The Confidential-Work Portfolio Piece, Scored to Show, Sanitize, or Omit

You built something you are proud of, and then the agreement got in the way. This guide is for anyone - designers, engineers, marketers, consultants - who has a project worth showing but an NDA, a work-for-hire clause, or a proprietary restriction sitting on top of it. It gives you a way to score what the agreement actually blocks, pick one of five treatments, and attach a disclosure line that reads as professional rather than evasive. The point is to stop guessing whether a given project is even showable.

Most advice jumps straight to tactics - blur the logo, use mock data, build a clone - without telling you which tactic fits which restriction. That is backwards. The restriction decides the treatment. So you read the agreement first, classify what it blocks, and only then choose.

What a confidentiality agreement actually blocks

An agreement rarely blocks everything, and knowing exactly what it blocks is the whole game. Standard NDAs and work contracts sort confidential information into distinct buckets, and most tactics only neutralize one or two of them.

The buckets, drawn from standard agreement language, are:

• Client information: the client's name, branding, internal procedures, strategies, financials, customer data, and business plans.
• Project details: the brief, problem statement, plans, sketches, prototypes, final designs, technical specs, and user research.
• Intellectual property: design concepts, patterns, methodologies, inventions, and patents.
• Product or service information: features, interface, user flow, usability findings, development stages, and marketing strategy.

Read two axes before anything else: scope (what is confidential) and duration (how long it lasts). Add a third if your work produced designs or code: IP ownership, meaning whether the company owns the deliverables. Work-for-hire language means the client owns everything from the moment of creation, including drafts and source files.

What usually survives is the part that is actually yours: your process. Even when visuals are completely off-limits, how you approach a problem, structure research, synthesize findings, and make decisions demonstrates capability independent of any client's assets. That is the raw material for most sanitized pieces.

The hardest ceiling is "existence," not visuals

There is one restriction that breaks almost every tactic. NDAs often provide that the mere existence of the agreement, or of the project, is itself a secret. White-label, mock data, and redaction all quietly assume you are allowed to acknowledge the project happened. When existence itself is confidential, every visual tactic fails and only a recreated proxy survives. Check for this first, because it changes which column of the scoring table you are even allowed to read.

Why this decision is routine, not rare

If you work in tech, you will make this call on nearly every project, so a repeatable method beats case-by-case improvisation. NDAs are not an edge case. The surveys disagree on the exact figure but agree on the shape.

The cost of getting this wrong is not just a thin portfolio. In Refolk's index of professional profiles, the U.S. designer market dwarfs the U.K. one, which means a sanitized U.S. portfolio competes against a far deeper pool.

With roughly four times the competition in the U.S., an over-redacted project that reads as a gallery rather than a case study is a real liability precisely where NDAs are most common.

The five treatments and what each neutralizes

Every restricted project resolves to one of five treatments, and each neutralizes a specific restriction while failing against others. Match the treatment to the block you found in the agreement, not to the one that is easiest.

Show as-is is only safe when a timed clause has released the work or a portfolio clause clearly permits it. Anonymize or white-label strips identifying corporate data and leaves the structural framework; borrow this format with confidence, because it is a mature commercial discipline. Summarize behind a private link sells the process, not the product, and gates the detail. Replace with a proxy means building a smaller functional equivalent on open data, hosting it publicly, and linking it - the only tactic that survives when the NDA is absolute. Omit is a legitimate choice, with one caution: do not omit so much that you fall below the showable bar.

Blurring deserves its own mention because people reach for it first and it is the weakest option. You could blur a logo or name, but it is reversible, it reads as careless, and it is not recommended. Treat blur as not a treatment.

Portfolio rights versus confidentiality, and which wins

When a contract grants portfolio rights and an NDA restricts disclosure, the narrower-sounding right does not automatically win; confidentiality usually overrides when the two conflict. Well-drafted contracts keep the clauses separate, and a clean portfolio clause reads along the lines of: the freelancer reserves the right to display final deliverables in their professional portfolio without disclosing confidential information.

The trap is a broad portfolio clause that never excludes unreleased or confidential work. Problems arise there because contractors read the broad grant and wrongly conclude they can show anything. Confidentiality overrides when the contract says confidential information cannot be disclosed, when the two clauses conflict and confidentiality is clearly broader, or when portfolio use requires prior written consent. And the obligation commonly survives the end of the engagement, so "the project ended" is not a release.

Many portfolio clauses are also conditional on public release: you may use the work only after the client has made it public. Sort any project into one of three rights categories before choosing a treatment:

• Full Rights: display without restriction.
• Conditional Rights: self-promotion only after a stated period or with client approval.
• No Rights: prohibited in any form.

The scoring procedure, project by project

Run this once per restricted project. It takes under two hours for most projects and converts a vague worry into one assigned treatment plus a fallback.

Note where sources disagree on order. Some treat "get permission first" as the golden rule and put it at step one; others treat permission as a step you reach only when sanitizing cannot do the job. I put it at step four on purpose: you cannot frame a useful permission request until you know what the agreement blocks and what you actually want to show. If your field or client relationship makes asking cheap, move it earlier.

The showable bar you cannot sanitize below

A sanitized piece still has to work as a case study, and the sanitization floor sits uncomfortably close to the minimum bar hiring managers expect. Over-redaction does not just weaken a piece; it can drop you below the minimum portfolio size.

The consensus is narrow: most hiring managers expect three to five well-structured case studies, one recruiting firm reports managers look for two to three, and juniors may pass with one or two. Depth beats volume - fewer high-quality projects that show your thinking beat many shallow ones.

What a piece must retain to count: the problem, your role, your approach, and the outcome. A fuller spine adds audience, the decision you made, the deliverable, how you defined the metric, the result, a limitation, and the lesson. "Here is the homepage I designed" is not a case study. If sanitizing strips the role or the outcome, you have produced a gallery, and a gallery does not count toward your three-to-five.

Over-redaction does not just weaken a piece. It can quietly drop you below the minimum portfolio size.

Disclosure lines and delivery mechanics that read as professional

A good disclosure line signals discipline, not evasion, and the field already recognizes a handful of standard phrasings. Use them verbatim and adapt only the descriptors.

On a resume, a bracketed descriptor that names the sector and company size in place of the client is widely understood by hiring managers and reads as professionalism. On a portfolio, a short note that enterprise case studies are available on request due to confidentiality agreements does the same work. For delivery, build on a standard platform - Notion, Webflow, or Squarespace - create a dedicated landing page for confidential work, and lock that page behind a password you share only with specific hiring managers during interviews. One documented treatment shows an approved client logo on the homepage that clicks through to a short note about the project's confidentiality, which is a clean way to acknowledge the work without exposing it.

Resume label:
[Confidential - Fortune 500 Healthcare Technology Company]

Portfolio note:
Access to enterprise case studies is available upon request due to confidentiality agreements.

Permission request to a past client:
I'd like to feature this work in my portfolio. I can:
1) publish it publicly after 30 days,
2) publish an anonymized version now, or
3) keep it private if you prefer.
Please click one option or reply and I'll proceed.

Permission is cheaper than most candidates assume, because the person asking controls the options. Refusals drop when you time the ask to a strong launch or milestone and frame it as a two-option choice with no open-ended negotiation. Get the yes in writing: schedule a short call, show the exact material you want to include, and deliver a simple release form to sign and return, with a copy for the client to keep. A documented anonymous rewrite that got approved needed only four edits - removing the source's name, generic-izing the title, replacing the company with a generic description, and adjusting the challenge so it no longer identified the company. And the blunt reality: most clients do not care, and even those with a no-portfolio right often do not enforce it.

Doing this across a batch of applications is where the work compounds, because each posting wants a slightly different emphasis on the same sanitized project. Refolk writes your resume from your own history and tailors it to each posting, which means the compliant descriptor you settle on gets carried consistently across every application instead of being rewritten by hand each time.

How this goes wrong

The failure modes below are where compliant-looking portfolios breach, and where showable work gets wasted. Each has a concrete check you can run.

• Reading portfolio rights as a blanket yes. A broad clause that does not exclude unreleased work tempts you to show everything. Check: does the clause explicitly carve out confidential or unreleased projects? If not, assume it does not cover them.
• Anonymizing but implying it was paid client work. Anonymization does not create permission. Check: have you labeled a recreated or sample piece as "Sample Project" or "Independent Case Study" rather than passing it off as a paid engagement?
• Relying on blur. It is reversible and reads as careless. Check: can the logo be recovered by de-blurring or from surrounding context? If yes, it is not sanitized.
• Mock data that is inconsistent or unlabeled. Check: is the dummy data realistic and internally consistent, and does the page clearly state it is not the actual data or product?
• Showing work before public release. Even with portfolio rights, displaying unreleased work can expose sensitive information, harm a launch, or mislead the public. Check: has the client actually launched it?
• Forgetting confidentiality survives the contract. "The project ended, so I'm free" is a false positive. Check: does the duration clause end, and has that date passed? Obligations commonly outlive the engagement.
• Over-sanitizing below the showable bar. Stripping role, approach, or outcome leaves a gallery. Check: does the piece still state the problem, your role, your approach, and the outcome?
• Naming the client in a verbal walkthrough. The existence and name restrictions apply in interviews too. Check: can you narrate the project using only process and generic descriptors, with no client name?

Keep the portfolio current and compliant

Treat this as a standing audit, not a one-time cleanup, because agreements expire, projects launch, and permissions arrive. Re-run the score whenever a project's status changes. A piece sitting behind a private link today may become show-as-is the day the client launches; a perpetual NDA may never move. Standard confidentiality duration runs two to three years, so set a reminder at each project's expiry date rather than trusting memory.

Before you publish or send anything, run the checklist.

To calibrate what "showable" looks like at your level, study people who have already solved this in public. Searching for a specific slice of that market - the practitioners who publish depth despite working in restriction-heavy sectors - shows you how far sanitization can go while keeping a piece credible.

The judgement call never fully disappears, but the method makes it fast. Read the agreement, classify the block, pick the treatment, attach the line, and check the bar. Do that per project and your portfolio stays both honest and defensible, even in the fields where nearly three in four workers carry an NDA.