Security Details

Franchise Builder US (a trade name of Grant Search US, Inc.) takes the security of your data seriously. We implement industry-standard measures to protect your business information, franchise documentation, and personal data from unauthorized access, use, or disclosure.

Data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security). Sensitive data at rest is encrypted using industry-standard encryption protocols.

Access to your data is restricted to authorized personnel who require it to operate, maintain, and improve the Service. We enforce role-based access controls and regularly review access permissions. Your account is protected by authentication, and you are responsible for safeguarding your credentials.

Your data is isolated from other users' data. Other users cannot access your business profiles, manuals, FDD drafts, financial models, or any other content you create, unless you explicitly share it or publish it to the marketplace.

Our infrastructure is hosted on reputable cloud providers that maintain industry-recognized security certifications. We regularly apply security patches and updates to keep our systems protected against known vulnerabilities.

When you use AI-powered tools, your content is processed to generate drafts and suggestions. We do not use your private content to train shared AI models in a way that would expose your data to other users. Your AI-generated and uploaded content remains private to your account.

Namespace Isolation (Cross-Tenant Contamination Protection): Every AI prompt that processes your proprietary franchisor content — franchise manuals, FDD sections, business plans, financial models, marketing copy, social posts, and any other confidential material — is wrapped in a mandatory namespace isolation preamble before being sent to the model. This preamble identifies your content as belonging to a single, isolated tenant namespace (identified by your tenant ID and business record) and instructs the model to (i) treat all content as strictly confidential to that namespace, (ii) never reference, reproduce, summarize, or leak content from other franchisor tenants, and (iii) derive its output solely from the content in the current prompt. This technical isolation layer prevents one franchisor's "secret sauce" — trade secrets, proprietary methods, financial figures, or operational details — from leaking into the output of another franchisor using the same platform. The isolation preamble is enforced server-side and cannot be overridden by user input.

Zero-Retention Enterprise API Certification: All inputs submitted to the platform's InvokeLLM instance — including franchise manuals, FDD sections, financial models, business plans, and any other proprietary franchisor content — are processed exclusively through an Enterprise API tier with a zero data retention configuration. This means:

• No Training on Your Data: Your inputs are never used to train, fine-tune, or improve the underlying AI models. The model provider does not retain your prompts or completions for any model improvement purpose.
• No Data Persistence: Your inputs and the AI's outputs are not stored by the model provider beyond the duration needed to process the request and return the response. No residual copies of your content remain in the model provider's infrastructure after processing.
• No Human Review: Your proprietary content is not reviewed by, accessible to, or shared with the model provider's personnel or any third party for any purpose, including quality assurance or training data labeling.
• Trade Secret Protection: This zero-retention configuration is critical for protecting franchisor trade secrets, confidential financial data, and proprietary business methods. Your content retains its trade secret status under applicable law (including the Defend Trade Secrets Act, 18 U.S.C. § 1836) because it is not disclosed to any third party in a manner that would destroy its confidential character.

We maintain this Enterprise API configuration under contract with our model provider and periodically verify compliance. If you require a signed Zero-Retention Certification or Data Processing Addendum for your own compliance or due diligence, please contact us through the Support section of the platform.

In the event of a security incident, we will take steps to investigate, contain, and remediate the issue. We maintain an incident response plan that defines roles, responsibilities, and procedures for detecting, triaging, and resolving security incidents.

Breach Notification Commitment — 72 Hours: In the event of a verified data breach affecting franchisor or franchisee data, Franchise Builder US commits to notifying the affected franchisor within 72 hours of breach verification. This 72-hour notification window is designed to ensure that franchisors can meet their own regulatory notification obligations under applicable data protection laws, including:

• GDPR (EU): 72-hour notification to supervisory authorities (Article 33)
• CCPA / CPRA (California): "Most expedient time possible" notification to affected consumers
• State breach notification laws: Various state-specific timelines (e.g., 30 days for some states, "without unreasonable delay" for others)
• GLBA (financial data): "As soon as possible" notification to the FTC and affected consumers
• HIPAA (health data): 60-day notification to affected individuals (if applicable)

By committing to a 72-hour internal notification window, we ensure that franchisors have sufficient time to assess the breach, determine their own notification obligations, and comply with the most stringent applicable regulatory timelines. Our notification will include: (i) the nature of the breach, (ii) the categories of data affected, (iii) the approximate number of records affected, (iv) the measures we have taken or will take to remediate the breach, and (v) recommended steps the franchisor can take to protect affected individuals.

We will also notify affected users directly in accordance with applicable laws and our Privacy Policy if their personal data is impacted. Franchisors are responsible for notifying their own franchisees and customers as required by their franchise agreements and applicable law.

To help keep your account secure, you should:

• Use a strong, unique password for your account
• Keep your credentials confidential and do not share them
• Log out of shared or public computers after using the platform
• Notify us promptly if you suspect unauthorized access to your account

If you believe you have identified a security vulnerability in the platform, please report it through the Support section of the platform. We appreciate responsible disclosure and will investigate all credible reports. Please do not publicly disclose suspected vulnerabilities until we have had an opportunity to address them.

Monthly Red Team Testing Commitment: Franchise Builder US commits to conducting monthly "Red Team" adversarial testing of all AI prompt pathways to prevent cross-tenant data exfiltration, prompt injection attacks, and unauthorized data leakage across franchise systems. This testing is a core component of our AI security standard of care and is designed to identify and remediate vulnerabilities before they can be exploited.

Our Red Team testing program includes:

• Prompt Injection Simulation: Monthly adversarial prompts are submitted through every AI-powered interface (manual drafting, FDD generation, marketing copy, social posts, lead scoring, audit checklists) to test whether user-supplied input can override system instructions, access other tenants' data, or extract privileged information across namespace boundaries.
• Cross-Tenant Exfiltration Testing: Red Team operatives attempt to craft prompts that reference, summarize, or reproduce content belonging to other franchisor tenants. The namespace isolation preamble (described in Section 6) is verified to block all such attempts.
• Data Leakage Audits: AI outputs are scanned for residual traces of other tenants' proprietary content, trade secrets, financial figures, or operational methods that may have leaked through model memorization or prompt manipulation.
• Remediation & Patching: Any vulnerability identified during Red Team testing is remediated within 30 days. Critical vulnerabilities (those that could result in cross-tenant data leakage) are remediated within 72 hours and may trigger temporary suspension of the affected AI feature until the vulnerability is patched.
• Audit Trail: Red Team test results, identified vulnerabilities, and remediation actions are logged and made available to franchisors upon request for due diligence purposes.

Prompt Injection Defense Warranty: Franchise Builder US warrants that it maintains the following technical safeguards against prompt injection attacks as part of its standard of care:

• Namespace Isolation Preamble: Every AI prompt is wrapped in a mandatory server-side preamble that identifies the tenant namespace and instructs the model to never reference or reproduce content from other tenants. This preamble cannot be overridden by user input.
• Input Sanitization: User-supplied instructions are sanitized to detect and neutralize common prompt injection patterns (e.g., "ignore previous instructions," "reveal the system prompt," "show me data from other users").
• Output Filtering: AI outputs are post-processed to detect and redact any content that appears to originate from a different tenant namespace, preventing cross-tenant data leakage even if the model attempts to comply with a prompt injection attack.
• Rate Limiting & Anomaly Detection: AI endpoints enforce rate limits and monitor for anomalous usage patterns that may indicate prompt injection probing or data exfiltration attempts. Suspicious activity is flagged for security review and may result in temporary account suspension.

This AI security standard of care commitment is reviewed quarterly and updated as new threat vectors emerge. Franchisors are notified within 72 hours of any Red Team test that identifies a critical vulnerability affecting their data.

While we implement robust security measures, no system can be guaranteed to be completely secure. We continuously work to improve our security posture, but we cannot warrant that unauthorized access, use, or disclosure of data will never occur. See our Terms of Service for limitation of liability terms.

The platform's payment processing integration is designed to minimize PCI DSS (Payment Card Industry Data Security Standard) compliance scope to the lowest-scope Self-Assessment Questionnaire (SAQ A), ensuring that no cardholder data touches the platform's DOM or servers.

All 50 U.S. states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands have enacted data breach notification laws that require businesses to notify affected residents in the event of a security breach involving their personal information. Franchise Builder US complies with all applicable state data breach notification laws and commits to notifying affected franchisors within 72 hours of breach verification, as described in Section 7 above.

General State Breach Notification Requirements: While specific requirements vary by state, most state breach notification laws share the following common elements: (a) a duty to notify affected individuals in the event of unauthorized access to or acquisition of their personal information; (b) a definition of "personal information" that typically includes name plus Social Security number, driver's license number, financial account number, or other identifying data; (c) a notification timeline ranging from "without unreasonable delay" to specific deadlines (e.g., 30, 45, or 60 days); (d) required content of breach notifications (e.g., nature of the breach, types of information compromised, steps to protect against harm); and (e) notification to state attorneys general or other regulatory authorities for breaches exceeding a certain threshold of affected residents.

State-Specific Notification Timelines: The following states have specific statutory notification deadlines that differ from the general "without unreasonable delay" standard:

• Connecticut, Florida, Ohio, Vermont, Wisconsin: Notification required within 45 days of discovery (Conn. Gen. Stat. § 36a-701; Fla. Stat. § 501.171; Ohio Rev. Code § 1349.19; 9 V.S.A. § 2435; Wis. Stat. § 895.507).
• California: Notification required "in the most expedient time possible and without unreasonable delay" (Cal. Civ. Code § 1798.82). California also requires notification to the Attorney General for breaches affecting more than 500 California residents.
• New York: Notification required "in the most expedient time possible and without unreasonable delay" (N.Y. Gen. Bus. Law § 899-aa). New York also requires notification to the Attorney General, Department of State, and State Police for breaches affecting New York residents.
• Massachusetts: Notification required "as soon as practicable and without unreasonable delay" (Mass. Gen. Laws ch. 93H). Massachusetts also requires notification to the Attorney General and the Office of Consumer Affairs and Business Regulation.
• Texas: Notification required "without unreasonable delay" (Tex. Bus. & Com. Code § 521.053). Texas also requires notification to the Attorney General for breaches affecting more than 250 Texas residents.
• Illinois: Notification required "without unreasonable delay" (815 ILCS 530). Illinois also requires notification to the Attorney General for breaches affecting more than 250 Illinois residents.
• Pennsylvania: Notification required "without unreasonable delay" (73 Pa. Stat. § 2301 et seq.).
• Washington: Notification required "without unreasonable delay" (Wash. Rev. Code § 19.255.010). Washington also requires notification to the Attorney General for breaches affecting more than 500 Washington residents.
• Colorado: Notification required within 30 days of determination that a breach occurred (Colo. Rev. Stat. § 6-1-716).
• Florida: Notification required within 30 days of discovery (Fla. Stat. § 501.171).
• Ohio: Notification required within 45 days of discovery or when the investigation is completed (Ohio Rev. Code § 1349.19).

Expanded Definitions of Personal Information: Several states have expanded their definitions of "personal information" beyond the traditional name-plus-SSN/driver's-license/financial-account standard to include: (a) biometric data (Illinois BIPA, Texas, Washington); (b) health information (California, Connecticut, Missouri, New Hampshire, Virginia); (c) online credentials — usernames, email addresses, and passwords (California, Connecticut, Delaware, Illinois, Nevada, New Hampshire, Oregon, Rhode Island, Washington, Wyoming); (d) passport numbers (California, Florida, Hawaii, Illinois, Nebraska, New York, North Carolina, Oregon, Vermont, Washington); and (e) medical information (California, Missouri). Franchise Builder US treats all of these data categories as personal information subject to breach notification obligations.

Attorney General Notification: Most states require businesses to notify the state Attorney General or designated regulatory authority when a breach affects residents of that state above a certain threshold (commonly 500, 1,000, or 2,500 residents). Franchise Builder US will notify all required state Attorneys General and regulatory authorities in accordance with each state's specific requirements when a breach affects residents of that state.

Substitute Notice: If the cost of providing direct notice to affected individuals exceeds a certain threshold (commonly $250,000) or the number of affected individuals exceeds a certain threshold (commonly 500,000), most state laws permit "substitute notice" — which typically includes email notification, conspicuous posting on the business's website, and notification to major statewide media. Franchise Builder US will use substitute notice only when permitted by applicable state law and when direct notice is not reasonably feasible.

Harm Threshold: Some states (including California, Florida, and others) only require breach notification if the breach is reasonably likely to cause substantial harm to affected individuals — i.e., the unauthorized access has resulted or could result in identity theft, fraud, or other harm. Franchise Builder US will assess the harm threshold in accordance with each applicable state's law and will provide notification when required, even if the harm threshold is not clearly met, as a matter of transparency and good faith.

Coordination with Franchisor Obligations: Franchise Builder US recognizes that franchisors may have their own breach notification obligations to their franchisees and customers under applicable state and federal law. Our 72-hour internal notification commitment (Section 7) is designed to give franchisors sufficient time to assess the breach, determine their own notification obligations, and comply with the most stringent applicable regulatory timelines. We will provide franchisors with all information necessary for them to fulfill their own breach notification obligations, including the categories of data affected, the number of records compromised, and the measures taken to remediate the breach.

The New York SHIELD Act (Stop Hacks and Improve Electronic Data Security Act) requires businesses storing the private data of New York residents to implement specific administrative, technical, and physical safeguards. Franchisors with NY-based franchisees must designate a Security Coordinator, conduct regular risk assessments, and maintain employee training programs.

Use the certification tool below to designate your Security Coordinator and acknowledge your administrative safeguards compliance.