Watermark Creator Portfolio Images Before Public Display While Keeping Originals Private

Short answer: Keep original creator portfolio images private, moderate them first, then publish a watermarked derivative with a separate access policy. A health app that displays creator portfolio images has two separate obligations: moderate the upload and protect the source file. The practical choice is to keep the original in a private store, run moderation before publication, and generate a watermarked derivative only after the decision is recorded. That ordering limits accidental disclosure and makes a failed transform recoverable. The watermark is a presentation control, not a moderation