What HQ sees on Fleet, and what stays private to the franchisee

Why this article exists

Fleet is one of the pages where HQ leadership can look genuinely deep into a franchisee's operation: vehicle counts, insurance premium, accident history, driver compliance. That depth only works, and only stays trustworthy, because Verinode enforces a strict boundary underneath it. This article documents that boundary on Fleet specifically: what gets anonymized, what gets suppressed entirely, what geography HQ can and cannot see, and how the peer comparisons inside a franchisee's detail slider protect against being reverse-engineered in a small network.

Read Fleet: your network's vehicles at a glance first for the full page tour. This article goes one layer deeper into the mechanics that page only summarizes.

The four protections, in one place

Fleet applies the same four privacy mechanics every per-franchisee HQ view uses (Commercial, Facilities, Fleet, Equipment, and the Network drill-in). All four are driven by one setting on your HQ account, Data posture, found under Settings → Group → Data posture, plus one fixed floor Verinode enforces regardless of that setting:

1. Entity-model name anonymization. In an independent-operator network, a franchisee's real name never appears; it's replaced with a stable label like "Franchisee #A1B2."
2. The small-network suppression. In an independent-operator network with too few active franchisees, the per-franchisee rows are hidden entirely, not just anonymized, and a disclosure banner explains why.
3. Geography hidden unless same-entity. City and state are only shown when your network is configured as one legal entity operating multiple locations. Independent-operator networks never see a franchisee's location, anonymized or otherwise.
4. The k-anonymity floor on peer comparisons. Inside a franchisee's Fleet detail, a comparison against Group, Regional, or National peers only ever renders once enough peer franchisees sit behind it. Below that floor, the comparison is withheld, not shown against a thin or unreliable sample.

The rest of this article walks through each one as it behaves specifically on Fleet.

1. Entity-model name anonymization

Every HQ group has an entity model, set once under Settings → Group → Data posture, with two options:

• Independent operators. Tagged "Default · privacy-safe" in Settings, and the posture every new HQ group starts on. Use this for a franchise network, an association, a co-op, or a PE roll-up where each franchisee is a separate legal business. On Fleet, every franchisee's name is replaced with a stable label in the form "Franchisee #XXXX" (for example, "Franchisee #A1B2"), derived from that franchisee's internal account ID.
• Same entity. Tagged "Enterprise multi-location" in Settings. Use this only when every location shares one tax ID, meaning your business operates multiple offices under a single legal entity rather than franchising to separate owners. On Fleet, franchisee (location) names surface as entered.

The label is stable, not randomized per page load. The same franchisee gets the same "Franchisee #XXXX" everywhere it appears on Fleet, in the hero's franchisee-count context, in every risk row tile, in the Fleet by Franchisee roster, and inside that franchisee's own detail slider. That consistency is deliberate: it lets you track one franchisee's fleet posture over time, or notice the same label showing up across Insurance Risk, Compliance & Driver Risk, and Accidents in the same review cycle, without the label ever revealing which real business it is.

Switching entity model is an account-level decision, not a per-page toggle. It requires admin access, and Verinode surfaces a confirmation toast on save ("Switched to independent-operators (drill anonymized)" or "Switched to same-entity (raw drill enabled)") because it changes what every operator-facing HQ page shows on its very next render, not just Fleet.

2. The small-network suppression

Anonymizing a name is not, by itself, enough protection in a very small network. If an independent-operator network has only one or two active franchisees, a single tile's vehicle count, premium, or accident history can identify that franchisee by elimination, "Franchisee #A1B2" or not, because there's nowhere else the numbers could belong.

To close that gap, Verinode applies a second, harder floor: in an independent-operator network with fewer than three active franchisees, every per-franchisee row on Fleet is suppressed entirely, not anonymized, emptied. That covers Insurance Risk, Compliance & Driver Risk, Accidents, and Fleet by Franchisee, all four. In place of the rows, a disclosure banner appears (verbatim):

Aggregate-only view. Your network currently has fewer than three active operators, so per-franchisee fleet posture tiles are suppressed to protect operator privacy (small-cohort identification risk). Hero aggregates still surface. Tiles return once the network reaches 3+ active operators, or change the network data posture in Settings → Group → Data posture.

Two things stay true while that banner is showing:

• The hero panel keeps reporting real network totals the whole time. Active vehicles, total mileage, annual premium, and policies expiring in 90 days are all sums or weighted averages across the whole network, they don't identify any one franchisee, so they never get suppressed by this guard.
• Same-entity networks bypass this guard entirely. There's no separate franchisee identity to protect when every location belongs to the same company, so a same-entity network sees its per-location rows regardless of how many locations it has.

The suppression lifts the moment your network reaches enough active franchisees for a per-franchisee row to no longer single one out by elimination. It is not something an admin can override at will from a per-page setting, the only two ways it changes are the network genuinely growing past the floor, or switching entity model to same-entity if that reflects the network's actual legal structure.

3. Geography hidden unless same-entity

City and state are a second identifying signal, one that's independent of a franchisee's name. A location alone can narrow "which franchisee is this" down to one or two candidates in a lot of networks, even with the name anonymized.

Because of that, Fleet applies a separate rule to geography: a franchisee's city and state only ever surface when your network is configured as same-entity. In an independent-operator network, city and state are not anonymized to a placeholder, they are omitted outright, in every place Fleet would otherwise show them. That includes the header of a franchisee's Fleet detail slider, which under same-entity shows the franchisee's real city and state alongside its name, and under independent-operators shows neither: the location fields simply aren't part of what the slider renders.

This mirrors the anonymization rule but is stricter: name anonymization gives you a stable substitute label to work with ("Franchisee #A1B2"). Geography under independent-operators gives you nothing to substitute, it's withheld, full stop, because there is no privacy-safe stand-in for a franchisee's actual city that would still be useful information.

4. The k-anonymity floor on peer comparisons

Inside any franchisee's Fleet detail (opened by clicking any tile on any Fleet row), a scope switcher lets you compare that franchisee's fleet shape, safety record, and compliance posture against peers at three scopes: Group (the rest of your own network), Regional (peers in the same state, across networks), or National (peers everywhere, across networks). Every one of those comparisons carries its own floor: it only renders once there are enough peer franchisees behind it that showing a median wouldn't, in effect, expose one specific peer's data by narrowing the comparison down to a cohort of one or two.

Qualitatively, this works the same way at every scope:

• Too few peers behind a scope and that scope is disabled in the switcher, with a short explanation of what's missing rather than a blank or broken comparison.
• Enough peers, but not a deep bench, and the comparison renders with a lower confidence label attached, so you can read the median as directional rather than as a settled fact.
• A healthy peer bench and the comparison renders at full confidence.

Verinode does not publish the exact peer-count thresholds behind these tiers anywhere in the product, by design, disclosing the precise cutoff would hand a way to reason backward from "this scope just became available" to "the network must have exactly this many peers now." What you see instead is qualitative: a scope is either comparable or it isn't yet, and if it is, the confidence label tells you how much weight to put on the number.

Group scope is the fully live comparison today for every HQ network: your franchisee's own numbers against the rest of your own network's franchisees. Regional and National scope are still being seeded platform-wide behind the scenes; until real cross-network fleet data has matured enough at those scopes, the detail slider's scope footer explains that those industry benchmarks are pending rather than showing a placeholder number.

How the four protections interact on one page

It's worth seeing all four side by side, because they don't all trigger on the same condition:

| Protection | Triggers on | What it hides | Bypassed by | |---|---|---|---| | Name anonymization | Independent-operator entity model | Franchisee's real name → "Franchisee #XXXX" | Same-entity entity model | | Small-network suppression | Independent-operator model + fewer than 3 active franchisees | All four per-franchisee rows, entirely | Network growing past the floor, or same-entity model | | Geography hidden | Independent-operator entity model | City, state (no anonymized substitute) | Same-entity entity model | | K-anonymity peer floor | Any scope (Group, Regional, National) with too few peers behind it | That scope's comparison in the detail slider | The peer pool at that scope growing large enough |

Name anonymization and geography hiding are both entity-model-driven and apply the moment your network is independent-operator, at any network size. The small-network suppression is the one that's also size-dependent: it's the extra floor that exists specifically because name anonymization alone doesn't protect a network of one or two. The k-anonymity peer floor is different again, it lives inside the drill-in, not the row stack, and it protects the peer being compared against, not the franchisee being viewed.

Where this shows up in the UI

• Fleet page, hq.verinode.ai/fleet: the hero panel's summary line appends "Franchisee rows are anonymized (independent-operator network)" when applicable. See The network fleet hero.
• Insurance Risk, Compliance & Driver Risk, Accidents rows: each tile's headline is the (possibly anonymized) franchisee name; all three rows go empty together under the small-network suppression banner.
• Fleet by Franchisee row: the full roster, same anonymization and suppression rules. See Fleet by Franchisee for the tile-by-tile breakdown.
• Franchisee Fleet detail slider: header shows city/state only under same-entity; the scope switcher pills (Group, Regional, National) show or hide based on the k-anonymity floor at each scope.
• Settings → Group → Data posture: where entity model is set. Two options, "Independent operators" (default, tagged privacy-safe) and "Same entity" (tagged enterprise multi-location), each with its own description of what surfaces raw versus anonymized.

Frequently misread as a bug

• "The Fleet page is empty for my network." Check whether you're in independent-operator mode with fewer than three active franchisees first, that's the small-network suppression banner, not missing data. The hero above it is still real.
• "I can't see Regional or National comparisons in a franchisee's detail." Two possible reasons: either Verinode's Regional/National fleet benchmark data hasn't seeded for your network's peer pool yet platform-wide, or the peer pool at that scope is currently too thin to publish a comparison. Both read the same way in the UI, a disabled scope with a short explanation.
• "A franchisee's city and state aren't showing in the detail slider." That's expected under independent-operators. Geography is withheld outright at that entity model, it isn't anonymized to a placeholder the way names are.
• "Franchisee names look like real names, not anonymized codes." Your network is configured as same-entity under Settings → Group → Data posture. That's appropriate if every location genuinely shares one tax ID; if it doesn't, that's a setting to revisit with an admin.

Why the boundary exists

Franchisees own their vehicle, insurance, driver, and accident records. They enter that data into their own Verinode IQ account, not into HQ. HQ's database role has no path to query a franchisee's underlying PII records, individual VINs, maintenance logs, or insurance documents directly, ever. What HQ reads is a nightly, franchisee-level rollup written by a background aggregation job, and every protection in this article governs how that rollup, and the peer comparisons built on top of it, gets presented back to HQ leadership. The boundary is what makes the network numbers worth showing at all: franchisees keep ownership and privacy over their own records, and HQ still gets the aggregate, risk-flagged picture it needs to run the network.

Related help articles

• Fleet: your network's vehicles at a glance for the full page tour this article assumes
• The network fleet hero for how the always-visible aggregate totals are built
• Fleet by Franchisee for the full roster row's anonymization and suppression behavior tile by tile
• HQ overview for how Assets (Facilities, Fleet, Equipment) fits into the rest of HQ
• Network Health for the cross-network rollup Fleet risk rows feed into
• Benchmarks at HQ for how peer comparisons work outside the Assets cluster

Data sources