The privacy boundary: why Reports only ever shows aggregates

Reports & Communication lives in the HQ sidebar as Reports, at hq.verinode.ai/reports. It's where your network's quarterly reviews, on-demand reports, surveys, and broadcasts all live in one place, and it's built to a single rule that holds across every row on the page: everything you see is a network-level aggregate, computed from data your franchisees have already agreed to contribute to network rollups. Nothing on this page is a doorway into any one franchisee's private business records.

This article is the through-line for the whole section: where that guarantee comes from, how it's enforced in each of the four surfaces on the page, and the handful of narrower protections (a minimum-respondent floor on survey breakdowns, a read-count proxy instead of a read log on broadcasts) that make it hold even in the corners.

The rule, in one sentence

Every report, every survey result, and every broadcast metric on this page is read through one shared internal data layer that is only able to reach network-level rollup tables. It has no code path into the systems that hold a franchisee's own day-to-day business records, so there's nothing for a Reports page bug or a careless query to accidentally leak. Aggregation isn't a filter applied on the way out; it's the only kind of data this page's read layer is capable of asking for in the first place.

What's on the page, and how each row respects the boundary

The page opens with a hero panel ("Comms · Network reach"), then four rows: Quarterly Reviews, Member Cohort · Compliance · Recruitment, Surveys, and Broadcasts. Each one earns the aggregates-only guarantee a different way.

Quarterly Reviews: five sections, all network-wide

The Quarterly Report deck generates a branded PDF and a companion spreadsheet, board-ready as-is. When you or an admin clicks Generate quarterly review, the generator pulls six network-level snapshots in parallel and assembles them into one document:

| PDF section | What feeds it | |---|---| | Network Health | Your network's composite score out of 100, how many franchisees were active in the last 30 days against your total membership, and the network's median gross margin | | Programs | Preferred-vendor count, national-account carrier count, preferred-TPA count, and network-weighted program adoption | | Margin & Cash | Your network's margin percentile, and a three-bucket cash-runway breakdown: under 30 days, 30-60 days, over 60 days | | Brand & Compliance | The network's certification-current rate, and a franchisee-count-by-cert-type summary | | Recruitment | Top-quartile margin and cycle time across your network, and total location footprint |

Every one of those is a count, a median, a percentile, or a rate computed across the whole network or a defined slice of it, never one franchisee's raw ledger. The spreadsheet companion mirrors the same figures in a tab-per-section workbook, plus a franchisee-by-cert-type compliance matrix, so the detail is exportable without ever adding a franchisee's individual financials to the mix.

The Recruitment section carries one extra safeguard worth knowing: if your network doesn't have enough data to publish a top-quartile margin figure yet, the report doesn't guess or leave a blank. It prints, in substance: "Financial performance figures are provided only in the disclosed Item 19." That's a deliberate nod to franchise-disclosure law, financial-performance figures used for recruitment purposes have their own legal channel (a Franchise Disclosure Document's Item 19), and the report defers to it rather than presenting an unofficial number in its place.

The generated document is stored with the review period it covers; the PDF and spreadsheet themselves aren't kept as separate downloadable files on this record; they're rebuilt and delivered at generation time. Every quarterly review lives in your network's own report history, never visible to any other network.

Member Cohort · Compliance · Recruitment: the same rule, on demand

The second row's three report types, Member Performance, Compliance Audit, and Recruitment Pack, follow the identical pattern: each is a comparison across a group of franchisees or a standard, never a one-to-one exposure of a single franchisee's figures. See Member Cohort, Compliance, and Recruitment Pack reports for what each report type covers in detail.

Surveys: two patterns, two different privacy shapes

Surveys are where the aggregates-only rule gets the most interesting, because HQ can author two structurally different kinds of survey, and they protect franchisee responses in two different ways.

Network Survey (the "hq_to_members" pattern). This is a multi-question pulse HQ sends directly to every active franchisee. Franchisees answer it from their own side of the platform; HQ never has a path to any individual response. What comes back to this page is a per-question aggregate: a response distribution and a total-response count, computed on a schedule after franchisees answer, not read live off individual submissions. HQ is structurally reading a rollup, not a form-response table with names on it.

Team Template (the "hq_template_for_teams" pattern). This is a survey template HQ builds for franchisees to run with their own teams internally. HQ never sees the responses to this one at all, not aggregated, not otherwise, because the responses belong entirely to the franchisee running it with their own staff. The only thing that rolls up to HQ is an adoption count: how many distinct franchisees have cloned and used the template. If three franchisees adopted a template and each ran it with twelve employees, HQ sees "3 franchisees adopted," never sees a single one of those 36 answers.

Opening a survey's detail view shows Pattern A's responses as a per-question aggregate, and Pattern B's tile as an adoption count alongside the question list, with no response data attached at all.

The k-anonymity floor on survey breakdowns

Even for a Network Survey, where HQ is entitled to see the aggregated distribution, there's a second layer of protection underneath: a minimum-respondent floor. If too few franchisees have answered a given question so far, the per-answer breakdown itself stays hidden, even though HQ is otherwise allowed to see aggregates for this survey pattern. Instead of a histogram, the question shows text to this effect:

Response breakdown stays hidden until at least [the floor] operators answer, so individual responses can't be identified. [N] of [the floor] so far.

The response count is still shown (so you know the survey is being answered), but the breakdown, "3 said Strongly Agree, 1 said Disagree", is withheld until enough distinct franchisees have answered that no single response could be worked out from the shape of the distribution. This is the same kind of protection that gates industry benchmark lines elsewhere in HQ: a real number is either shown whole, or not shown at all, never shown in a form thin enough to reverse-engineer who said what.

Broadcasts: one-way, encrypted, read-proxied

Broadcasts are one-way messages HQ sends to every active franchisee; they land directly in each franchisee's own feed. Three protections apply here specifically:

• Only group admins can send one. Anyone who can reach the Reports page can read past broadcasts and their read counts; composing a new broadcast is gated to admin members of your group. The subject and body are both required before a send is accepted.
• Content is encrypted at rest, under a key scoped to your network alone. When your session can decrypt it, the page shows the protected copy; if it can't, the page falls back to the same content held in plain text as a rollout-era safety net, so a broadcast is never simply unreadable. Either way, your broadcast content stays inside your own network; it's never visible to another network's HQ.
• "Read" is a count, never a list. The number shown on each broadcast tile, and the "operators reached" figure in the hero panel above it, is a running counter that ticks up once per franchisee the first time they open that specific broadcast. HQ can see how many franchisees have read a message. HQ cannot see which ones. There is no per-franchisee read state exposed anywhere on this page. See The network reach hero for exactly how that counter behaves.

On send, HQ gets a plain confirmation, "Sent, delivered to N operators," and your other HQ teammates get a notification that a broadcast went out, with a link back to this page. Neither of those surfaces a franchisee identity either, delivery count and teammate notification are both HQ-side bookkeeping, not a window into franchisee behavior.

What admins can do vs. what everyone can read

Every member of your HQ group who can open the Reports page can see all four rows in full: report history, survey results, and broadcast history are visible to any group member, not just admins. Two actions specifically are gated to admin:

1. Generating a report on demand, the "Generate quarterly review" button in the page header, and the equivalent controls in the on-demand report types, only render for admins. Everyone else can browse the report history but can't trigger a new one.
2. Sending a broadcast, the compose action is admin-only. Non-admins can read past broadcasts and their reach numbers, but can't author a new one.

Neither restriction is about privacy between franchisees; it's about which HQ teammates can produce and publish reports and messages on the network's behalf.

Empty states

Before your network has any activity to show, each row reads plainly rather than showing a placeholder chart:

• Hero, with nothing yet: "Reports + broadcasts surface here once you generate or send them. Quarterly reviews auto-generate on the first day of each quarter."
• Quarterly Reviews, with none generated: "Auto-generated on the first day of each quarter at 06:00 UTC. Open the deck to generate one on demand."
• Member Cohort · Compliance · Recruitment, with none generated: "On-demand reports, Member Cohort, Compliance Audit, Recruitment Pack, appear here as you generate them."
• Surveys, with none authored: "No surveys yet."
• Broadcasts, with none sent: "HQ broadcasts to franchisees with read receipts surface here."

None of these states are errors. They're expected for a network that hasn't generated a report or sent a message yet, and every row fills in on its own the first time you act.

Verify it yourself

1. 1Open Reports from the HQ sidebar, or go to hq.verinode.ai/reports directly.
2. 2Notice that every figure on the page, hero counts, quarterly review sections, survey response totals, broadcast read counts, is a number, a percentage, a median, or a count. None of them is a named franchisee's individual dollar figure or job-level detail.
3. 3Open a Network Survey's detail view. If it's freshly sent, at least one question likely shows the respondent-floor message rather than a breakdown, that's the k-anonymity protection working as intended, not a bug.
4. 4Open a Team Template survey's detail view. You'll see the question list and an adoption count, never a single response, because responses to that pattern never leave the franchisee's own side of the platform.

Why this matters

Franchisees contribute data to network rollups so HQ can see the network's shape: how the group is doing on margin, on compliance, on program adoption, on recruitment. That contribution comes with a boundary: franchisees keep their own operator-side data. HQ's job is oversight at the network level, not a window into any one franchisee's day-to-day business. Reports & Communication is built so that boundary holds even where it would be easy to accidentally cross, a survey with too few respondents, a broadcast's read state, a recruitment figure that legally belongs in a different disclosure channel entirely. Verinode surfaces the pattern and the reach; what you do with it, a call to a franchisee, a change to a program, a board update, is a decision for your leadership team, not something the platform decides for you.

Related

• Reports & Communication: how HQ shares intelligence with the network
• The network reach hero: what the top of Reports measures
• Member Cohort, Compliance, and Recruitment Pack reports
• What HQ sees: the network privacy boundary
• The HQ privacy boundary in the Vault
• Generating a quarterly review or on-demand report