Security and your records
What we do to protect a venue's records.
Last reviewed 26 September 2026
Where your records are kept
- The platform, its database and its backups are hosted by Amazon Web Services in Sydney.
- Uploaded files such as photographs, documents and training videos are stored with Cloudflare in its Asia Pacific region, which may be outside Australia. Copies of these files are also kept with our backups in Sydney.
- Every provider that receives personal information, and what it receives, is listed in section 10 of our Privacy Policy.
Signing in
- Every page is served over HTTPS. A plain connection is redirected, and browsers are told to use only HTTPS for the platform.
- Passwords are at least 12 characters and are stored only in a scrambled form that cannot be turned back into the password.
- Venues with an active subscription, their staff, business owners and our own team can turn on a second step when signing in. Signing in from a device they have not trusted is then confirmed by email first.
- Card and bank details are taken by Stripe. We never see or store a card number.
Who can see a venue's records
- Each member of a venue's team signs in with their own account, and the venue chooses which tabs each person can open.
- On the Guardian plan, the venue's Hospitality Compliance Support Officer reads its records for the period the venue allows, from three months to five years.
- A small number of Hospitality Shield staff can read and correct a venue's records to support it. Every change they make is recorded against their name.
Nothing is changed without a trace
- Every change to a record is kept in that record's history, with who made it and when.
- Daily records are never deleted. One that is undone is kept, with who undid it and when.
- A deleted document, recipe, training video or uploaded file waits in the venue's Recycle bin for 180 days and can be put back until then.
- The assistant in the app sees only what the account asking it can see.
Report a security problem
If you think you have found a weakness in Hospitality Shield, email compliance@hospitalityshield.com.au with what you found and how to see it. Do not access or change anyone else's records while you look.