Who is on the lot — and who is not

Who we are

ABN 20 235 092 068. The operator is not registered for GST — the published card is the amount invoiced. This site is the public card and the lead form. The desk holds no keys. It is not a booking engine.

Insured contractor before dispatch

No one is sent to your lot until they are on FILE: an ABN we have checked, a current public-liability certificate of currency, and a written 1/2/3-bed rate (4-bed if offered) that includes the photo pack and sits inside the desk pay lock. Those written rates are on file before a turn is offered. Going on file is not a job offer and not a guarantee of work.

The photo pack is delivered on the same thread before the next guest: entry, each made bed, bathroom, kitchen bench, living, and any visible damage.

The desk operator does not attend. If we cannot put a FILE contractor on the window, we cancel our side and write that on the thread. We do not send an uninsured person to fill the gap.

Codes stay on email

Lockbox codes, app invites, fob names and concierge notes belong on the booking thread — desk@innerturn.com.au — not on this website and not in the public form. The public form does not ask for a code. Do not paste one there.

A form is not a booking

The manager form creates a LEAD. A booking needs the lot pack, your written confirm, and a contractor on FILE. One send. Do not resubmit. If the form is quiet, email desk@innerturn.com.au once.

Forms use a honeypot and a short timing gate so a blank machine post is dropped. That does not make a lead into a book.

How the desk is locked

Short appendix. The public site does not use these locks. They sit on the operator desk only.

The desk is invite-only on Netlify Identity. Sign-in is email + password, allow-listed to desk@innerturn.com.au and the Gmail recovery address. Public signup stays off. Desk APIs accept only a token that GoTrue / Netlify Identity has verified. Unsigned or forged JWTs are rejected.

After Identity succeeds, a second lock is required: a one-time six-digit code emailed to the desk inbox. It works once, only for the account that asked, and expires after ten minutes; the server keeps only a keyed hash of it in Netlify Blobs. A hashed unlock phrase remains as a fallback. A session token lasts twelve hours and is required, with the Identity token, before pipeline state can be read or written.

Five failed Identity tries on the page pause for a minute. Eight failed unlocks lock that address for fifteen minutes.

HTTPS only. HSTS. Clickjacking blocked. Content-Security-Policy denies unexpected scripts. Desk and login pages are no-store and noindex. Vulnerability mail: desk@innerturn.com.au — also listed in security.txt.

Related: Terms · Privacy · Policies.