Can you put an NDA project on your resume?

Why are data center NDAs suddenly in the news?

In early October 2026, AWS chief Matt Garman announced that Amazon will stop asking government agencies to sign non-disclosure agreements when it negotiates data center deals, backing it with a pledge of more than a billion dollars over five years for community programs. Microsoft had already dropped the practice in March. Both moves followed a real political revolt: New York enacted a one-year permit moratorium while it completes an environmental review, with more than a hundred other local moratoriums under consideration. Governors in Pennsylvania, Delaware and Massachusetts signed executive orders barring NDAs with municipal officials. Researchers found the agreements in at least 25 of 31 Virginia projects surveyed, and records requests turned up 54 signed by Louisiana officials since early 2024.

Here's the part nobody covering the story mentions. Those NDAs didn't only bind county supervisors and assessors — they bound the people who built the halls. Journeyman electricians pulling medium-voltage feeders, controls technicians commissioning switchgear, mechanical engineers sizing chillers for liquid-cooled AI racks, construction superintendents running 600-person sites. All of them signed something before they badged in, and all of them eventually need a CV. The AI build-out is one of the biggest hiring waves in critical facilities work in decades, and a large slice of its workforce can't name a single employer on paper without checking a contract first.

So the industry's transparency problem becomes your writing problem. And I'll say the unpopular thing: the NDA is rarely what's holding your CV back — the habit of hiding behind it is. People sign one agreement and then quietly scrub their whole history down to "worked on confidential infrastructure projects for a major client." That bullet breaches nothing and proves nothing. It strips out the megawatts, the headcount, the standards, the commissioning milestones and the equipment names a recruiter is scanning for, and it leaves an automated screen with almost no keywords to match. The fix isn't more disclosure. It's better description of what you're already free to say.

Can you legally put an NDA project on your resume?

Yes — in nearly every case. A non-disclosure agreement restricts disclosure of specific confidential information: the client's identity, contract values, designs, source code, roadmaps, internal codenames, site security details. It does not erase the two years you spent commissioning switchgear, and it doesn't stop you saying you're a controls engineer who worked on hyperscale builds. Lawyers draw the line between protected information and your own general skill and experience, and that second category belongs to you. Before you assume the worst, read the actual document instead of the folklore around it. Most agreements are narrower than people remember, and many list precisely what's covered — which also tells you what isn't.

As a working rule, these details are usually safe: the sector and rough size of the client, the type of system, your job title and scope, team size and reporting line, project duration, publicly available tools and platforms, recognised standards and certifications, and percentage-based outcomes. These usually aren't: the client's name where the agreement covers it, internal project codenames, proprietary designs or algorithms, unreleased product details, exact contract values, security layouts, and anything about a site that isn't already public. Notice how little of the first list a recruiter would trade away. Scale, stack, role and result is most of what a hiring decision rests on anyway.

When you're genuinely unsure, ask rather than guess — and ask the right person. For contract and consulting work, that's your employer's legal or contracts team, not the client. On cleared programmes, it's your facility security officer. For agency or staffing placements, the account manager who holds the master services agreement usually knows what the client has approved for case studies and CVs, which is often more than you'd expect. Many clients allow a sector descriptor and the project's technical shape while forbidding the name. Get that answer once, in writing if you can, and you can reuse it across every application for years.

How do you describe confidential work without naming the client?

Replace the client's name with a descriptor that carries the same signal: sector, scale and what the thing actually did. "A hyperscale cloud provider's 96 MW campus" tells a recruiter more than most company names would, and it names nobody. The technique is substitution, not deletion — you're trading a proper noun for three or four common nouns that convey credibility. "A top-five global retail bank." "A Series C health-tech platform serving 2 million patients." "A federal civilian agency." "A Tier III colocation operator across four sites." Each one is specific enough to be checkable in an interview and generic enough that it identifies no one in particular.

Then keep the numbers, because the numbers are almost never the secret. Compare these. Before: "Worked on a confidential data center project for a major client." After: "Led electrical commissioning for a 48 MW hyperscale data center build — nine substations, 220 UPS modules and 14 generator sets accepted on schedule across a 16-month programme, with zero recordable incidents over 310,000 site hours." Before: "Delivered a transformation project for an undisclosed customer." After: "Rebuilt order-to-cash for a Fortune 100 industrial manufacturer, cutting invoice cycle time 34% across 11 countries and training 240 users." Same confidentiality, four times the evidence. Nothing in the rewrite names a company, a site or a contract.

Finally, flag the confidentiality once and move on. A single line — "client names withheld under NDA" in your experience header, or "(confidential client)" after the descriptor — reads as professional discretion. Three paragraphs explaining your legal obligations reads as anxiety, and recruiters do notice the difference. If your employer is the named entity and only the end client is covered, list your employer normally and anonymise downstream; that's the cleanest structure and the one parsers handle best. Rebuilding a CV around descriptors rather than logos is fiddly by hand, so it's worth drafting it in a CV builder that lets you rework each bullet until the proof survives the redaction.

What if even the numbers and the job title are classified?

Then describe the function and use ranges. Cleared work has a harder ceiling than commercial NDA work: compartment names, codewords, programme and system names, specific work locations, intelligence targets, sources and methods, and polygraph results all stay off the page — several of those are classified in themselves. What you can normally state is the clearance type and the year of your most recent investigation, the granting body in general terms such as DoD or DoE, your general job functions, and unclassified awards. Where a metric is sensitive, a band like "supported 50+ mission products annually" often clears review when the precise count would not.

Every classified programme contains unclassified functions, and those functions are what hiring managers are buying. Systems engineering. Vulnerability assessment. Risk analysis. Briefing senior leaders. Running a maintenance schedule. Administering networks across air-gapped environments. Write those plainly: "managed secure communications networks for a federal client," "conducted vulnerability assessments on classified systems," "produced multi-agency intelligence products for a general-officer audience." Name the unclassified tools you genuinely used — Palantir, Analyst's Notebook, ArcGIS, Splunk, Linux, Python — because those are the keywords a cleared-role screen actually matches on. One trap worth naming: never confirm a detail just because it has leaked publicly. Your CV shouldn't be the second source.

Two habits protect you. First, have your facility security officer review the draft before it leaves your hands; they do this routinely and it costs you a day. Second, keep two versions. Clearance level and investigation date belong on a CV sent directly to a defence employer or a cleared recruiter, not on a public profile anyone can scrape. The same split works in cybersecurity, where incident write-ups have to survive both an NDA and a disclosure policy — if that's your field, there's a cybersecurity CV builder built around exactly that problem, putting certifications and your real tooling up front where screeners look.

Will an NDA-heavy CV still pass the ATS?

The applicant tracking system doesn't care who your client was — it cares which words from the job ad appear in your file. That's precisely why NDA-scrubbed CVs underperform: when people redact, they don't just remove the client name, they flatten the whole sentence into abstractions. "Supported critical infrastructure for a confidential customer" contains no matchable noun. The job ad, meanwhile, asks for switchgear, UPS and battery strings, PDU and RPP, ATS, generators, CRAC units, chillers, raised floor, DCIM, BMS, lockout/tagout and arc-flash awareness. None of those terms are confidential. They're in every posting on the market, and leaving them out costs you the screen entirely.

So treat keyword repair as a separate pass. Go through the posting, list the equipment, standards, software and certifications it names, then check each one against your own history and your agreement. Almost all of them will be generic industry vocabulary you're free to use. Put them in two places: a short skills block near the top with the real stack, and inside the bullets where you actually did the work, because a bare keyword list without context reads as padding to a human. Add shift patterns, site counts, uptime tiers and headcount. Those details carry scale without identifying a single facility or client.

Before you send it, read the file the way a parser does. Single column, no text boxes, no icons, consistent date formats, real headings — a two-column template will scramble a descriptor-heavy CV faster than a plain one, because the context a reader needs to interpret "a hyperscale operator" gets separated from the bullet it belongs to. Then get a second opinion that isn't a friend being kind. A free CV analysis returns a score out of 100 with separate marks for impact and ownership, clarity and structure, and ATS compatibility, plus a visual layout check; paste the job description and it lists the skills the ad wants and yours doesn't show. That's where redaction damage shows up as a number.

Frequently asked questions