How Privacy Works

River was designed around a clear principle: the only things that leave your machine are the ones you explicitly share.

This page covers how that principle works in practice — what's local, what's cloud, what's encrypted, and how you control all of it.

Three deployment modes#

How privacy works depends on how you're running River.

River Cloud (the default)#

River hosts the backend, sync server, and storage. Your entities live in River's databases, encrypted at rest and in transit. AI inference goes to whichever model you've selected (cloud or local).

This is the easiest mode and the one most users start with. Privacy is enforced by encryption, ACLs, and our internal policies.

River Self-Hosted#

You run the full stack — backend, MongoDB, OpenSearch, MinIO, the WebSocket server — on your own infrastructure. Nothing leaves your network unless you explicitly call a cloud service from inside River.

Pair self-hosted with local Ollama models and you have a workspace where AI inference, data storage, and event flow all happen on machines you own. This is the right mode for healthcare, legal, government, finance, and anyone with hard data residency requirements.

→ See Self-Hosted River.

Local-only mode#

Even on River Cloud, you can configure the AI to use exclusively local Ollama models. In this mode, your prompts never leave your device. Storage still goes to the cloud (encrypted), but inference is local.

What's encrypted#

Connector credentials#

For integrations that store API keys (Stripe Connect, Crisp, custom HTTP tools), each user's credentials are Fernet-encrypted with a per-user key. Even with database access, no one can decrypt one user's credentials with another user's key.

What never leaves your machine#

When you use the desktop app:

• Local files you drop in (until you explicitly upload them as entities)
• Computer Use screenshots (analyzed locally if you've configured local AI)
• Local Ollama inference (entirely on-device)
• The Agent Panel's local chat thread (when using local models)

What does leave your machine#

When you use River Cloud:

• Entities stored in your Dataspace (encrypted)
• Edits routed through the WebSocket server for multiplayer (encrypted)
• AI prompts sent to whichever model you've selected (cloud models route through the provider; local models stay on your hardware)
• Integration sync (e.g., Gmail → River) flows through OAuth + your selected sync path

Data ownership and export#

You own your data. Always.

• Export any entity, Group, Dataspace, or your entire workspace at any time
• Delete anything irreversibly
• Take it elsewhere — entities export as Markdown, JSON, or original file formats
• Self-host the same workspace — you can move from Cloud to Self-Hosted by exporting and re-importing

What we never do#

• Train models on your data
• Sell or share your data with third parties
• Read your entities for any purpose other than running the system
• Use your prompts in our research

This is the explicit, contractual promise.

Audit logs#

For Org Admins and Owners, audit logs (Premium plan) record every privileged action — member additions, permission changes, integration connections, data exports. See Admin Dashboard.

Tips#

• For the highest privacy posture: Self-Hosted River + Local Ollama models + offline mode for sensitive sessions.
• For a balanced posture: River Cloud + local-only AI mode for sensitive Spaces, cloud AI for the rest.
• Audit your share list quarterly — Settings → Sharing → Active shares shows everything currently exposed.