The Short Answer

Publish each programme at the level of detail your security or safeguarding lead has cleared, and no lower. That level is decided before anything goes live, on a scale that runs from country to region to type of partner to a named partner. Say on the page that some details are withheld for safety. Then close the other routes the same details travel by: photo metadata, staff profiles, report PDFs and your IATI data. And keep a takedown route that works within the hour, not the week.

Taking a partner's name off the map protects nobody if the same name sits in last year's programme report.

The section checklist tags the where-we-work page Best practice, because no rule requires a map or a partner list. This post is about the publishing controls around that page. The security judgement belongs to the people who hold it.

Who Decides What Is Named

The web team should never be the one deciding whether a partner can be named. It cannot see the risk. A Global Interagency Security Forum summary of its research on partnerships, published in 2020, says that for local and national NGO staff, threats "often overlap between professional and personal lives and are not necessarily visible to international partners". If the international office cannot always see a threat, a communications team in another country cannot be expected to.

So the decision sits with whoever holds security risk management for that context, usually a security or safeguarding lead, and the partner is asked first. The website's job is to make that decision the only way onto the page. Nothing that names a partner, places work below country level or profiles staff in a flagged country goes live without the lead's recorded sign-off. Build it into the publishing workflow, not into someone's memory.

The frameworks NGOs already work to assume the same. The Charter for Change commits signatories to include local actors as spokespeople "when security considerations permit", and a footnote to its transparency commitment reads: "Fully respecting security and not necessarily publishing the names of individual partners in conflict contexts."

FCDO's branding guidance for ODA-funded programmes says that in deciding where and how UK funding is recognised, "consideration should be given to the safety, security and dignity of beneficiaries and staff". It allows an exception where identifying UK support would "endanger the lives, safety and security of the people who benefit from the programme and staff". Note the process attached: implementing partners "must agree exceptions" with their FCDO senior responsible owner. Leaving a funder's logo off a programme page is an agreed, recorded exception. It is not a design choice.

Four Levels of Disclosure

Two questions sit behind every programme on the page: how precisely you place the work, and how precisely you name who does it. Four levels cover most cases.

  1. Country. The country is named, and nothing below it.
  2. Region. A province or district, with no site or village.
  3. Partner type. "Three women-led community organisations", with no names.
  4. Named partner. The organisation by name, with its agreement.

Each programme gets a level for place and a level for partner, recorded in a short register: the programme, both levels, who approved them, the date and the next review. That register is the document the page is built from, and the only one the web team works to.

One technical point decides whether the levels hold. Where a web map draws its pins from data sent to the visitor's browser, anything in that data can be read from the page source, whatever the zoom level or the pin style shows. If the file behind the map holds a village's coordinates, showing the pin at region level has protected nobody. I would hold the map's data itself to the register's level, so a pin can never be more precise than the decision behind it. Generalise the data, not the picture.

Say What You Have Withheld

An absence nobody explains reads as an omission. One line fixes it, placed where the reader meets the gap: in the map's legend and above the partner list. "Some partners and locations are not shown, for their safety."

The same line belongs on partner directories, as what local partners look for on an INGO website sets out. On a map it matters more, because an empty region invites a guess. A funder doing due diligence may need the full picture, so say that it is available on request and send it through the same route as your other sensitive documents.

What Leaks Besides the Map

The map is the page everyone checks. The same details can travel by other routes.

  • Photo metadata. A phone camera with location turned on records where a photo was taken. Apple's personal safety guide says that when such photos are shared, recipients "may be able to access the location metadata and learn where it was taken". Do not assume your platform strips it on upload. Download an image from the live site and read its metadata. Consent and representation for the people in the photo are covered in ethical nonprofit photography.
  • Captions and alt text. A village named in a caption, or in the alt text a screen reader announces, is as public as a village named on the map.
  • Staff profiles. A name, a face, a job title and a country office together can identify someone the programme keeps quiet. The safeguarding page post makes the same call for the safeguarding lead: give the role and a monitored contact, and treat the person's name as a judgement about their safety.
  • Reports and PDFs. Evaluations, programme reports and older annual reports name partners and places. A file's document properties can carry its author's name. Check the file, not only the page that links to it.
  • Old pages and addresses. Past press releases and news stories, and a URL that still contains a partner's name after the page was renamed.

Then the data you publish elsewhere. If your funding agreement requires IATI publishing, your activity files can name partner organisations and describe locations. A redaction on the website means little if the IATI file names the partner, so the two follow the same register.

The standard allows for this. IATI's guidance on excluding data lists working "in sensitive geographical areas" where it "presents a risk to your organisation or staff to publish the exact location of your work" among its reasons, and says that if you exclude data "you must publish an exclusion policy". A location can also be coded as approximate rather than exact (Geographic Exactness codelist).

FCDO's IATI guidelines go further, with examples of adapting data rather than dropping it: "anonymising the implementing (or funding) organisation", "publishing a recipient region (consisting of several countries) instead of a recipient country or location if this is too sensitive" and adapting the activity description. They also say "It is intended that once published, data remains permanently available." Decide first. The open-data page itself, including where the exclusions policy is linked, is covered in publishing IATI data and Charter4Change figures.

When the Context Changes

A level set last year describes last year. The register needs a scheduled review and a set of triggers that bring a programme back to its lead at once: a change in the security situation where it runs, a change in how authorities treat foreign-funded organisations, an incident affecting a partner, a partner's own request and any new page or publication that would name one.

Make one rule explicit. A programme's disclosure can be reduced on the lead's word the same day, without waiting for a meeting. Increasing it waits for the review.

Everything else on the site follows the cycle in content governance for nonprofit websites. The difference here is the clock: these reviews are set by events in a programme country, not by the calendar.

Taking It Down Fast

Picture a partner calling late on a Friday to ask for its name to come down. What happens next should already be written down.

  • Who. At least two people who can unpublish, one of them reachable out of hours, with the security lead's contact beside theirs.
  • What. The page, and every image, PDF and caption carrying the same detail. A file in a media library can keep its own address after the page that linked it has gone, so search the site and its documents for the name.
  • How. The removed address should return a 404 or 410. Google's Removals tool can hide a page from results in the meantime, but a successful request "lasts only about six months", so it is a stopgap. Its "Clear snippet" option deals with an outdated description in results.
  • Elsewhere. If the detail is in IATI data, talk to your funder's programme manager. FCDO's guidelines say data may occasionally need to be "temporarily hidden for reasons of sensitivity".

Copies already made, such as an archive snapshot, a newsletter already sent or a partner's own post, are beyond your reach. That is the strongest argument for deciding before publication rather than after.

Who Owns It

The security or safeguarding lead owns each disclosure level. Communications owns the page and the wording of the line that explains what is withheld. Whoever runs the website owns the mechanics: the map's data, image metadata, the takedown route and a test of all three after any template or platform change. Whoever publishes to IATI keeps the file in step with the register.

A where-we-work page is easy to build and easy to fill. The discipline is in what it leaves out, and in keeping it out everywhere else on the site. The map shows where you work. The register decides what it is safe to show.

Further Reading

What This Post Does Not Cover

This is about publishing: who signs off what appears, how detail is generalised, what else on the site carries the same detail and how to remove it quickly. It is not security advice. Whether a partner, a place or a member of staff can safely be shown is a judgement for your security or safeguarding lead and the partner concerned, and the terms of any funding agreement are for your funder and your own adviser; where this post and your agreement differ, the agreement governs. It describes no incident and no partnership Socialectric has been part of.