What HQ can and cannot see about a franchisee's facilities

The boundary in one sentence

HQ's Facilities page (hq.verinode.ai/facilities) reads a nightly, network-level summary of what franchisees have already recorded in their own IQ accounts. It never reads a franchisee's live records, and depending on how your network is configured, it may not even show you which franchisee a number belongs to. This article is the definitive reference for exactly what crosses that line and what does not. For the page layout, tile-by-tile walkthrough, and how-to-use guidance, see Facilities overview and Opening a franchisee's facilities detail card; this article exists to answer one question directly: what am I actually looking at, and what is being withheld from me on purpose.

What HQ sees: the nightly rollup, nothing else

Every franchisee registers their own facilities (locations, square footage, ownership type) and leases (rent, CAM, term dates) inside their own IQ account, the same operator-side platform they use to run their day-to-day business. HQ does not ask them to enter anything twice.

Once a night, a scheduled job reads every franchisee's registered facilities and leases and writes one summary row per franchisee into a network-level table (the network data). That row carries only: facility counts (total and active), owned-versus-leased counts, total square footage, total monthly rent and CAM, lease-expiration counts at the 90-day and 180-day marks, the earliest upcoming lease end date, and a count of open or overdue facility-compliance events. Nothing else about the franchisee's facilities exists in that row, and nothing else is what the Facilities page reads.

Every number on the Facilities page hero, the four franchisee tile rows (Lease Risk, Footprint by Franchisee, Owned vs Leased, Open Facility Compliance), and the per-franchisee detail card comes from that one summary row per franchisee, refreshed overnight. If a franchisee changes a lease term or adds a new location this afternoon, the network view will not reflect it until the next overnight refresh. What you are looking at at any given moment is a snapshot as of last night, not a live query.

What HQ never sees, under any configuration

Regardless of network size, entity model, or scope selection, there is no path from the Facilities page (or the per-franchisee detail card opened from it) to:

• A franchisee's underlying invoices, receipts, or lease contracts as documents.
• Their day-to-day facility management activity: who added a location, who edited a lease term, when.
• Any other private business record: their P&L, their vendor relationships, their job files, their client list. Facilities only ever surfaces facility and lease facts.
• Anything that happened since the last overnight refresh. There is no live tail into a franchisee's account.

This is the trust boundary HQ is built on: franchisees own their data. HQ sees network aggregates, per-franchisee summary numbers, and compliance status, never a franchisee's operational detail underneath those numbers.

The one on-demand exception: peer comparisons

Clicking any franchisee-named tile opens that franchisee's detail card, which computes a live peer comparison (Group / Regional / National scope) at the moment you open it rather than waiting for the next nightly refresh. This is the one place HQ code computes something on demand instead of just reading yesterday's summary table.

Even here, the boundary holds: the comparison returns a peer median, this franchisee's percentile rank within that cohort, and a cohort size, and never a specific peer's raw number. You cannot use the detail card to work out what any other individual franchisee in the comparison is paying in rent or how many locations they run; only the aggregate statistics of the group they belong to. The National-scope comparison on demo networks is built by a narrowly scoped, separately reviewed module that reads facility and lease data across the demo-operator cohort specifically to compute that aggregate; it is engineered to return only medians and cohort sizes, and it carries its own K-anonymity floor (below) on top of the one already enforced for Group scope.

Entity model: whose name and location actually show

Every network is configured, once, with an entity model that governs whether individual franchisees are named at all:

• Same entity, used when every location is part of one legal company (a PE-backed multi-location operator, for example). Real franchisee names and real city/state pass through everywhere: the tile rows, the detail card header, everywhere a franchisee is referenced.
• Independent operators, the default for franchise and association networks. Every franchisee name is replaced with a stable anonymized label, Franchisee #XXXX, built from the last four characters of that franchisee's internal ID. The label is the same every time you see that franchisee, across every tile row and every visit, so you can track a pattern over time without ever being able to map the label back to a business by name. City and state are withheld too: the detail card header shows "Location anonymized" in place of geography.

This setting lives at the network level under Settings, Group, Data posture, and it applies uniformly. There is no per-page or per-user toggle to reveal an underlying identity once the network is set to independent operators; it is a network-wide decision, not a viewer-level one.

Small networks: the whole-network suppression guard

Anonymizing a name is not enough protection on its own in a very small network. If your network has only one or two active franchisees, it takes no real effort to work out which anonymized tile belongs to which business just from the numbers next to it, one franchisee's rent, square footage, and lease dates are distinctive enough to identify them by elimination even with the name hidden.

To close that gap, when a network is in independent-operators mode and has fewer than three active franchisees, every per-franchisee row across all four tile rows (Lease Risk, Footprint by Franchisee, Owned vs Leased, Open Facility Compliance) returns empty, and this banner appears above the row stack in its place:

Aggregate-only view. Your network currently has fewer than three active operators, so per-franchisee facility footprint tiles are suppressed to protect operator privacy (small-cohort identification risk). Hero aggregates still surface. Tiles return once the network reaches 3+ active operators, or change the network data posture in Settings → Group → Data posture.

Two things stay true while this guard is active:

• The hero panel at the top of the page (total facilities, square footage, monthly rent, leases expiring, ownership mix) still shows in full. Only the per-franchisee breakdowns are held back; the network-wide totals are computed from the same summary rows either way, and a total by itself does not identify anyone.
• Networks in the same-entity model bypass this guard entirely. If every location belongs to one legal entity, there is no separate business identity to protect, so per-franchisee tiles show normally regardless of how many locations exist.

The guard lifts automatically once the network reaches three or more active franchisees; there is nothing to request or toggle on your end beyond growing the network or changing the entity model.

The K-anonymity floor on peer comparisons

Separately from the whole-network suppression guard above, every individual peer comparison inside the detail card, at Group, Regional, or National scope, carries its own minimum-cohort requirement before a median or percentile is allowed to render. Below that minimum, the metric tile shows "Cohort too small" instead of a number, and the scope footer reads "Peer cohort too small, need more active franchisees in the network."

Verinode deliberately does not publish the exact peer count behind that floor in the product copy. It is a qualitative confidence signal, not a number designed to be reverse-engineered: if the app told you precisely how many peers you were one franchisee short of, watching that message flip on and off as your network's roster changed would itself leak who joined or left. When a comparison does clear the floor, the footer instead names a confidence tier, High confidence, Directional, or Low confidence, that rises with how many peers actually contributed to the figure, without stating the count.

This floor is independent of, and stricter in spirit than, the whole-network suppression guard above: suppression is a coarse gate on the entire per-franchisee row set, while the K-anonymity floor is a per-metric, per-scope check that can hide one comparison (say, National) while another (Group) still renders, depending on how many peers have usable data for that specific metric.

National benchmarks: demo networks see them, real networks don't yet

The Facilities hero and the detail card's National scope can both show a "vs national median" comparison, an industry-wide reference point rather than just a within-network one. Whether that comparison shows a real number, a "pending" state, or nothing at all depends on one thing: whether your network is a demo/evaluation network or a live, real network.

The underlying industry pipeline for facility metrics (feeding Verinode's benchmark layer from real, anonymized operator contributions across the platform) is not fully seeded yet. Until it is, the only National reference data that exists is built by aggregating across the platform's demo-operator cohort, a stand-in built specifically to preview what the feature looks like once real industry data is flowing.

That distinction is enforced, not cosmetic:

• Demo networks see the demo-cohort-derived National comparison: the "vs national median" line appended to hero tiles, and live medians and percentiles at Regional and National scope in the detail card.
• Real (non-demo) networks never see that demo-derived data dressed up as a real industry number. The hero tiles simply omit the comparison line and stand on their own base text. The detail card's Regional and National scopes show an honest pending state instead: "Regional industry benchmarks pending, facility metrics will seed via the benchmark data in the next slice" (same copy for National, with the word swapped).

This was deliberately hardened so that a real, paying network could never be shown a synthetic number labeled as if it were a genuine cross-industry benchmark. When the real pipeline is seeded, this distinction, and the demo-only module behind it, goes away and every network sees the same live comparison.

Where each control lives

• Entity model (same-entity vs. independent-operators, which drives naming and geo-hiding): Settings, Group, Data posture.
• Small-network suppression: not a toggle, it is a function of your active franchisee count while in independent-operators mode. It lifts automatically at three or more active franchisees.
• K-anonymity floor on peer comparisons: not configurable, it is a fixed protection built into every scope of every peer-comparable metric across HQ, not specific to Facilities.
• Demo vs. real National benchmarks: determined by whether your network is flagged as a demo/evaluation network in Verinode's own account setup, not something you set from the Facilities page.

How to verify the boundary yourself

1. 1Confirm your network's entity model under Settings, Group, Data posture. If it reads independent operators, every franchisee tile you see elsewhere should show Franchisee #XXXX labels, not real business names.
2. 2Open Facilities. If your active franchisee count is below three and you're on independent operators, you should see the aggregate-only banner and no per-franchisee tiles, only hero totals.
3. 3Click into any franchisee tile (once you have three or more active franchisees) and check the scope footer. Group scope should show a confidence tier and, if your network is small enough, "Cohort too small" instead of a fabricated number.
4. 4Toggle to Regional or National scope. On a real, non-demo network, this should read as an honest "pending" state, never a number.

Related articles

• Facilities overview
• Opening a franchisee's facilities detail card
• Network footprint
• Owned vs leased
• Lease risk
• Open facility compliance
• HQ overview
• Network health
• HQ benchmarks
• HQ programs
• HQ standards
• Compliance across the network