The privacy boundary in Recruiting

Why this article exists

Recruiting is the one section of HQ where the audience for a piece of Verinode output is not your own leadership team, it is a prospective franchisee who has never signed anything yet. That raises the bar. Every other HQ surface asks "can HQ see too much of a franchisee's private business," Recruiting asks that question and a second one: "is any of this ever going to leave the building in a PDF and land in a stranger's inbox."

This article documents, mechanism by mechanism, how the entire Recruiting section, the territory map, the prospect pipeline, the recruitment-story stats, the Network Hiring Flow row, and the generated recruitment deck, holds the same boundary: HQ and any prospect who receives a deck see aggregates, top-quartile figures, and medians, never a named franchisee's private financials, and never a data point specific enough to point back at one operator. Read this before you generate a deck, present the territory map to a franchisee advisory council, or explain to a prospect why a page of the deck they received says "Warming up" instead of a number.

Where this shows up

Open Recruiting from the HQ sidebar, at hq.verinode.ai/recruit-grow. Every element the boundary touches lives on that one page:

• The territory map, plotting franchisee locations and open prospects.
• The territory table beneath the map.
• The Take Action tile that generates the recruitment deck.
• The Coverage Gaps, Active Prospects, and Territories rows.
• The Network Hiring Flow row.
• The Financial figures in prospect materials toggle, sitting flat beneath the tile rows.
• The generated recruitment deck itself, a five-page PDF that leaves the page (and, once handed to a prospect, leaves the company).

The four things HQ is protecting

Everything below reduces to four distinct guarantees. Keep these in mind as you read the mechanisms:

1. A franchisee's private financials never appear, named or not, anywhere in Recruiting, unless your franchisor has explicitly opted in for the one regulated exception (margin figures in the deck, covered below), and even then only as a top-quartile aggregate, never a single operator's number.
2. A franchisee's identity is anonymized wherever showing it would let HQ, or a prospect, single one operator out, whether that's a name on a map pin or an office label in a hiring-flow comparison.
3. A precise location is withheld wherever plotting it would re-identify an anonymized operator anyway, because a masked name next to an exact address defeats its own purpose.
4. A thin number is never dressed up as a real one. Below a defensible sample size, Verinode shows a qualitative "warming up" state instead of a statistic, both on the page and in anything generated for a prospect.

Mechanism 1: the territory map, pin colors and what's withheld

The map (the product) plots two kinds of pins, built from getTerritoryMapPayload() in the product: your franchisee locations, read from the network data, and your open prospects, read from the network data. Both reads stay entirely inside core.*. HQ never reaches into a franchisee's private business data (pii.*) to render a single pin on this map.

Operator pins carry the franchisee's directory location_name, and their city and state, purely for pin placement, resolved through a static city-to-coordinates lookup, never a street address or a precise geocode of anything more specific than the city. Whether those fields display at all depends on your network's entity model:

• Same-entity networks see the real location_name, the real city, and the real state on every operator pin.
• Independent-operator networks, the default, see the location name replaced with "Franchisee #XXXX", a short stable code built from the last four hex characters of that operator's account id, and their city and state fields set to null entirely. The map's query explicitly suppresses both together: anonymizing the label while still plotting the operator's exact city would let anyone looking at the map re-identify the franchisee by elimination, since a masked name sitting on a specific dot on the map is not actually masked. So the coordinates are withheld along with the name, not just the label.

Prospect pins are never gated by any of this. A prospect's contact name, city, and state show in full regardless of your network's entity model, because a prospect isn't a franchisee whose business data HQ needs to protect, they're HQ's own inbound lead. The map's code comment states this directly: prospect pins are "HQ's own leads, not franchisee PII."

Pin colors follow the same logic at a glance: teal for an active operator, copper for an invited one, gray for a seeded (pre-loaded, not-yet-invited) one, and steel blue for a prospect at any pipeline stage. Clicking a pin opens a small overlay with the label, city/state (when shown), and a status line, "Operator, active" or "Prospect, negotiating," for example, with nothing else on it, no financial figure ever appears in a pin overlay.

Below the map, a caption reads how many pins were placed and, when relevant, how many were "unplaced (no city/state)" because a directory row or prospect record is missing that field, or because an independent-operator network's franchisee geo was intentionally withheld per the rule above.

The territory table that follows the map (Territory, Population, Market, Active, and a View on map link) never carries a franchisee identity at all, its rows are territory-level counts (population, market-potential score, active-operator count), not per-operator data, so nothing in that table is gated by entity model.

Mechanism 2: the recruitment-story stats, top-quartile and median only

The stats that ride on the Take Action tile, top-quartile margin, the network median margin, and top-quartile cycle time, come from a single Verinode function in , which reads the nightly the network data snapshot. Even though the underlying evidence payload behind that snapshot contains per-franchisee margin and cycle-time figures (it has to, in order to compute a P75), those per-franchisee rows never leave the query function. The function only ever returns:

• A top-quartile average: the mean of every franchisee's figure that clears the above-P75 threshold, computed inside the query and returned as a single number.
• A network median: the network-wide P50, read directly off the aggregate snapshot.

No individual franchisee's margin or cycle time is ever passed to the page, the tile, or the deck. The code comment on this function is explicit that computing the top-quartile average from named-level evidence is safe specifically because the output that ever reaches a screen or a PDF is anonymized before publish: the deck generator sees the exact same aggregated numbers the page does, never the row-level data behind them.

Top-quartile cycle time is computed the same way, except lower is better for cycle time, so the "top quartile" here is the fastest quarter of operators (the shortest cycle times), not the highest values. Either way, what crosses into view is an average across an anonymous cohort, never a single operator's number.

Mechanism 3: office names in Network Hiring Flow

The Network Hiring Flow row shows the network's median time-to-hire across recruiting pipeline stages, mined by getNetworkFlow() in the product, the same aggregator cron that feeds Network Health's Network Flow row. The tiles you see on Recruiting are the network-pooled medians, not broken out by office, so there's no per-office identity to protect on the visible row itself.

The underlying data model does carry a per-office breakdown (used elsewhere, on the full Network Flow drill-in reached from Network Health), and it applies the identical anonymization rule as the map: office names run through anonymizeFranchiseeName(), the same function the territory map uses, so an office cell is labeled with its real name in a same-entity network and with a stable "Franchisee #XXXX" code in an independent-operator network. Office-level rows also carry their own sample floor, an office's median only appears once it has at least five in-order cases behind it; below that, the code drops the cell rather than showing a median built on too few cases to trust. See Network Flow for the full mechanics of that drill-in.

Mechanism 4: the recruitment deck, the artifact that leaves the building

The recruitment deck (the product) is the highest-stakes surface in this section because, unlike everything else on the page, it is downloaded as a PDF and handed directly to someone outside your company. Its own file header states the design goal plainly: "Every number on the deck is the same number Verinode shows existing franchisees about themselves, no marketing inflation." The differentiator your recruitment team is selling is the Verinode-verified attestation: a prospect can trust the figures because a third party computed them from real operator data, not because the franchisor curated them for the pitch.

The deck is five pages, and the privacy posture differs by page:

• Cover: your group's name and the Verinode-verified attestation. No franchisee data at all.
• Footprint: franchisee count, states covered, total locations, and total square footage. These are counts, not statistics, so they're never gated by sample size, a network of 3 franchisees shows "3" exactly as safely as a network of 300 shows "300." No franchisee is named.
• Performance (Verinode-verified): top-quartile gross margin against the network median, top-quartile cycle time, top-quartile operator score, and the composite health score, plus a methodology line naming the franchisee count in the cohort. This page is gated twice over, by the sample floor and by the financials opt-in, both covered below.
• Operator success patterns: average Google rating, reputation composite, certification coverage, and full-stack certification rate, network-wide. Same sample-floor gate as Performance.
• Next steps: three numbered steps toward Discovery Day, including a note that the Federal Trade Commission's Item 19 disclosure obligation is the franchisor's, not Verinode's. No franchisee data.

No individual franchisee name appears anywhere in the deck, on any page, at any network size. The route's own header comment is unambiguous: "Every metric is aggregated / top-quartile / median; no individual franchisee names appear anywhere in the deck." A DOC-1 audit log entry is written every time the deck is generated, recording only the total-franchisee and states-covered counts at generation time, not any per-franchisee detail, for the franchisor's own compliance trail.

The sample-size gate: fewer than 10 active franchisees

Below 10 active franchisees, the Performance and Operator success patterns pages don't print thin numbers, they print a single "Warming up" banner instead, with the copy: "Verinode publishes numerical recruitment stats once the network reaches at least 10 active franchisees so the figures are statistically defensible. Until then this deck describes the network qualitatively. Reach out to the franchisor's recruitment team for an early-network conversation." The Cover, Footprint, and Next steps pages are unaffected, since they carry counts and narrative, not statistics. The Take Action tile on the page mirrors this before you even click Generate, its sub-line reads "Qualitative until 10 active franchisees, N today" so there's no surprise when you open the PDF. Full mechanics, including the trust-label ladder (Warming up, Early signal, Verified, Strong) printed in the deck's own methodology note, live in The warming-up sample floor on recruitment stats.

The financials gate: margin figures need an explicit opt-in

Gross margin is a financial performance representation. For a legally franchised network (the network data.the network rollup = 'franchise'), showing profitability figures to a prospect outside a properly disclosed Item 19 filing is a Federal Trade Commission Franchise Rule question, not something Verinode decides on your behalf. So the top-quartile margin figure, both on the Performance page and in the network-footprint hero's sub-line on the page itself, is withheld by default for franchise-type groups until your HQ admin turns on Financial figures in prospect materials, the toggle sitting flat beneath the Recruiting page's tile rows.

Turning it on requires a confirmation step: "These are financial performance representations. By enabling this you confirm the figures are disclosed in your Item 19 and that you are responsible for FTC Franchise Rule compliance. Verinode surfaces your network data; the disclosure obligation is yours." Non-franchise groups (associations, corporate multi-location enterprises) never see this toggle at all, because the Item 19 obligation it governs doesn't apply to them, their margin figures show freely.

This is a separate gate from the sample floor, and both have to clear before a margin number reaches a prospect. A 40-franchisee network that hasn't opted in still shows no margin figure anywhere prospect-facing, cycle time, operator score, and reputation figures show normally, only margin is withheld. An 8-franchisee network that has opted in still shows no margin figure, because it hasn't cleared the 10-franchisee sample floor yet.

Non-financial figures, footprint, activity, cycle time, certification coverage, reputation, are never gated by this toggle at all, regardless of group type.

What HQ never sees on this page, full stop

Regardless of network size, entity model, or how the financials toggle is set:

• A franchisee's underlying jobs, invoices, or raw financial records. Every read on this page comes from core.* group-level tables, never pii.*.
• A single franchisee's individual margin, cycle time, or operator score. Only the top-quartile average and the network median ever leave the query layer, computed once and returned as aggregates.
• A franchisee's precise city or state, in an independent-operator network, once its name has been anonymized. The two are always withheld together.
• Any franchisee identity at all inside the generated recruitment deck, on any of its five pages, at any network size, above or below the sample floor, with or without the financials toggle on.

Same-entity networks: what's different

If your group's entity_model is same_entity, the map and Network Hiring Flow both pass real names and real geography through unanonymized, because there is no separately owned franchisee to protect from identification, HQ already owns the underlying business at every location. The sample-size floor on recruitment stats and the FTC Item 19 financials gate still apply on their own terms regardless of entity model (a same-entity group is still subject to the sample floor if it's small, and still subject to the Item 19 gate if it's legally structured as a franchise), but the identity-anonymization machinery, the "Franchisee #XXXX" labels and the withheld geo, is bypassed entirely. Verinode sets entity_model at onboarding based on your network's actual legal structure; it is not a self-service toggle on this page.

Best-practice example

Say your network runs as an independent-operator franchise with 14 active franchisees. On the territory map, every operator pin reads "Franchisee #A3F1" or similar, with no city or state attached, while your three open prospects show their real names and cities because they're your own leads, not franchisee data to protect. The Network Hiring Flow row shows a network-pooled median time-to-hire with no office breakdown visible on this page at all. When you generate the recruitment deck, at 14 franchisees you clear the 10-franchisee sample floor, so the Performance and Operator success patterns pages render real top-quartile figures instead of the "Warming up" banner, but if your franchise counsel hasn't yet confirmed your Item 19 discloses those margin figures, the deck still generates in full, it simply omits the margin card until the Financial figures in prospect materials toggle is turned on. At no point in that deck, cleared floor or not, financials toggle on or off, does a specific franchisee's name or business figures appear.

Related reading

• Recruiting & Growth: section overview: the full page layout, every row and empty state on Recruiting.
• The warming-up sample floor on recruitment stats: the full mechanics of the 10-franchisee floor and the trust-label ladder.
• The territory coverage map: the map and territory table in full detail.
• The prospect pipeline: how prospects move through inquired, qualified, negotiating, signed, and dropped.
• Generating the prospect deck: a walkthrough of the deck-generation flow itself.
• HQ's network privacy boundary: the platform-wide picture this article's mechanisms are a specific instance of.
• What HQ sees vs. what stays private: the vendor aggregate boundary: the equivalent boundary article for Vendors, useful as a comparison for how the same discipline applies with a different suppression mechanism (cohort K-anonymity rather than name/geo anonymization).
• Item 19 and financial performance representations: the FTC Franchise Rule requirement behind the financials toggle.
• Discovery Day: the deeper pack the franchisor's team hands a qualified prospect after this deck.

Data sources