Privacy on Materials: k-anonymity and franchisee anonymization

Why Materials has its own privacy article

Materials reads what your network pays for the physical goods that go into a job (drywall, paint, fasteners, lumber, roofing, and the rest of the material families) and rolls it up into a single network view: a per-unit median price, set beside the cohort your locations are compared against, with the dollarized savings opportunity attached. See hq-materials-overview for the full tour of that page.

None of that is useful, or safe, unless leadership can trust that a number never resolves back to one location's private purchasing. This article documents exactly how that trust is enforced on Materials: which rows get held back, when the per-material location breakdown stays withheld, how franchisee names are anonymized, and what changes if your network is configured differently. Read it before you present a Materials number in an ops review or a franchisee advisory council, so you know exactly what you are, and are not, looking at.

The two network data postures

Every HQ group is configured with one of two data postures, stored once on the group record and changed only from Settings:

• Independent operators. The default, and the safer posture. Each location is a separately owned and operated business that shares your brand, your standards, and a data pipeline into HQ. This is the standard franchise, association, co-op, or PE roll-up model: locations are franchisees, not company branches. Everything described in this article, cohort suppression, the location-drill floor, name anonymization, applies under this posture.
• Same entity. The group is a single legal entity operating multiple company-owned locations under one tax ID. There is no separately owned franchisee to protect from identification, so HQ sees the network's own data in full: names, raw per-location prices, everything.

Find and change this setting at hq.verinode.ai/settings, on the Network tile (labeled "Identity & Visibility" with the subtext "Name, branding, what peers see"). Inside it, the Data posture panel presents both options side by side:

• Independent operators, tagged "Default, privacy-safe": "Franchise networks, associations, co-ops, PE roll-ups. Each operator is a separate legal entity. Per-franchisee rows render as Franchisee #XXXX, city/state/contact email hidden. Aggregate metrics still flow."
• Same entity, tagged "Enterprise multi-location": "One tax ID across all locations. HQ sees the network's own data, franchisee names, city/state, contact email all surface raw. Suitable for restoration companies operating multiple offices under one parent entity."

Only admins can change this. Selecting an option and pressing Save shows a confirmation toast ("Switched to same-entity (raw drill enabled)" or "Switched to independent-operators (drill anonymized)") and every HQ page that reads per-franchisee data, Materials included, re-renders under the new posture on its next load.

Per-material suppression: the cohort floor

Materials is built from a nightly rollup, one row per canonical material, that Verinode computes from your locations' connected supplier invoice data. Before that rollup ever reaches the page, one rule runs first: a material's row only appears once enough of your locations are buying it. A material purchased by only one location, or by too small a handful, is dropped from the rollup entirely rather than shown at a thin, easily-attributed cohort. Showing a price tied to a near-single-location group would be the same as showing that one location's own purchasing by elimination, so Verinode suppresses the row itself, not just a name on it.

This suppression happens once, upstream, and it shapes every row on the page:

• Top opportunities only ever lists materials that cleared the floor. A material below it never appears here even if the gap versus cohort would otherwise be large.
• Spend by family rolls up only the materials that cleared the floor. A family whose only purchases come from a single location won't show a spend total built from that purchase; it either rolls into what's visible from other, qualifying materials in the same family or doesn't appear at all.
• All materials is the same filtered list, just presented in full rather than top-six. A suppressed material is not a blank row here, it is not a row at all.

There's no counter or banner on the desktop Materials page telling you how many materials are currently held back this way. On the HQ mobile network view, a footer note can appear at the bottom of the materials list letting you know that some materials are being withheld until enough of your locations are buying them for a network price to be shown safely. Either way, the correct read is the same: an empty or thinner-than-expected Materials page is not a broken page, and a missing material is not evidence that nothing is being purchased. It means too few locations are buying it to safely publish a price. As more locations pick up that material, in your own connected invoice data or as new locations join and start buying it, the row clears the floor on its own and appears in the next rollup. No action is required on your end.

The per-material location drill: withheld for small networks

Underneath the material-level rollup, Verinode also computes, for every material that clears the cohort floor, which of your locations are paying the most for that specific item, ranked highest price first. This is a deeper, more granular breakdown than the network median shown on the page: instead of one number for the whole network, it is one row per location.

That breakdown is held to its own, stricter floor, separate from the per-material cohort floor above. A location-by-location list, even with names removed, is inherently more identifying than a single network number: if your network only has a couple of active locations, a "top locations paying above cohort" list is functionally a list of your locations, full stop, no matter how it's labeled. So this breakdown is withheld in its entirety, for every material, until your network has enough active locations overall for a location-level list to mean something other than "everyone." Below that network-size floor, this deeper breakdown returns nothing at all rather than a list that would only ever contain one or two entries.

This protection is part of how Materials is built to scale safely as networks grow. Once your network clears the floor, the location-level view exists to eventually surface directly on the Materials page (or its future drill-in), always under the same name-anonymization rules described next; below the floor, there is nothing to show, by design, not a bug or a missing feature.

Franchisee name anonymization

Wherever a per-location row does surface on HQ, in Materials or anywhere else, franchisee identity is handled the same way. In an independent operators network, a franchisee's real business name never appears on an aggregate or drill-in row. Instead, each location renders as a stable, anonymized label in the form Franchisee #XXXX, four characters drawn from that location's own account identifier, consistent every time that same location appears anywhere on HQ. City, state, and contact email are hidden alongside the name.

In a same entity network, this anonymization is skipped entirely: since there is no separately owned business to protect, franchisee names, city, state, and contact email all surface raw, because it is HQ's own company data being reviewed, not a franchisee's.

What HQ never sees on Materials, full stop

Regardless of network size or how close a material sits to clearing a floor, HQ's Materials page never shows, and never has a code path to show, in an independent operators network:

• Any single location's raw supplier invoices, line items, or purchase history. Every figure is a rolled-up median or a dollar total across the network.
• A material's price when too few locations buy it to protect any one location from being identified by elimination.
• A location-by-location price breakdown for any material, until the network as a whole is large enough that the breakdown wouldn't simply be a roster.
• A franchisee's real name, city, state, or contact email attached to any Materials row.
• The cross-network cohort behind any comparison. The cohort median your network is measured against is a single anonymized reference number computed from operators outside your own network, filtered the same way, with the same minimum-contributor protection that guards every peer benchmark on the platform. You get one price, never a name, never a count of who's behind it.

How to use this

1. 1Treat a missing material or a thinner-than-expected page as a data-maturity signal, not a failure. Ask whether more locations need to connect invoice data, not whether Verinode "lost" a material.
2. 2Never assume a network median or a savings-opportunity dollar figure points at one location. It is built across every qualifying location; no single location's number is recoverable from it.
3. 3If you administer a company-owned, single-tax-ID network, confirm your data posture is actually set to "Same entity" in Settings → Network → Data posture, so you're not seeing anonymized labels for locations that are, in fact, your own company's branches.
4. 4If you administer an independent franchise or association network, leave the posture on "Independent operators." That is the default for a reason, and it is what makes every number on this page safe to bring back to a franchisee advisory council.

Related reading

• hq-materials-overview, the full tour of the Materials page itself: the hero, Top opportunities, Spend by family, and All materials rows.
• hq-vendors-privacy-boundary, the closest sibling article, covering the same cohort-floor and anonymization discipline on the Vendors page in more depth, including the documented PII-read carve-out for aggregated team ratings.
• hq-network-privacy-boundary, the platform-wide version of this boundary: how HQ's database role is structurally prevented from ever querying a location's private business data.
• hq-benchmark-coverage-and-anonymity, the same minimum-cohort discipline applied to network benchmark comparisons.
• hq-overview, orientation to the full HQ sidebar and what HQ is and isn't.

Data sources