Protecting data on your device

The Govt.nz app is built to keep your information under your control, on your device, and out of reach of anyone else — including the government.

Independently checked and accredited

The Govt.nz app is accredited by the New Zealand government’s Trust Framework Authority, under the Digital Identity Services Trust Framework (DISTF) Act .

Accreditation involves an independent security evaluation and privacy assessment and ongoing compliance with the Framework’s rules. The security evaluation involves independent technical testing of the app, including code review and penetration testing, conducted on a regular basis.

Trust Framework for Digital Identity — Public Service Commission | Te Kawa Mataaho

If you discover a potential security issue yourself, follow the responsible disclosure guidelines to report it.

Responsible disclosure guidelines

All sensitive data on your device is encrypted

Your device protects your data using encryption keys stored in a secure element. This is a piece of dedicated hardware built into your device. It’s the same technology that protects banking apps and services like Apple Pay.

Your device key never leaves this secure hardware. It cannot be extracted or accessed remotely and only your device can use the key to unlock it.

Access to the encryption keys requires OS biometrics

The app relies on your device’s built-in, OS-level biometric controls, such as Face ID or fingerprint, to unlock the encryption keys stored on your device.

The app itself never receives or processes biometric data — it only calls the device’s operating system to confirm you’re authorised. This means that even if your device is lost or stolen, no one else can access your information.

All communications are encrypted

The traffic is encrypted using industry standard protocols whenever the app:

  • connects to a service
  • obtains app content
  • exchanges information with a credential issuer.

Security requirements for devices

The app may store sensitive information on your device, including digital credentials. Because of this, devices must meet current Govt.nz security requirements and the relevant iOS (Apple) or Android security standards.

This includes having an approved operating system running a modern version with patches applied. Hardware requirements such as biometrics may also be required.

Check if your device is supported

Utility links and page information

Was this page helpful?
Thanks, do you want to tell us more?

Do not enter personal information. All fields are optional.

Last updated