible by ThoughtRiver staff which will be used to develop a new iteration of the out-of-the-box prediction models. No data is added to this store without explicit client consent and there is no obligation to agree to this process. None of this data is accessible by any of ThoughtRiver clients.  

Analytics 

The following client data is collected and stored by third party analytics providers who provide product analytics services to ThoughtRiver to support iterative product feature enhancement and customer success support for clients. The usage data is collected via all of ThoughtRiver’s applications (including the Microsoft Word Plug-In, Negotiations Application and Power automate enabled email flow): 

• Domain name of the user's email address. For example, “thoughtriver” is recorded for a user with the email user@thoughtriver.com 

• The user’s universally unique identifier (UUID) which is generated automatically when a new user is created 

• The business role/s assigned to a user 

• The sub-account the user accesses 

• Each ‘event’/feature that a user interacts with within the applications including length of time interacting and frequency of the interaction. ThoughtRiver may track interaction with all features including, for example, uploads, resolution of issues, creation of issues, use of Advice Notes, use of Clause Suggestions.  

• The amount of time a user spends with any of the ThoughtRiver platform’s interfaces on a contract and how much time is spent remediating each version of a contract and how a user is interacting with the available content and application features in relation to a contract. 

The analytics provider logs additional information automatically. This includes geographic location, first-party cookies, data related to the device/browser, IP address, etc. 

Data Segregation and Destruction 

• All customer data is held on a dedicated database separate from the web application. 

• On completion of trial or paid subscription, then this data, including backup copies, will be fully deleted, unless it is requested to be maintained within the ThoughtRiver ecosystem. 

Security 

ThoughtRiver employs a fully managed security operations centre, intrusion detection / prevention and escalation / remediation plans.  ThoughtRiver maintains certification to ISO standard 27001.  This includes both company and application security testing.   

Penetration testing and secure code reviews are performed periodically by independent qualified experts and ethical hackers.  

Employees are screened in accordance with the requirements of the ISO 27001 standard. 

Changes to this policy  

This privacy and security policy was published in September 2021 and last updated in November 2024.  ThoughtRiver may change this policy from time to time and when we do we will inform you via the Platform.