The HQ privacy boundary: aggregate-only exterior views and small-network suppression

What this is

Exterior & Roofing is one of the places in Verinode HQ where the platform's core privacy rule gets the most concrete: HQ sees network aggregates and rankings, never a single franchisee's private business data. Franchisees own their own numbers; HQ sees what a nightly network rollup computes and hands up, never a franchisee's underlying job files, estimates, or invoices directly.

On the Exterior & Roofing page, that rule shows up as three separate guardrails working together:

1. Small-network suppression. When your network only has a small handful of active memberships, HQ hides the per-franchisee tiles entirely, name or no name, because a labeled figure in a very small group can be traced back to a specific membership by elimination.
2. Franchisee-name anonymization. In independent-operator, franchise, and association networks, per-franchisee tiles show a stable anonymized label instead of the membership's real business name, unless your network is explicitly configured as a single enterprise.
3. Network-level encryption of the sensitive figures. The exterior revenue, total revenue, and exterior margin numbers behind this page, along with each franchisee's business name, are protected at rest by an encryption key that belongs to your network alone.

This article walks through all three, what you'll actually see on screen because of them, and how the privacy posture is set for your network.

Where to find it

Exterior & Roofing is not a permanent item in the HQ sidebar. It's folded into Benchmarks as an "Exterior & Roofing" category, and it only appears once at least one membership in your network has logged exterior work. The page itself lives at a stable address, hq.verinode.ai/exterior, and you can navigate there directly whether or not it's currently showing in Benchmarks.

Everything described below applies to every row on that page: the network summary panel at the top, Exterior Book by Franchisee, Retail vs Insurance Mix, Supplement Capture, and Seasonal Concentration.

Guardrail 1: small-network suppression, aggregate-only view

Each of the four per-franchisee rows on Exterior & Roofing is inherently a "one tile per membership" view. Anonymizing a name doesn't fully protect a membership in a very small network: if there are only one or two other memberships it could possibly be, a reader can work out who a tile belongs to just by process of elimination, no matter what label sits on it.

To close that gap, HQ checks your network's active-membership count against a working floor before it ever renders a per-franchisee tile. If your network is running in independent-operator mode and sits below that floor, every per-franchisee row on the page, including Exterior Book by Franchisee and the three rows beneath it, returns empty. In its place, a banner appears above the row stack:

Aggregate-only view. Your network currently has fewer than [a small number of] active operators, so per-franchisee exterior tiles are suppressed to protect operator privacy (small-cohort identification risk). Hero aggregates still surface. Tiles return once the network reaches enough active operators, or change the network data posture in Settings → Group → Data posture.

The wording adapts to whichever surface it's shown on, so on Exterior & Roofing specifically it reads "exterior" where the general version reads "Commercial book," "facility footprint," and so on, since the same guardrail also protects Commercial, Facilities, Fleet, and Equipment.

What still shows even when tiles are suppressed: the network summary panel above the row stack is unaffected. You'll still see the headline count of locations running exterior as a division, the total exterior job count and network-wide revenue share, and the three secondary medians (insurance revenue share, supplement capture, exterior margin). Suppression only removes the individual, per-franchisee tiles; the network's own totals and medians are aggregates by construction and don't carry the same identification risk.

Only independent-operator-type networks are gated this way. A network explicitly configured as a single enterprise (one ownership structure running multiple locations under one hood) is exempt from this floor entirely; there's no separate business to protect from itself, so per-location tiles render regardless of how many locations there are.

Tiles return on their own. As your network's active-membership count grows past the floor, the per-franchisee rows populate automatically on the next load. Nothing needs to be manually turned back on. You can also review or adjust how your network's privacy posture is configured from Settings, under Group, in Data posture.

Guardrail 2: franchisee-name anonymization

Once a network clears the small-network floor and per-franchisee tiles are showing, the second guardrail decides what name appears on each tile. This depends on how your network is configured, not on which page or row you're viewing:

• Independent-operator, franchise, or association networks (the default, safer posture for any network) show an anonymized label on every per-franchisee row: a fixed prefix followed by a short, stable code, for example "Franchisee #A1B2." The code is generated once per membership and stays the same every time you view that membership's tile, so you can track the same anonymized franchisee over time (rising job count, improving supplement capture, and so on) without ever seeing their real business name.
• Single-enterprise networks (one ownership structure, explicitly configured as such) show the real membership name instead. Because there's one underlying business, there's no separate operator identity to protect.

New networks default to the anonymized posture. A network has to be explicitly switched to the single-enterprise configuration to unlock real names on per-location rows; it never happens implicitly just because a network happens to be small or exclusively franchised.

On Exterior & Roofing specifically, this shows up in the Headline field of every tile in Exterior Book by Franchisee and in the equivalent per-franchisee rows below it (Retail vs Insurance Mix, Supplement Capture, Seasonal Concentration). If your network summary panel notes that rows are anonymized, that note is telling you which of the two postures above your network is currently in.

Guardrail 3: network-level encryption of revenue and margin

The figures behind Exterior & Roofing carry different levels of sensitivity, and Verinode treats them differently at rest:

• Exterior revenue, total revenue, and exterior margin percentage are dollar-denominated economics. A specific franchisee's revenue or margin figure is exactly the kind of private business detail HQ is built never to expose outright, so these columns, along with each franchisee's business name, are stored encrypted, protected by an encryption key unique to your network. Nothing downstream of your network's own encryption key can read these values as plain numbers or plain text at rest.
• The percentage and count dimensions that make up the four exterior lenses (insurance revenue share, supplement capture rate, seasonal concentration, exterior job count, whether a membership runs exterior as a division) are lower-sensitivity aggregate figures. They describe a shape or a rate rather than an absolute dollar amount, so they are not separately encrypted the way the underlying dollar figures and the name are.

In practice you won't see anything different because of this guardrail; it operates entirely at rest, and Exterior & Roofing decrypts what it's authorized to show the same way it always has. It's mentioned here because it's part of the same privacy posture as the other two guardrails: even before a figure ever reaches the suppression or anonymization check described above, the raw dollar values and the franchisee's name are already protected under a key that belongs to your network and no one else's.

How the three guardrails fit together

1. 1Encryption protects the raw revenue, margin, and name values at rest, under a key that's specific to your network, before anything is ever read for display.
2. 2Small-network suppression checks your network's active-membership count. Below the floor, in independent-operator mode, every per-franchisee tile on the page is withheld; the network summary panel still shows.
3. 3Name anonymization applies to whatever per-franchisee tiles do render: independent-operator, franchise, and association networks see a stable anonymized code; single-enterprise networks see the real name.

How to use this in practice

• If Exterior Book by Franchisee (or any of the three rows beneath it) is showing an "Aggregate-only view" banner instead of tiles, that's this guardrail working as intended, not a data gap. Check the network summary panel above it: the totals and medians there are still real and current.
• If your tiles show anonymized codes like "Franchisee #A1B2" rather than real names, that's expected for any network running in independent-operator, franchise, or association mode. It is not a display bug, and it does not mean the underlying figures are wrong.
• If you believe your network should be showing real per-location names (because it genuinely is a single ownership structure operating multiple locations, not a franchise or association of independent operators), that's a configuration change under Settings, Group, Data posture, not something that changes automatically based on network size or activity.
• Use the anonymized code consistently over time. Because each membership's code is stable, you can track "Franchisee #A1B2's" exterior job count or margin trend across weeks without ever needing their real name to do it.

Empty states

If your network has too few active memberships in independent-operator mode, you'll see the "Aggregate-only view" banner described above in place of every per-franchisee row on the page, while the network summary panel continues to show real totals and medians (or its own "Awaiting data" placeholders, if the underlying figures haven't been reported yet for a separate reason).

This is distinct from the page's other empty state, where no membership in the network has logged any exterior work at all yet. In that case you won't see a privacy banner; you'll see the plain data-not-here-yet copy ("Exterior & roofing data will appear as franchisees run exterior jobs and their estimates and supplements flow in.") because there's nothing to suppress in the first place.

Related help

• /help/hq-exterior-roofing-overview
• /help/hq-exterior-book-by-franchisee
• /help/hq-exterior-retail-vs-insurance-mix
• /help/hq-exterior-supplement-capture
• /help/hq-network-privacy-boundary