The ghost kitchen model is booming. Lower startup costs, no front-of-house overhead, and the explosive growth of delivery apps have made virtual kitchens one of the fastest-growing segments in foodservice. But here’s the compliance trap most operators fall into: they assume that because customers never walk through the door, regulators won’t either.

They will. And when they do, the standards are exactly the same.

What Is a Ghost Kitchen?

A ghost kitchen  also called a dark kitchen, virtual kitchen, or cloud kitchen  is a commercial food operation that prepares meals exclusively for delivery or takeout. No dining room, no walk-in customers, no front-of-house staff. Orders come in through apps like DoorDash, Uber Eats, or your own website. Food goes out through delivery drivers.

Ghost kitchens require the same food safety permits as traditional restaurants requirements vary by city and state, but your kitchen must pass a health inspection before opening. That surprises a lot of first-time operators who think the delivery-only model puts them in a regulatory gray zone. It doesn’t.

Food Logistics

The #1 Mistake Ghost Kitchen Operators Make

Most operators launching a ghost kitchen focus entirely on their menu, their delivery platform setup, and their packaging. Food safety compliance is an afterthought until a health inspector shows up, or worse, a customer gets sick.

Many operators are completely unaware of their legal duty to register a ghost kitchen or dark kitchen with their local authority. Some try to operate out of home kitchens or shared spaces without ever registering as a food business at all. That’s not a loophole  it’s a liability.

Food Safety

Permits and Licenses You Actually Need

The exact requirements vary by state and locality, but here’s what most ghost kitchen operators need before they go live:

Business License — Required to legally operate in your jurisdiction.

Food Handler’s Permit — Required for anyone who handles or prepares food, ensuring they follow safe food handling practices. FoodReady

Commercial Kitchen License / Health Permit — Verifies that your facility meets local health and safety standards. Most kitchens need approval from the health department, which involves regular inspections to ensure cleanliness and safety standards. FoodReady

Commissary License (if using shared space) — If operating out of a shared kitchen facility, a commissary license may be mandatory. This license ensures that shared kitchens follow specific guidelines for equipment use, food storage, and sanitation. FoodReady

Food Manager Certification — The FDA Food Code requires the Person in Charge at a food establishment to demonstrate food safety knowledge, with a Certified Food Protection Manager (CFPM) certification being the recognized standard. Many states mandate that at least one CFPM be present or on-site during operations.

The Unique Food Safety Risks in Ghost Kitchens

Ghost kitchens introduce food safety challenges that traditional restaurants don’t face in the same way.

Shared kitchen cross-contamination. Different dark kitchen businesses may operate alongside each other at the same time in the same shared kitchen space, making it difficult to determine responsibilities and how staff from different operations ensure hygiene — and inspectors have identified inadequate cleaning practices creating cross-contamination hazards in communal kitchens. If you’re sharing a kitchen with other operators, your allergen controls and sanitation protocols need to account for what they’re cooking, not just what you are.

Temperature danger during delivery. When using third-party delivery services, businesses must ensure that food remains safe during transit — any lapses in food safety can lead to legal disputes and liability claims. Hot food must stay above 135°F; cold food must stay below 41°F. Once the order leaves your kitchen, you lose control — which means your packaging, portioning, and hold times before pickup matter more than most operators realize.

Multiple virtual brands, one kitchen. Many ghost kitchen operators run two, three, or even more virtual restaurant brands out of the same space. Each brand may have different allergen profiles, different raw ingredients, and different customer expectations. Your food safety plan needs to account for all of them, not just your flagship concept.

Liability is yours, not the platform’s. In the event of food contamination or illness, determining liability can be complex, especially when multiple parties are involved in the supply chain and delivery process. DoorDash, Uber Eats, and Grubhub are not your safety net. If a customer gets sick from your food, the legal and reputational exposure lands on your business.

Core Food Safety Practices Every Ghost Kitchen Needs

Whether you’re operating out of a shared commissary or a dedicated space, these are non-negotiable:

Temperature Control
Perishable ingredients must be stored at safe temperatures — below 40°F for refrigeration and above 140°F for hot holding. Log temperatures consistently, especially for proteins, dairy, and ready-to-eat items. If you don’t document it, it didn’t happen.

Personal Hygiene
Staff should wash hands frequently, wear gloves when handling food, and follow proper grooming standards. In a high-volume, delivery-focused operation with rotating staff, hygiene protocols need to be posted, trained, and enforced — not assumed.

Cross-Contamination Prevention
Use separate cutting boards, utensils, and storage containers for raw and cooked foods. In shared kitchen environments, color-coded equipment and designated prep zones are especially important.

Cleaning and Sanitation SOPs
Work surfaces, equipment, and storage areas should be cleaned and disinfected regularly to prevent bacterial growth. You need written Sanitation Standard Operating Procedures (SSOPs) that specify what gets cleaned, how, with what products, at what concentration, and how often. A verbal understanding among staff is not a food safety program.

Allergen Management
If you’re running multiple virtual brands with different menus, your allergen controls need to be explicit. Know your Big 9, label accurately, and train every person who touches food on your allergen protocols.

Do You Need a HACCP Plan?

It depends on what you’re producing. If you’re a delivery-only operation cooking from scratch and serving food directly to consumers, your local health department may not require a formal HACCP plan  but they will expect you to demonstrate active managerial control over food safety hazards.

If you’re producing any packaged foods for wholesale, processing raw proteins, or operating under FDA jurisdiction (not just local health department oversight), a formal HACCP plan may be legally required. When in doubt, it’s worth getting a professional assessment  the cost of building a compliant food safety program is always less than the cost of a closure or recall.

The Bottom Line

Ghost kitchens are not exempt from food safety law  they’re just less visible, which means compliance problems tend to go undetected longer and blow up harder when they surface. Compliance with standards for food handling, storage, and sanitation is essential to avoid fines, closures, and reputational damage.

The good news: building a solid food safety foundation for a ghost kitchen is very achievable, especially in the planning stage. The operators who get in trouble are the ones who launch fast and figure out compliance later. Don’t be that operator.

Need help building a food safety plan for your ghost kitchen? Afya Food Safety & Sanitation offers HACCP plan development, SOP writing, and compliance consulting tailored to delivery-only operations. Contact us today.