Pānui
4notify Aotearoa New Zealand · New Zealand Gazette
OFFICIAL · RealMe · Department of Internal Affairs
Pānui No
PAN-NZ-004
Date
2026-05-27
Status
In force
Category
Digital government

RealMe, igovt logon and one-time-code delivery: digital-government notices to New Zealanders

RealMe, built on the igovt logon service operated by the Department of Internal Affairs (Te Tari Taiwhenua), gives New Zealanders a single secure logon to hundreds of government services. 4notify integrates with the digital-identity notification flow to deliver logon verification, service notices and one-time-code delivery — with identity references kept masked.

PushSMSEmail
Preamble

Section 1 — Pursuant to the Identity Information Confirmation Act 2012 and the Privacy Act 2020, this Pānui is issued concerning the delivery of RealMe and igovt logon notices and one-time codes.

Legislative basis
Identity Information Confirmation Act 2012

Provides the legal basis for the igovt identity-verification service that underpins RealMe.

Privacy Act 2020

Information privacy principles governing the collection, use and disclosure of personal information by RealMe-connected agencies.

Electronic Identity Verification Act 2012

Governs the RealMe verified-identity service and the handling of its identity credentials.

Implementation
01

igovt notification integration

4notify integrates with the RealMe / igovt notification gateway; penetration testing is performed quarterly.

02

Identity reference masking

The delivery envelope carries only a hashed identity reference (SHA-256 + salt); the cleartext identifier stays in the agency's own system.

03

Three-channel escalation

Logon challenge → push (60s) → SMS (2 min) → email (5 min); the recipient's channel preference is held in their RealMe profile.

04

One-time-code delivery

RealMe and igovt one-time codes are delivered inside a 60-second window; on SMS failure, email is the fallback.

Delivery envelope
json
{
  "event": "realme.logon.challenge",
  "identity_hash": "sha256:salt:7f2a9b...",
  "agency": "ird.govt.nz",
  "agency_name": "Inland Revenue myIR",
  "channels": ["push", "sms", "email"],
  "escalation_window_minutes": 5
}
Sample message
PushSubject: Confirm your RealMe logon

RealMe: a logon to Inland Revenue myIR is in progress. Tap to approve, or open the RealMe app if this was not you. Code expires in 60 seconds.

Compliance checklist
  • RealMe / igovt notification integration active
  • Identity-reference masking (SHA-256 + salt) enforced at the envelope
  • Channel-preference escalation implemented from the RealMe profile
  • OTP P50 ≤ 4 seconds across all three networks
The 4notify difference

4notify is the only A2P provider with native RealMe / igovt notification integration, identity-reference masking and a Privacy Act 2020-aligned template library for digital-government messaging.

Frequently asked questions
Can 4notify see a person's RealMe identity details?

No. The delivery envelope carries only a hashed identity reference; the connected agency holds the cleartext identifier and resolves the hash locally.

Does this cover agency service notices as well as logon codes?

Yes — agency notifications (for example a myIR message-waiting alert) travel through the same envelope and are delivered on the person's preferred channel.

Notified by
4notify Operations Office
2026-05-27 · PAN-NZ-004

Start for free

14 days, no card required. New Zealand-hours support.

Other pānui in this edition