A microsite worth entering
A genuinely beautiful gallery with filtering, entry pages, sharing and social previews — living inside your site's own header and footer, responsive from small phones to ultrawide.
The audience campaign engine
Your audience makes the content. We run everything else.
EntryWorks powers competitions where the public submits the work — photos, video, recipes, stories, anything — with voting, moderation, prizes and partner-grade reporting built in. Designed to order for each brand, hosted in Australia.
Photo competitionsVideo challengesRecipe contestsShort storiesCaption battlesKids’ artGarden of the yearPet showdownsDesign awardsCommunity heroes
The platform
One engine runs the whole campaign
Public microsite, submissions, screening, voting, prizes and reporting — one deployment, wearing your brand end to end.
- 01Entrantuploads from any device
- 02Screeningprovenance, forensics, detectors
- 03Moderatora person makes the call
- 04Gallerypublished, metadata stripped
- 05Resultsvotes, winners, reports
every decision along this path lands in the audit log
Frictionless entry
Uploads go straight from the entrant's device to secure cloud storage, then an automated pipeline reads capture data, builds every display size and queues the entry for review in minutes.
Voting that survives scrutiny
Signed-in voting with a hard one-vote-per-person rule enforced at the database, rate limits, device signals and a leaderboard review before any prize is called.
Moderation with judgement
Automated checks score every entry and show their reasoning; a person always makes the publish decision, and the whole history is kept.
An operator console, not an admin page
Competitions, entries, prizes, copy, emails, sign-in options and reporting managed from one console — including live edits to on-page wording, no developer required.
Reporting partners can invoice against
Entries, entrants, voters, visitors and campaigns — by day, by source, by placement — with spreadsheet exports whose totals actually reconcile.
The gates
Security designed in, not patched on
Every surface is threat-modelled before it's built. These controls are wired into the framework — they can't be forgotten.
- Identity
- Three separate audiences — public entrants, client staff, platform operators — each with their own sign-in, including corporate SSO. Every action re-checks role and ownership on the server.
- Isolation
- Each client's data is fenced at the query level. An administrator only ever sees their own competitions, entries and reports.
- Uploads
- Short-lived single-purpose credentials, strict size and type limits, byte-level verification, and every image re-encoded before it's served.
- Privacy
- Location and camera metadata stripped from every public image; release forms in a private vault, opened one signed request at a time.
- Vote fraud
- Database-enforced one-vote rules, rate limits, device fingerprinting, throwaway-email heuristics and a manual leaderboard review before prizes.
- Secrets
- Keys and credentials envelope-encrypted at rest, rotated from the console in minutes. Nothing sensitive sits in a config file.
- Accountability
- Every privileged action — approvals, rejections, edits, exports — lands in an immutable audit log: who, what, when.
- Hardened edges
- Strict content-security policies, signed webhooks, injection-proof data access, least-privilege database roles, redacting logs.
Sovereign & compliant
Australian data, Australian rules
SYD · AU
Everything stays onshore.
Photos, entrant records, databases and backups live in Sydney-region Australian data centres. Residency is a property of the architecture — not a promise in a contract.
Privacy Act & APPs
Privacy by design: metadata stripped from public images, personal data redacted from logs, retention limits, breach-ready audit trail.
Right to be forgotten
A self-service delete-my-data path for every entrant — with the removal itself on the record.
Trade promotion ready
Terms, eligibility windows and winner records structured to support state and territory permit obligations.
Spam Act aligned
Transactional, consent-based email only — every send logged with its trigger.
Consent & releases
Signed model-release capture for identifiable people, flagged before judging, stored in a private vault.
Accessible to everyone
Keyboard navigable, screen-reader tested, WCAG-level contrast in every design language.
Proof
It's already run at city scale
Integrations
Plays well with the stack you already run
Every integration is configured from the operator console — connected, tested and rotated without a developer or a redeploy.
Google Analytics
The full event stream — views, entries, votes, shares — fires into your own GA property.
Campaign attribution
Campaign tags and ad-platform click IDs follow the visitor from arrival through to entry and vote.
Edge analytics
CDN-level traffic pulled into reports — the visitors browser-side analytics never sees.
Microsoft 365 SSO
Staff sign in with the accounts they already have; access ends when the employee does.
Social sign-in
Google, Facebook, Apple or a one-tap email link — switchable per campaign.
Any email provider
Transactional email over standard SMTP, sent through whichever provider you already trust.
Finance-ready exports
Styled workbooks for entries, voters and campaigns — with totals that reconcile.
Your own cloud
Standards-based object storage — assets can live in your organisation's own Australian account.
Your next campaign is a
conversation away.
Tell us the audience, the sponsor and the format — we’ll come back with a design, a timeline and a number.