Why Our Work Page Has No Logo Wall

Visit almost any agency site and you will find the same strip near the top: a row of greyscale logos under a line like "trusted by". It works because readers cannot check it. A logo might mean a multi-year engagement, a two-week contract, a partner's client, or a free trial someone once signed up for.

Our work page does not have one. That is not modesty and it is not an oversight. We name a client only when that client has approved it in writing, and we built the site so that rule is enforced by the system rather than remembered by whoever is editing the page. Approved clients do appear, in a short strip limited to organisations attached to published work, and a logo is approved separately from the name.

A policy is only as good as its weakest edit

Almost every company has a policy about client confidentiality. The failure mode is rarely bad faith. It is a rushed update, a new team member, a sales deck copied onto the website, or a checkbox that means one thing in the admin panel and something else to the template.

So we asked a narrower question: what would have to go wrong for an unapproved client name to reach the public site? Then we made each of those things require a deliberate act.

Layer one: the database refuses it

The projects table carries a check constraint. A project's client can be marked public only if the name exists and approval has been recorded:

CONSTRAINT ck_projects_client_consent CHECK (
  client_public = 0
  OR (client_approved = 1 AND client_name IS NOT NULL)
)

That is not validation in a form. An UPDATE that tries to publish an unapproved name fails in the database itself, whichever screen, script or person issued it.

Layer two: one gate, allow-list only

Everything the public site knows about clients, projects, media and testimonials passes through a single publication gate. There is no second implementation to drift from it: the content feed does no judging and the pages do no filtering.

• Allow-list, never deny-list. The gate names every field it emits. A column added to the database later is invisible until someone writes a line for it — forgetting means a field does not appear, never that it leaks.
• Each permission is its own decision. A project being public grants nothing else. Client name, logo, website, images, video, metrics, engineering effort and testimonial are eight separate flags, checked where each is used.
• Both sides must agree. A project must be cleared to name its client, and the client's own record must be cleared to be named. Either one saying no is a no.
• Nothing is hidden, only omitted. No CSS or JavaScript conceals anything. If it is not permitted, it is not in the payload, so it is not in the HTML.

Layer three: unapproved media has no URL

Images are where confidentiality usually leaks, because a file that is merely unlinked is still reachable by anyone who guesses or finds its address. Ours are gated physically: a file only gets a public URL once its bytes are moved into the served directory on approval. An unapproved screenshot is not hidden from the page — there is no address at which it exists.

Honest labels for everything else

Not every system we describe is client work, and a reader should not have to guess. Every item on the work page carries a provenance label — client system, partner build, associated company, internal build, reference architecture or concept. The mapping is one-directional: only a record explicitly classified as a client relationship can ever be labelled a client system, so an internal product cannot be presented as a customer engagement by accident.

What it costs, and why we accept it

The cost is real. A page of described systems is less immediately impressive than a wall of recognisable names, and some visitors will leave before reading far enough to judge the work itself.

We think the trade is right for the clients we want. A company that is careful with its clients' names is signalling how it will treat yours — and the businesses that care about that tend to be the ones whose systems matter most.