Food Safety for Ghost & Cloud Kitchens

A ghost or cloud kitchen is a delivery-only food business with no dine-in area, so its food safety risks concentrate where you have least control: packaging, hold time and the courier's car. In Australia you generally still need to register or notify your premises as a food business under Standard 3.2.2, meet the same construction and hygiene rules as any kitchen, and manage temperature all the way to the customer's door. Confirm your obligations with your local council and state or territory food regulator. Key takeaways: A ghost kitchen is still a food business: you generally must register or notify with your local council under Standard 3.2.2, meet the same premises, equipment and hygiene rules, and appoint a Food Safety Supervisor where your state requires one — confirm locally, as requirements vary by jurisdiction.. Your biggest delivery-only risk is the time and temperature gap between the pass and the customer. Potentially hazardous food must be kept out of the 5°C-60°C danger zone; hot food travels at 60°C or above and cold food at 5°C or below.. Packaging is a food safety control, not just branding — use insulated, tamper-evident, food-grade packaging, vent or separate items to control condensation and sogginess, and keep hot and cold items apart in transit.. Third-party couriers (Uber Eats, DoorDash, Menulog drivers) are usually outside your direct control, so build safety in before hand-off: fast pick-ups, insulated bags, sealed packaging and clear allergen labelling on every container.. Multi-brand and shared commissary kitchens multiply cross-contamination and allergen risk across concepts sharing one line — separate equipment, schedules and clear labelling are essential, and each brand's menu must carry accurate allergen information under Standard 1.2.3.. What makes a ghost or cloud kitchen different? A ghost kitchen (also called a dark, cloud or virtual kitchen) produces food purely for delivery or pick-up, with no customers on site. Some are single operators cooking one menu; many are 'virtual brands' where one kitchen runs several delivery-only concepts from the same line, or commissary sites where multiple businesses rent bench space. Removing the dining room does not remove any food safety obligation — it adds new ones. In a normal restaurant, food travels a few metres from pass to table in seconds. In a delivery model, the same meal sits in packaging, waits for a courier, rides in a car and finally reaches a doorstep 20 to 40 minutes later. That journey is time and temperature abuse waiting to happen, and it occurs after the food has left your direct control. Everything in a ghost kitchen's food safety program has to account for that final, unsupervised leg. No dine-in area, so all risk shifts to packaging, holding and transport. Longer time between cooking and eating than any table-service model. The final leg is often handled by a third party you do not employ. Multi-brand and shared sites concentrate cross-contamination and allergen risk. Customers cannot see your kitchen, so labelling and packaging carry all the trust. Do you need to register a delivery-only kitchen? Generally, yes. Under Standard 3.2.2 of the Food Standards Code, a business that handles food for sale usually must notify or register its premises with the relevant enforcement agency — almost always your local council — before trading, and delivery-only operations are not exempt. If you cook from a shared commercial or commissary kitchen, check whether that site is already registered and whether your individual business also needs its own notification; running multiple virtual brands from one address does not always mean one registration covers them all. Home-based cloud kitchens face extra scrutiny because domestic kitchens rarely meet Standard 3.2.3 premises and equipment requirements. Because registration, fees and Food Safety Supervisor rules differ by state and territory, confirm exactly what applies to your setup with your local council and state food regulator before you take a single order. Notify or register the premises with your local council before trading (Standard 3.2.2). Check whether each virtual brand or tenant needs its own notification, not just the building. Most states require a certified Food Safety Supervisor for businesses handling unpackaged potentially hazardous food — confirm your state's rule. Home kitchens must still meet Standard 3.2.3 construction and equipment standards, which is often the sticking point. Use ablis.business.gov.au to help identify the licences and registrations relevant to your location. Controlling temperature from the pass to the door Temperature control is the defining challenge of delivery-only food. Potentially hazardous food (cooked rice, meat, dairy, cooked pasta, cut fruit and similar) must be kept out of the 5°C to 60°C danger zone, where bacteria multiply fastest. The practical rule for delivery is simple: keep hot food hot at 60°C or above and cold food cold at 5°C or below, right up to the moment the courier collects it, and package it to hold that temperature for the trip. The '2-hour/4-hour rule' can be applied to food that is briefly out of temperature control during assembly, but this is cumulative and delivery time counts toward that clock — and once food is in a warm car, you have lost your thermometer. Batch cooking to a delivery rush is a classic ghost-kitchen trap: food cooked early sits in the danger zone waiting for orders. Cook and hold correctly, check core temperatures with a probe thermometer, and stage food so it goes into packaging as close to pick-up as possible. Keep hot potentially hazardous food at 60°C or above until hand-off; cold at 5°C or below. Delivery time counts toward the 2-hour/4-hour rule — the clock is cumulative and does not reset at the door. Use a calibrated probe thermometer to verify core temperatures, not just the display. Avoid cooking far ahead of the delivery rush; stage assembly close to pick-up.