RunPivot for government · AU & NZ

The AI A/B testing platform for government.

Government teams test for completion, comprehension, and access — not conversion. Describe the test in plain language, run it on your live site, and ship the version more people can actually finish. Every variant checked for accessibility. No citizen data touched, ever.

Every variant

WCAG 2.2 AA checks

None

Citizen data collected

Public pages

Surfaces in scope

Weeks

Typical assurance timeline

The problem

Government teams know what to improve. The blocker is shipping tests that pass assurance.

Public services need completion, comprehension, and equitable access — not conversion-rate theatre. Most experimentation programs were built for neither the metric nor the review process.

01
Variants skip the accessibility check
The control page passed audit once. Every variant since shipped without the same WCAG review — and real users paid the cost.
02
Procurement outlasts the pilot
Full platform buys take quarters. The service page keeps underperforming while assurance paperwork runs in parallel.
03
Commerce metrics miss the brief
Conversion framing ignores task completion, plain-language comprehension, and whether assistive-technology users can finish at all.

One service page. One experiment cycle.

Typical public-sector program

Last WCAG audit on control

Before variant program began

14 mo

Variants launched without automated check

Manual audit not repeated per test

Assurance review cycles per test

Security + privacy + accessibility

2–3

Task completion rate

Untested form flow

41%

Accessibility debt on live variants

Growing

Illustrative program snapshot. The pattern is common: one audited baseline, many unaudited variants, and a growing gap before central teams catch it.

A different definition of winning

The metric is completion, not conversion.

A commercial site tests to lift revenue. A government service tests so that more people — including those who find digital services hardest — get to the end of the task. Renewing a licence. Applying for support. Reporting something that matters. The experiments look similar. The stakes don't.

Plain language
Test whether rewritten content actually improves comprehension and completion, instead of assuming it does.
Service steps
Test the order, grouping, and wording of form steps to find where people abandon and why.
Every user
Variants that win with the average user but fail assistive technology users are not wins. RunPivot treats them as failures.

Accessibility is a constraint, not an audit

A/B testing usually breaks accessibility. Ours checks it.

Here is the uncomfortable truth about most experimentation programs: the control page passed an accessibility audit once, and every variant since has skipped it. RunPivot runs automated WCAG 2.2 AA checks on every variant before it goes live, so an experiment can never trade completion for access.

WCAG 2.2 AA checks · every variant · before launch · automated checks complement, not replace, your audit program

The checks you'll run on us

We know your assurance process. Here's where we stand.

Your security, privacy, and accessibility teams have a list. This is it. No vendor theatre — just the register.

Australia

Framework	What it covers
WCAG 2.2 AA	Accessibility conformance for all variants served, aligned to the Digital Access Standard under the DTA's Digital Experience Policy.
DIGITAL SERVICE STANDARD V2.0	Alignment of RunPivot-run experiments with the DTA's criteria for user-centred, accessible, measurable services.
PRIVACY ACT 1988 & APPs	Handling of any data collected by the tag against the Australian Privacy Principles, with support for your Privacy Impact Assessment.
ACSC ESSENTIAL EIGHT	RunPivot's internal security maturity mapped against the Essential Eight mitigation strategies.
ISM CONTROL MAPPING	Mapping of RunPivot's controls to relevant Information Security Manual controls for OFFICIAL-level public websites.
IRAP ASSESSMENT	Independent assessment status under the Information Security Registered Assessors Program.
DATA RESIDENCY (AU)	Where experiment data is stored and processed, and whether an Australian-region deployment is available.
PSPF ALIGNMENT	Handling of OFFICIAL information under the Protective Security Policy Framework.
SUPPLY CHAIN CONTROLS	Subresource Integrity and Content Security Policy compatibility for the RunPivot tag on government sites.
PENETRATION TESTING	Most recent independent penetration test of the platform and tag, summary available in the assurance pack.

WCAG 2.2 AA: Accessibility conformance for all variants served, aligned to the Digital Access Standard under the DTA's Digital Experience Policy.
DIGITAL SERVICE STANDARD V2.0: Alignment of RunPivot-run experiments with the DTA's criteria for user-centred, accessible, measurable services.
PRIVACY ACT 1988 & APPs: Handling of any data collected by the tag against the Australian Privacy Principles, with support for your Privacy Impact Assessment.
ACSC ESSENTIAL EIGHT: RunPivot's internal security maturity mapped against the Essential Eight mitigation strategies.
ISM CONTROL MAPPING: Mapping of RunPivot's controls to relevant Information Security Manual controls for OFFICIAL-level public websites.
IRAP ASSESSMENT: Independent assessment status under the Information Security Registered Assessors Program.
DATA RESIDENCY (AU): Where experiment data is stored and processed, and whether an Australian-region deployment is available.
PSPF ALIGNMENT: Handling of OFFICIAL information under the Protective Security Policy Framework.
SUPPLY CHAIN CONTROLS: Subresource Integrity and Content Security Policy compatibility for the RunPivot tag on government sites.
PENETRATION TESTING: Most recent independent penetration test of the platform and tag, summary available in the assurance pack.

New Zealand

Framework	What it covers
NZ GOVT WEB ACCESSIBILITY STANDARD	Conformance of every variant with the NZ Government Web Accessibility Standard.
NZ GOVT WEB USABILITY STANDARD	Alignment of tested pages with the Web Usability Standard's requirements.
PRIVACY ACT 2020 & IPPs	Handling of any tag-collected data against the Information Privacy Principles, with support for your privacy analysis.
NZISM ALIGNMENT	RunPivot's controls mapped to relevant NZ Information Security Manual requirements.
GCDO CLOUD RISK ASSESSMENT	A completed vendor response supporting your agency's public cloud risk assessment under GCDO guidance.
DATA RESIDENCY (NZ/AU)	Where experiment data for NZ agencies is stored and processed.
MĀORI DATA CONSIDERATIONS	How RunPivot's no-personal-data scope intersects with Māori data sovereignty expectations for services used by whānau, hapū, and iwi.
PENETRATION TESTING	Most recent independent penetration test of the platform and tag, summary available in the assurance pack.

NZ GOVT WEB ACCESSIBILITY STANDARD: Conformance of every variant with the NZ Government Web Accessibility Standard.
NZ GOVT WEB USABILITY STANDARD: Alignment of tested pages with the Web Usability Standard's requirements.
PRIVACY ACT 2020 & IPPs: Handling of any tag-collected data against the Information Privacy Principles, with support for your privacy analysis.
NZISM ALIGNMENT: RunPivot's controls mapped to relevant NZ Information Security Manual requirements.
GCDO CLOUD RISK ASSESSMENT: A completed vendor response supporting your agency's public cloud risk assessment under GCDO guidance.
DATA RESIDENCY (NZ/AU): Where experiment data for NZ agencies is stored and processed.
MĀORI DATA CONSIDERATIONS: How RunPivot's no-personal-data scope intersects with Māori data sovereignty expectations for services used by whānau, hapū, and iwi.
PENETRATION TESTING: Most recent independent penetration test of the platform and tag, summary available in the assurance pack.

If an item on this list matters to your assessment, ask us and we'll show you where it's up to.

What we touch, what we never do

Public pages only. No citizen data. That's the design.

In scope

Public, unauthenticated pages.
Content, layout, and step-order variants.
Aggregated, anonymous completion and interaction metrics.
Your existing consent and analytics settings, respected as configured.

Permanently out of scope

Authenticated services and portals.
Any personal information about the people using your service.
Form field contents, in any state, ever.
Cross-site tracking or advertising identifiers of any kind.

This boundary is why a RunPivot assessment is measured in weeks, not quarters. There is no citizen data to govern because none is collected.

How agencies start

Start on one page, not one panel.

Full platform procurement is a long road and we respect why. Most agencies start RunPivot on a single low-risk surface — a campaign page, a content-heavy service page, or a council site — run as a paid pilot with a defined end date and a written summary of what the experiments found. If the results earn a bigger conversation, the assurance pack and compliance register are your first two attachments.

Procurement listings · status TODO

Send this page to your security team.

They'll have questions. The assurance pack answers the first twenty of them.