Factual disclosure of our architecture, data handling practices, and alignment with New Zealand information security standards. No marketing language.
ShiftScript is built entirely on Cloudflare's global edge network. There are no owned or leased servers. All compute, storage, and routing is managed by Cloudflare.
Data residency: Cloudflare routes requests to the nearest point of presence. R2 storage is configured without a specific geographic restriction, but Cloudflare's infrastructure includes NZ-region routing. ShiftScript does not replicate customer data offshore intentionally.
What we store:
What we do not store:
Data deletion: Administrators can delete documents and workspaces at any time. Deletion removes the object from R2 immediately. KV records are purged within 24 hours of workspace deletion.
Cache-Control: no-store, X-Frame-Options: DENY, and Strict-Transport-Security headers. API endpoints require valid session cookies for all admin operations.Every query made through ShiftScript is logged with the following data points:
Logs are accessible to workspace administrators via the admin portal. They can be exported and presented to regulatory auditors (HealthCERT, ERO, WorkSafe, Privacy Commissioner) as evidence of staff compliance activity.
Logs are retained for a minimum of 90 days. Administrators can request extended retention.
ShiftScript is designed for use by NZ government agencies, Crown entities, local government, and regulated private sector organisations. The following table maps platform controls to relevant NZISM v3.9 sections.
| NZISM Section | Requirement | Status |
|---|---|---|
| 5.3.1 | Security risk identification and treatment | Implemented |
| 7.1 | Incident detection and reporting | Implemented |
| 16.1 | Authentication — passwords, rate limiting, least privilege | Implemented |
| 16.1 (MFA) | Phishing-resistant MFA for privileged access | Planned |
| 16.7 | Session controls and audit logging | Implemented |
| 11.1 | Encryption in transit (TLS 1.2+) | Implemented |
| 18.2 | WPA3 / secure network communications | N/A (cloud-hosted) |
This mapping reflects the November 2025 release of NZISM v3.9. ShiftScript is a private sector SaaS platform — NZISM compliance is voluntary but maintained as a baseline for government-sector customers.
ShiftScript accepts low residual risk for confidentiality and integrity of customer data, managed through Cloudflare's enterprise-grade infrastructure, encryption at rest and in transit, and strict access controls.
ShiftScript accepts zero risk of storing payment card data — this is fully delegated to Stripe's PCI-DSS-compliant systems.
ShiftScript accepts zero risk of using customer documents for AI model training — documents are retrieved per-query and not persisted in AI model context between sessions.
ShiftScript accepts medium residual risk on MFA for admin accounts, currently mitigated by rate limiting and strong session management, pending full MFA implementation.
Risk appetite is reviewed annually or following any material change to the platform architecture. The designated Risk Owner is the platform operator (Cam Lock, ShiftScript). This statement satisfies the requirements of NZISM 5.3.6.R.01.
ShiftScript collects and processes personal information in accordance with the Privacy Act 2020 (NZ).
Third-party processors:
In the event of a security incident affecting customer data:
To report a suspected vulnerability or security concern: cam@shiftscript.nz
Risk Owner & Platform Operator: Cam Lock, ShiftScript
Security enquiries: cam@shiftscript.nz
Privacy Officer: Same contact as above
This policy was last reviewed May 2026. It will be reviewed annually or following material changes to the platform.