Solution
Multi-branch is not a report filter. Every record carries a branch, roles are granted per branch, and modules can be bought per branch — so a location can differ without forking the platform.
Every record belongs to an organisation and a branch, enforced server-side.
Each location enables the modules it actually uses, and is priced for them.
Plans, products and templates defined once, adopted per branch.
The same metric per branch and consolidated.
Members and staff move between branches without losing history.
Shared-database row scoping, schema-per-tenant or database-per-tenant.
Scope leaks — a report that forgets the branch filter, an API that trusts a branch id from the request body. Here, tenant and branch come from a verified auth context on the server, never from the client, so a forged id cannot widen what a request can see.
A franchisee can be given full control of their own branch while central retains the catalogue, the brand and the consolidated view.
