Everything you need to complete your security and compliance review. Franchise Builder is built on a secure, multi-tenant platform with encryption, row-level security, audit logging, and accessibility at the core. We inherit enterprise-grade certifications — SOC 2 Type II and ISO 27001 — from the Base44 platform we run on.
Last updated: September 7, 2026
Our certification status and roadmap
SOC 2 Type II
ISO 27001
EU-US Data Privacy Framework
UK-US DPF
Swiss-US DPF
CCPA Compliant
GDPR Compliant
WCAG 2.1 AA (VPAT 2.4)
Inherited Platform Certifications
Franchise Builder runs on the Base44 platform, which is SOC 2 Type II certified and ISO 27001 certified. The full SOC 2 report and ISO 27001 certificate are available under NDA via the Base44 Security Trust Center. International data transfers are protected under the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses. UK-US and Swiss-US DPF extensions are on the roadmap. Contact security to request reports under NDA.
Where your data is stored, processed, and backed up
Franchise Builder supports workspace-level data residency, allowing enterprise customers to store app data and user records in the US (default), EU (Frankfurt), or UK (London) regions. This is configurable on the Elite and Enterprise plans. True per-tenant region pinning is on our roadmap for 2027; in the interim, EU customers are covered by a Data Processing Addendum with EU Standard Contractual Clauses (SCCs) to provide a legal transfer mechanism.
Available Worldwide
Franchise Builder is available globally. Customers in Canada, Australia, and 100+ other countries use our US, EU, or UK hosting today, with full cross-border privacy safeguards (DPA, EU SCCs, UK IDTA) in place. Local in-country data residency for Canada and Australia is on our 2027 roadmap — but you can onboard and operate fully today.
| Region | Status |
|---|---|
United States (US) Primary database, file storage, backups, AI processing | Active |
European Union (EU) App data & users storage | Active |
United Kingdom (UK) App data & users storage | Active |
Canada (Toronto) Local residency on roadmap — Canadian customers onboard today with full PIPEDA-compliant safeguards (DPA + SCCs) | Active |
Australia (Sydney) Local residency on roadmap — Australian customers onboard today with Australian Privacy Act-compliant safeguards (DPA + SCCs) | Active |
| Stage | Detail |
|---|---|
| Data Entry | User input via browser, API requests, and file uploads are received over TLS 1.2+ and routed to the primary region. |
| Primary Storage | Entity records, user accounts, and app data are stored in the workspace-configured region (US by default; EU or UK on Elite/Enterprise plans). |
| File Storage | Uploaded media files (images, documents, videos) are stored in US-based object storage regardless of data residency setting. |
| Backups | Automated daily backups are stored in the same region as the primary database. |
| AI Processing | AI text generation (OpenAI), transcription, image generation, and video generation are processed in the US. EU customers are covered by OpenAI’s DPA and Standard Contractual Clauses. |
| Email Delivery | Transactional and system emails are processed through US-based SendGrid infrastructure. |
| Payments | Payment processing via Wix Payments (Base44 Payments) and Stripe operates in US and Israel regions. |
AI Processing Disclosure
AI text generation, transcription, and media generation are processed in the US via OpenAI and other US-based providers. EU customers are covered by our providers' DPAs and EU Standard Contractual Clauses. We are evaluating EU-hosted AI alternatives (e.g., Mistral) for EU-region tenants with strict residency requirements.
EU Transfer Mechanism
For EU and UK customers, we provide a Data Processing Addendum incorporating the latest EU Standard Contractual Clauses (SCCs) and UK International Data Transfer Addendum. This ensures a lawful data transfer mechanism while per-tenant region pinning is in development.
Federated authentication and automated user provisioning
Franchise Builder supports federated identity through industry-standard protocols, enabling enterprise customers to authenticate users through their corporate identity provider (IdP) and automate user lifecycle management via SCIM 2.0.
| Identity Provider | Status |
|---|---|
Okta OIDC Web Application required. Federation Broker Mode must be OFF. Available on Elite plan / Enterprise workspaces. | Active |
Microsoft Entra ID (Azure AD) App registration with client secret required. Tenant ID, Client ID, and Client Secret configured at platform level. | Active |
Google Workspace Google OAuth login available on the standard login page. Many mid-market brands use Google Workspace as their IdP. | Active |
SAML 2.0 (generic) The platform uses OIDC, not SAML. Most IdPs (Okta, Azure AD) support OIDC alongside SAML — configure an OIDC app instead. | Not Supported |
How to enable: SSO is configured at the platform/workspace level (Elite plan or Enterprise workspace). Enterprise customers work with our team to register their IdP app (Okta OIDC Web App or Entra ID app registration), provide credentials, and map IdP groups to platform roles (admin, manager, staff, franchisee). SCIM 2.0 endpoints are provisioned automatically once SSO is active. Contact security to begin setup.
Technical and organizational measures protecting your data
All data is encrypted at rest using AES-256 and in transit via TLS 1.2+. Database records, file storage, and backups are encrypted. API communications require HTTPS.
Every entity enforces row-level security policies so franchisors, franchisees, and staff only access data they own or are explicitly granted. Admin-only operations are gated by role checks. RLS policies are audited programmatically via the validateRlsPolicies function.
MFA is enforced for administrative access. Step-up authentication is required for sensitive operations (BOI reporting, financial data access, signature execution). MFA challenges are verified server-side.
All administrative actions are logged with user identity, timestamp, and action details via the logAdminAccess function. Access logs are retained for audit and reviewed for anomalies.
Multi-tenant data isolation is enforced at the database layer. Tenant context validation prevents cross-tenant data access. Background jobs and batch operations are scoped to the authenticated tenant.
Critical operations maintain immutable audit trails: document signatures, disclosure receipts, compliance actions, royalty reports, and FDD amendments. Recording hashes are computed and verified for tamper detection.
Personally identifiable information is redacted from field audit photos, employee records, and prompt history. EXIF metadata is stripped from uploaded images. Biometric data is purged on schedule.
Automated anomaly detection monitors bulk exports, unusual access patterns, and compliance violations. Failed webhooks are stored in a dead-letter vault for analysis. Latency metrics track system health.
Third-party services that may process customer data, with DPA status and certifications
Enterprise security teams require a complete subprocessor inventory as part of vendor risk assessment. This is also a GDPR/CCPA requirement — data subjects have a right to know who processes their data. Below is the full list of subprocessors, the data each processes, where it is processed, our Data Processing Addendum (DPA) status, and links to their trust centers.
| Subprocessor | Location | Usage & Data Processed | DPA Status | Certifications |
|---|---|---|---|---|
Amazon Web Services (AWS) Infrastructure | United States (default) / EU / UK | Cloud hosting, infrastructure, storage, backups, and system availability All customer entity data, uploaded files, backups, and system logs | Signed (AWS DPA) | Trust Center SOC 2, ISO 27001, ISO 27017, ISO 27018, CSA STAR |
OpenAI AI Processing | United States | AI text generation for manuals, FDDs, business plans, marketing copy, and support responses Text prompts and uploaded document content for AI-assisted drafting; no data retained for training | Signed (OpenAI DPA + SCCs) | Trust Center SOC 2 Type II, GDPR |
Wix Payments (Base44 Payments) Payments | United States & Israel | Payment processing, subscription billing, and checkout Payment card data, billing details, and transaction records | Signed (Wix DPA) | Trust Center PCI DSS Level 1, SOC 2, ISO 27001 |
SendGrid | United States | Transactional and system-generated email delivery Recipient email addresses, email content, and delivery metadata | Signed (Twilio/SendGrid DPA) | Trust Center SOC 2 Type II, ISO 27001 |
Authentication & Translation | Global | Google OAuth login, Google Translate for multilingual content OAuth tokens (email, name, profile) for login; text snippets for translation | Signed (Google Cloud DPA) | Trust Center SOC 2, ISO 27001, ISO 27017, ISO 27018 |
Stripe Payments | United States | Credit card processing for payment integrations Payment card data and transaction records for integrated billing | Signed (Stripe DPA) | Trust Center PCI DSS Level 1, SOC 2 Type II, ISO 27001 |
Mapbox / OpenStreetMap Mapping | United States | Territory mapping, site selection geolocation, and franchise maps Map tile requests, geolocation coordinates, and map rendering data | Signed (Mapbox DPA) | Trust Center SOC 2 Type II |
Square POS Integration | United States | POS integration for royalty sales sync (OAuth connector) Sales transaction data synced via OAuth for royalty calculation | Signed (Square DPA) | Trust Center PCI DSS Level 1, SOC 2 |
Base44 Platform Platform | United States | Application hosting, database, authentication, and backend function execution All application data, user accounts, authentication tokens, and backend execution state | Signed (Base44 DPA) | Trust Center SOC 2 Type II, ISO 27001, GDPR, CCPA |
We notify customers at least 30 days before adding or replacing a subprocessor, per GDPR Article 28 best practice. Notices are sent via email to workspace admins and posted on this Trust Center.
A dated record of all subprocessor additions, removals, and scope changes is maintained and available to enterprise customers under NDA upon request.
Enterprise customers may object to the engagement of a specific subprocessor. If we cannot resolve the objection, we will cease using that subprocessor for the objecting customer’s data or provide a documented alternative.
OpenAI processes AI requests in the United States. EU customers are covered by OpenAI’s DPA and EU Standard Contractual Clauses. For EU tenants with strict residency requirements, we are evaluating EU-hosted AI alternatives (e.g., Mistral). See the Data Residency section for details.
Data Processing Addendum
Our Data Processing Addendum incorporates EU Standard Contractual Clauses and references this subprocessor list. Enterprise customers receive a countersigned DPA as part of their agreement. To request the full subprocessor change log or raise an objection, contact security.
WCAG 2.1 Level AA conformance documentation
Franchise Builder is committed to WCAG 2.1 Level AA conformance. The following accessibility features are implemented and tested across the platform. A formal VPAT (Voluntary Product Accessibility Template) is available upon request.
How we use artificial intelligence responsibly
We use OpenAI (GPT models) for text generation, Google Gemini for web-search-augmented generation, and Claude for complex reasoning tasks. All providers are bound by DPAs and do not retain customer data for training purposes.
Customer data sent to AI providers is processed for the specific request and not used to train foundation models. Prompt history PII is purged on a defined schedule. Sensitive data (PII, financial, biometric) is redacted before AI processing where applicable.
AI-generated content is watermarked and attributed. AI disclosure audits scan for conspicuous disclosure of AI-generated content. Human oversight is logged for AI-assisted decisions (lead scoring, compliance flags, audit analysis). Users can request explanations for AI-driven scores and decisions.
The Franchise Builder AI Team consists of six specialist agents (Atlas — Build, Scout — Sell, Pulse — Run, Aegis — Compliance, Ledger — Finance, Sage — Support) plus Emma, the orchestrator. Each agent operates within a defined scope and persona. All agent actions are logged to an immutable AiAgentActivity record (agent identity, action type, timestamp, module context). Agents never make fully automated decisions with legal or significant effects without human review. Agent personas are pinned to specific system prompts and model versions to prevent scope drift.
An AI Risk Management System (aligned to NIST AI RMF) tracks model versions, drift, bias audits, and incident reports. Bias audit reports are generated annually. Algorithmic drift is logged. A kill switch is available to disable AI features if harmful behavior is detected.
Users can opt out of AI-assisted features. AI-generated documents are always editable and reviewable by humans before publication. No fully automated decisions with legal or significant effects are made without human review.
How we handle and protect personal data
Franchise Builder complies with the California Consumer Privacy Act (CCPA), the General Data Protection Regulation (GDPR), and other applicable privacy laws. We will enter into a Data Processing Addendum (DPA) with enterprise customers and support Standard Contractual Clauses for international data transfers.
Data subjects may exercise their rights (access, deletion, portability, opt-out) through ourPrivacy Portalor by contacting us directly. We process data subject requests within 30 days.
Customer data is deleted upon request or upon contract termination. Retention periods are documented in our data retention policy and configurable per entity type.
How we ensure availability and respond to incidents
Security teams can request SOC 2 draft reports, the VPAT, DPA, subprocessor details, or the full technical and organizational measures (TOM) document under NDA. To report a security vulnerability, contact us directly.
This Trust Center is updated as our certification status and security practices evolve. For the latest status or to discuss your specific security requirements, contact our security team.
Essential cookies are always on. You can accept or reject analytics, marketing, and translation (CPRA / GDPR).