Service level agreement
Availability objective, support hours, response targets and recovery objectives — the numbers on this page, in full.
Security & procurement
Built to be answerable
When CardOffice reaches your security review, most of what the reviewer needs should already be public. So it is: a live status page, a published SLA, a data processing agreement and a privacy statement, kept where anyone can read them — not produced on request after the third email.
Status you can check for yourself
app.cardoffice.nz/status shows live component checks and a 90-day uptime history. It is the same data the SLA is measured against, and it is visible to everyone at all times — no account, no asking, no screenshot prepared for the occasion.
Maintenance, announced
Scheduled maintenance targets the 02:00–06:00 NZT window. Anything expected to interrupt service for more than 15 minutes is announced on the status page at least 48 hours in advance. Routine deploys are rolling and interrupt nothing, so they are not announced.
Service commitments
What we commit to, in numbers
The availability objective is 99.5% per calendar month — roughly 3.6 hours of allowable downtime — measured by the platform's own one-minute component sampling and published on the status page. Support is by email, Monday to Friday, 09:00–17:00 NZT, excluding NZ public holidays.
| Priority | What it means | Response target |
|---|---|---|
| P1 | Service unusable for all users — cannot sign in, cannot print at all | 4 business hours |
| P2 | A core function degraded — photo upload failing, one printer down | 1 business day |
| P3 | Questions, cosmetic issues, feature requests | 2 business days |
These are response targets, not resolution guarantees — though for a P1, resolution effort is continuous during support hours until service is restored.
There is no out-of-hours pager. That is the honest trade-off of the current operation, and we would rather you read it here than discover it during an incident. If your organisation requires 24×7 first-line response, raise it during procurement — the roadmap answer is partner-delivered first-line support, not a pager.
The full SLA, including what is excluded from the availability measurement, is published at /security/sla/.
Data protection
Where your data lives, and how it comes back
CardOffice is hosted in New Zealand. Backup is not a checkbox on this page; it is a drill we run.
Backups
- Nightly encrypted backups of the database, configuration and all photos.
- Mirrored off-site to independent object storage with versioning.
- Deletion cannot propagate — removing data on the primary does not remove it from the backup.
Recovery
- Recovery point objective: 24 hours, set by the nightly backup cadence.
- Restores are drilled, not assumed — most recently 12 August 2026, end to end.
Access and accountability
An ID system is only as trustworthy as its record of who did what.
- Role-scoped access per organisation — people see and do what their role allows, nothing wider.
- Single sign-on via SAML or OpenID Connect, so your identity provider stays the front door.
- A full audit trail — who issued, updated or revoked a credential, and when, long after the person who did it has left.
Two things we will not do
Photographs are used to put a face on a credential and for nothing else — never for facial recognition. And customer data is your data: it is never used to train models, ours or anyone else's.
The paperwork
Documents your reviewer will want
Published and linkable, so they can go straight into your procurement file.
Data processing agreement
Shaped around the Privacy Act 2020, with a structure GDPR-trained reviewers will recognise.
Website privacy statement
What we collect through this website, and what we do with it.
Bring us your questionnaire
Every institution has a security questionnaire, and we would rather answer yours in the consultation than after it. Send it ahead or bring it along, and we will work through it line by line — including the lines where the honest answer is “not yet”.