Outlets open on the date you promised. Royalty nobody argues with.

What breaks, in the words franchisors use

• The expansion pipeline is a spreadsheet one person maintains, so when they are on leave nobody can say where a lead stands.
• Royalty is rebuilt by hand each month, and every dispute turns into an argument about the basis rather than the number.
• A franchisee under-reports for two quarters and it surfaces as a hunch, not as a flagged row.
• Renewal dates and notice windows are known only when somebody remembers to look, or when the franchisee mentions it first.
• An outlet slips six weeks because the licence that takes forty days was applied for after the fit-out, not before.
• Field audits happen, findings get photographed, and nothing closes the loop — so the same finding is written again next quarter.
• Territory is promised in a meeting and discovered to overlap after the agreement is signed.
• The marketing fund collects every month and there is no accounting of it you would be comfortable circulating.
• A new area manager needs access, so somebody makes them an admin, which also hands them the rate card.

None of that is a discipline problem. It is what happens when the network is real and the system of record is nine tools that do not know about each other.

What follows is the chain, end to end, with the record each step produces. Nothing on this page describes something we intend to build. Where a thing exists in the API but not yet on a screen, the row says so.

1. An enquiry arrives From a public form with its own link and QR, a business card photographed at a stall, or somebody typing it in — and an aggregator CSV through the import endpoint, which validates 500 rows at a time but has no console screen yet. The lead exists before anyone gets back to the office, and a consent receipt is written before the data is stored, not after.
2. It gets worked Your own stages, your own fields, follow-up dates with an overdue view, and every call, meeting, WhatsApp and stage change on one timeline — including the changes nobody would have thought to write down.
3. It gets qualified and matched An investment profile of twelve structured fields is scored against your franchise models on capital, format, geography, sector and royalty, and the score shows the weight behind each verdict. A profile too thin to match on cannot be advanced.
4. It gets signed An agreement with the terms as fields, a territory with the PIN codes frozen at grant, and a signing ceremony the counterparty completes in a browser with no account — email OTP, a drawn signature, and a hash-chained trail behind it.
5. It gets opened A fifteen-phase opening plan back-scheduled from the date you promised, with the licence durations that actually apply in India, phases that stay locked until the earlier sign-off is approved, and a projected opening day driven by real slip.
6. It starts trading The outlet files its sales for the period; you approve them. A figure that deviates from that unit’s own trailing median by more than your threshold is flagged into an audit queue before it is billed.
7. The month closes One run walks every active royalty term, computes the statement, and raises the invoice with GST split by place of supply and TDS shown as expected rather than as a shortfall. Re-running it corrects rather than duplicates.
8. The network gets governed Audits that cannot be closed until the failed critical items have corrective actions raised against them, a licence register that refuses the opening sign-off when a mandatory licence is missing, and an audit log nothing can edit.

The agreement

• The terms as fields Module ↗

  Stores a franchise, development, master, disclosure, NDA or other contract with effective and expiry dates, term months, renewal count and years, notice-period days, counterparty type, entity name, ownership percentage and contract value, tied to the franchisee’s record.

  The renewal date, the notice window and who actually signed become queryable data instead of clause 4 of a document nobody opens.

• Renewal creates a fresh record Module ↗

  Renewing marks the current agreement renewed and creates a new active one running the same span again from the old expiry date, carrying over owner, ownership percentage, term, notice period and value.

  You can still show what the terms were in 2022 and what they are now, because the renewal did not overwrite the contract it replaced.

• Key-date triggers with a lead-time offset Module ↗

  Any dated obligation — renewal window, expiry, insurance expiry or one you name — is recorded with a due date and a number of days’ notice, and moves upcoming to due to passed on its own.

  You are told ninety days before the renewal window opens, not on the day the agreement lapses.

• A nightly sweep moves the ladder Module ↗

  A scheduled command runs every morning, walks every workspace’s key dates and insurance certificates, advances each along its ladder, and writes a note on the franchisee’s timeline on every change.

  The reminder happens whether or not anyone opened the app, and the franchisee’s file shows the date the warning was raised.

• Acknowledging a trigger names a person Module ↗

  A due key date is closed by somebody acknowledging it, which stamps the user and the timestamp. The daily sweep never touches an acknowledged trigger again.

  Somebody owns the renewal conversation, and there is a record that they did.

• Expiring in the next thirty days, on the band Module ↗

  The agreements stat band counts active agreements and the total contract value across active and renewed, each with a weekly trend, plus the agreements whose expiry falls inside the next thirty days.

  Renewals stop being something you notice when the franchisee calls.

Signing

There is no e-sign provider vouching for any of this, which is exactly why the trail is built the way it is. And one boundary before the detail: the signer’s ceremony is a real screen, but the brand half — open the session, inspect the certificate, seal it — runs through the API today with no console button, so in a walkthrough we drive that half from the API and you watch the franchisee’s screen do the rest.

• A signing link the counterparty opens without an account Partly built Module ↗

  Opening a session on an agreement mints a 48-character token URL with a fourteen-day expiry; the franchisee opens it in a browser with no login and no app.

  The person signing is usually not a user of your system yet, and making them create an account is where signing flows die.

• Email OTP before the signature is accepted Module ↗

  The signer requests a code to the email address you already hold, and the server refuses the signature outright if the code has not been verified. The code is issued for signing specifically, so it can never be replayed as a login.

  Mailbox possession is the identity evidence. A signature captured without it is a picture of a name.

• A drawn signature and an explicit tick Module ↗

  The ceremony requires both a signature drawn on the pad and the assent checkbox, and the API rejects the submission if either is missing.

  A squiggle alone is not consent and a ticked box alone is not a signature — the record holds both.

• Declining is a recorded outcome Module ↗

  The signer can decline from the same page, optionally saying why; the session moves to declined and the refusal is written into the trail.

  An abandoned tab and a refusal look identical over email. Here they do not.

• Hash-chained trail with IP and user agent Module ↗

  Every step — created, sent, viewed, code sent, code verified, signed, sealed, declined — is appended to a ledger row carrying IP, user agent, timestamp, and a SHA-256 of the previous hash plus its own canonical payload. The table has no updated column, because an event never changes.

  Alter any event after the fact and every hash after it stops matching — and the system tells you at which step it broke.

• Sealing writes the signature back onto the agreement Module ↗

  Sealing a signed session makes it immutable, stores a hash over the certificate facts, and stamps the agreement with the signed-at time, the signer’s name, the IP captured at the moment of signing, and status active.

  The contract record and the evidence stop being two systems, and the DPDP erasure path never reaches a sealed instrument or its ledger.

Territory

• Defined the way you actually sell it

  A territory records its definition method — PIN list, district, radius, drive time or polygon — with up to 5,000 geo units, plus region, population, median income, daytime population and written performance conditions.

  The rights you granted are a list of PIN codes you can point at, not a paragraph two people remember differently.

• Grant type and the rights you keep back

  Each territory is granted exclusive, protected or non-exclusive, with the reserved rights recorded as a multi-select: online sales, wholesale, national accounts, alternative brands, non-traditional locations.

  The carve-out that causes a dispute four years later — who owns online orders into their PIN codes — is on the record at grant time.

• Reserve on a deposit, with a hold that expires

  A hold flips the territory to reserved and records the deposit and an expiry. The territory row is locked and re-checked inside the transaction, so two people cannot reserve the same territory at the same moment.

  You can hold a city for a serious prospect without taking it off the market forever, and the race that would double-promise it is closed in the database.

• Expired holds release themselves overnight

  A daily sweep expires held reservations whose window has passed, returns the territory to available, and writes a note on the prospect’s timeline.

  Territory stops silently sitting on hold because a deal went quiet and nobody tidied up.

• Converting a reservation freezes the grant

  Converting on award moves the territory to committed and freezes a snapshot of the name, region, definition method, geo units, grant type, reserved rights and performance conditions, with the moment it was frozen.

  What was granted stays granted as at that date, even if you later redraw the map.

• Agreement-grade territory export

  Returns the canonical geo units and grant terms for a territory, flagged frozen or not and with the date they were frozen — a draft can be previewed but is marked as not yet binding.

  The territory schedule attached to the franchise agreement comes out of the system rather than being retyped into the contract.

The plan

• The fifteen-phase opening journey Module ↗

  Every opening runs the same platform sequence: signing, entity and finance, site selection, LOI and lease, design and fit-out, licensing, construction and equipment, tech activation, hiring, training, stock and supply, pre-launch marketing, soft launch, grand opening, stabilization.

  Head office, the field team and the franchisee are looking at the same plan with the same names for the same steps.

• Six industry packs with Indian licence durations built in Module ↗

  F&B and QSR, education centre, salon and wellness, pharmacy, retail store and premises-light services packs are seeded per workspace, carrying researched processing times as ordinary editable durations — Shops and Establishment 5–10 days, GST registration 7, trade licence 7–15 general and 15–30 for health trades, fire NOC 15–30, FSSAI state 30–60, eating-house licence with the police 15–25 in the states that require one, drug licence 30–45 after inspection.

  Your first plan is built on what the authority actually takes rather than on an optimistic guess that gets learned once per opening.

• The pharmacy pack models the pharmacist-before-licence inversion Module ↗

  In the pharmacy pack, hiring the registered pharmacist is a real predecessor of the drug-licence application, because the application cannot be made without one.

  The sequencing mistake that costs six weeks is already in the template instead of being discovered on your first pharmacy opening.

• Back-scheduling from the opening date Module ↗

  Each task declares an anchor — project start, a predecessor, or the target open — with an offset and a duration, and the planner lays the whole thing out in day offsets. A predecessor offset of zero starts immediately after its prerequisite ends; a negative one overlaps.

  You pick the opening date you want and the plan tells you the site has to be signed by a particular week, rather than adding up the steps and hoping.

• Moving the date recomputes every window Module ↗

  Retargeting rewrites the planned start and end of every task from the plan’s own scheduling data, without re-reading the template.

  The date slips once and the whole plan moves with it, instead of thirty dates going stale.

• Clone a pack to edit it; platform packs stay read-only Module ↗

  A workspace customises a template by cloning it into its own numbered version with every task copied. Writes against a platform pack are refused, though you can still mark one as your default.

  Your edits are yours and versioned, and the pack you started from is still there to compare against.

The gates

• A phase stays locked until the earlier sign-off is approved Module ↗

  A phase is locked while any gate in any earlier phase is unapproved, and every mutation on a task — complete, block, approve — is checked against that on the server, so nobody can work ahead by posting straight at the API.

  No construction before the drawings are approved. The rule is in the database, not in a policy document.

• Only a sign-off clears a gate, and only the brand can give it Module ↗

  Gates are approval tasks. Ticking a checklist item — even a milestone — can never open the next phase, approval tasks refuse to be marked done, and a decision on a project’s gate is restricted to the tenant that owns the project.

  An outlet cannot sign off its own opening, and an assignee cannot clear a gate by ticking their own task.

• Franchisor-only steps are hidden but still gate Module ↗

  Tasks marked franchisor-only are filtered out of the outlet’s view and cannot be touched from the outlet side, while the gating still evaluates the full list.

  An internal credit check keeps the franchisee’s next phase locked without showing them a step that is none of their business.

• The licences sign-off reads the register, not a checkbox Module ↗

  Approving the licences-verified gate is refused, naming the offending items, when the unit has a mandatory statutory licence that is missing or expired — and the statutory library is seeded on the spot, so the gate cannot pass merely because nobody ever opened the compliance screen.

  An outlet cannot be signed off as licence-clear because someone senior ticked a box in a hurry.

• Grand open refused while a sign-off is outstanding Module ↗

  Marking a project opened returns an error counting the unapproved sign-offs. Once it succeeds, the actual open date becomes the baseline every downstream clock measures from.

  Opening day is a fact the system agrees with, which is what makes royalty, reporting cadence and stabilization trustworthy afterwards.

• Launch readiness gates Module ↗

  A launch record carries six named booleans — training complete, buildout sign-off, licences verified, POS live, staff hired, soft open done — set one at a time. It cannot be marked opened while any is unmet, and it cannot be created already-opened either.

  "Are we ready to open" has a definite answer with the missing items named, on both the mark-opened button and the generic edit path.

Running thirty openings at once

• Exceptions-first board with a colour per outlet Module ↗

  The opening command centre defaults to the projects with exceptions — red when slip exceeds seven days or a gate or critical task is already overdue, amber when anything is late or blocked — sorted worst first, with the pending approval inbox and the bottleneck table on the same screen.

  A field director opens one screen and sees which of thirty openings are in trouble and what would unstick them, rather than reading thirty plans.

• Projected opening day driven by critical-path slip Module ↗

  The projected open is the target pushed out by the worst slip on a critical task — measured against today for an unfinished one, or against when it actually landed for a finished one. Slippage on non-critical tasks is visible but never moves the date.

  The date on the screen is the date the outlet will open, not the date somebody promised in January.

• Blocked tasks carry a reason from a fixed list Module ↗

  A task is flagged blocked with one of awaiting landlord, awaiting authority, awaiting brand, awaiting vendor or awaiting funds, plus a free note. Completing a task clears the block.

  Because the reasons are a fixed list, the network can be counted — "half your openings are waiting on landlords" becomes a number rather than an impression.

• Bottleneck table: average slip per template step Module ↗

  Across every opening, tasks are grouped by the template step they came from and ranked by average days of slip, with how often it slipped and how often it was blocked.

  You learn that your own fire-NOC estimate is twelve days optimistic and fix the template, instead of chasing each franchisee.

• Days to open and days to first bill Module ↗

  Reports the average days from project start to opening across opened outlets, and the average days from opening day to the outlet’s first recorded sale.

  Two numbers that say whether your opening process is getting faster, and whether new outlets start trading on day one or three weeks later.

• Problem locations and the most overdue tasks Module ↗

  A rollup ranks the worst eight unopened locations by overdue milestones and overdue tasks with a pace signal — on track, at risk, overdue — and lists the twelve most overdue individual tasks with how late each is and which outlet it belongs to.

  A weekly openings call runs off two lists instead of a project-by-project readout.

Audits and visits

• Audit template builder Module ↗

  Build a scorecard as weighted sections of scored questions, each with a maximum score, an N/A toggle, a response type — yes/no, score, text — and a critical-item flag. A template carries a draft, active or archived status you set; nothing yet stops a draft template being used on a visit.

  Your brand standards become something the field team scores against, instead of a checklist that differs by whoever printed it last.

• Additive or deductive scoring, with N/A removed from both sides Module ↗

  Score either as points earned out of the maximum or as points deducted from it. N/A answers leave the numerator and the denominator, and sections combine as a weight-weighted average.

  An outlet with no kitchen is not marked down for the kitchen section, and a brand that runs demerit-style audits does not have to invert its own checklist.

• Critical items that fail the whole visit Module ↗

  A question marked force-failure that scores zero fails the visit regardless of the arithmetic, and the visit is stamped poor on the universal good/fair/poor reading whatever percentage it earned. The band letter itself still reflects the score.

  A food-safety auto-fail cannot be reported to the network as a good visit, which is what keeps the critical-item mechanism real rather than decorative.

• Corrective-action gate on completion Module ↗

  Where the template requires it, a visit cannot be completed until every failed critical question has a finding with a corrective action raised against it — enforced on the complete action and on the generic update, so there is no second door.

  The audit is closed by its actions being raised, so the same finding stops reappearing three months later because nothing owned closing it.

• Twelve visit types you can rename Module ↗

  Visits ship with twelve seeded types — compliance audit, brand standards, food safety, business review, mystery shopper, training, pre-opening check, regulatory inspection, maintenance, stock, marketing compliance, general inspection — as an editable vocabulary rather than a fixed enum.

  A brand that calls it a QBR and one that calls it a business review both get their own word, while a regulator’s inspection stays structurally separate because it is somebody else’s visit.

• A live score in the outlet that matches the server Module ↗

  The field screen captures a score, an N/A flag and a note per question, saves answers as an upsert that re-scores the visit, and shows a running percentage computed by a client mirror of the server’s scoring engine.

  The auditor sees the score they are about to hand over while still standing in the outlet, and it is the same number the server persists.

Licences and compliance

• A seeded Indian statutory licence library Module ↗

  Every workspace seeds a brand pack — trademark, GST registration, FSSAI central licence, EPR plastic packaging, POSH committee, Udyam — plus one of five industry outlet packs for F&B, pharmacy, salon, education and retail, each item carrying its authority, cycle, validity, renewal window, alert ladder, mandatory flag and a paragraph of guidance.

  The register starts populated with the guidance a renewal actually needs — FSSAI renewal opens 180 days ahead, the ₹100-a-day late fee bites inside the last 30, and after expiry it escalates to 3× for 90 days then 5×, with the licence dead at +180 — plus the municipal trade licence’s April–March year and the drug licence’s five-year retention fee, instead of starting blank and being filled in from memory.

• Required versus held, worst first Module ↗

  The register compares what a unit must hold against what it does hold and sorts by severity — lapsed, expired, missing, due, flagged, ok, not tracked — so a mandatory obligation with no record at all is a row rather than an absence you have to notice.

  You open the screen to find the outlet that never had a fire NOC, not to browse a filing cabinet you already know is fine.

• Network compliance portfolio Module ↗

  One call returns a register per franchisee unit plus your own head-office register, each with its counts and its blocking items.

  Exposure across the whole network is one screen with the broken units impossible to miss.

• Licence clocks that behave differently Module ↗

  The register models fixed-year, annual, perpetual-with-retention, no-expiry and state-variable cycles, and derives an expiry from the issue date where the statute implies one.

  A pharmacy’s Form 20/21 tracks its retention due date rather than a fake expiry, and a GST registration never appears on a renewal ladder it has no business being on.

• An append-only review trail per licence Module ↗

  Every record stamps the person who filed it and, on review, the reviewer, the timestamp and a note. Each decision — approve, comment, flag renewal, reject evidence — is written to a separate append-only table with its from and to state. Reassigning a record to a different owner is not yet possible.

  Flagging a licence never erases where the record had got to, and the history of who looked at it survives.

• Daily expiry sweep on a 60/30/15 ladder Module ↗

  A scheduled command recomputes every licence’s status against the ladder each morning and writes a note on the unit’s timeline the day it crosses into expiring or expired.

  You learn about a lapse from the system before you learn about it from the franchisee, and it costs nobody a diary reminder.

Documents

• A vault attached to the record, not a folder Module ↗

  A register of KYC, disclosure, agreement, certificate and other documents, each with a reference, an expiry, a public, internal or role-scoped access level, an optional review cycle in months, and an attachment to the franchisee it belongs to. It stores the metadata and a reference string — there is no file upload endpoint, so scans are referenced rather than held.

  Documents sit with the record they belong to, and one with a review cycle comes back around on its own.

• Versions supersede rather than overwrite Module ↗

  Publishing a new version mints the next version pointing at the one it supersedes and archives the prior, taking a row lock first so two concurrent updates cannot both branch a version two.

  There is exactly one current operations manual, and the superseded one is still readable rather than gone.

• Read-and-sign, with a who-has and who-has-not report Module ↗

  Assign a document to named users or a role target; each assignee starts unacknowledged, acknowledging stamps the time, the typed name and the IP, and the screen reports both sides. Publishing a new version re-creates a pending acknowledgment for every prior assignee.

  The updated operations manual is provably in front of every franchisee, with the ones who have not opened it named — and a revised manual forces a fresh read rather than inheriting last year’s signature.

• Issued documents are immutable Module ↗

  A generated PDF is rendered once, hashed, and stored outside the web root. Every download re-checks the hash and refuses to serve a file that no longer matches, and re-issuing mints a new record rather than rewriting the old one.

  The copy a franchisee already holds keeps saying what they received, which is the only basis on which a tax document means anything.

• A revocable public link on an issued document Module ↗

  Minting a share token makes a document downloadable with no login and counts the downloads; revoking nulls the token while keeping the file and its hash, and a revoked link returns a plain 404.

  You send a franchisee or their CA the actual document instead of a screenshot, and take the link back without saying what it used to point at.

Documents, rendered for India

• PDFs that set Devanagari properly Module ↗

  Generated documents run through a PDF engine chosen for Devanagari shaping, so a franchisee’s name in Hindi on a royalty bill is the name and not a row of boxes.

  The document you send an Indian franchisee is one you would be willing to have printed and put in front of an inspector.

Not built yet — on the plan

Nothing in this group is built yet, and every row is tagged that way. It is here because you will ask, and because a roadmap you can argue with beats one you find out about later — what we build next should be decided by the people paying for it, so tell us which of these actually blocks you.

• Audits captured with no signal Not built yet Module ↗

  The audit app holds a whole visit — scores, notes and photos — on the device inside a basement kitchen or a highway outlet, and syncs when the phone reconnects, with the score computed on the device meanwhile.

  Your auditor stops carrying paper into the places where the audit actually matters, and the visit reaches head office the same day rather than on Monday.

• Evidence you can actually attach Not built yet Module ↗

  Licence scans, audit photos, insurance certificates and signed agreements upload against the record they belong to, with the file held in the vault and versioned like everything else.

  “Send me the FSSAI certificate” stops being an email thread, and a licence register that holds a number and a date starts holding the document too.

• Training and certification for outlet staff Not built yet Module ↗

  Modules, assessments and certificates per role sit under the training phase of the opening journey, and the training gate reads whether the named people actually passed rather than whether somebody ticked it.

  The training obligation your agreement puts on you becomes evidence you can produce, and a new outlet’s staff are certified before the gate that says they are.

• A marketing asset library Not built yet Module ↗

  Approved logos, creatives, campaign kits and local-store templates live in one place the network downloads from, versioned, with the superseded version withdrawn.

  A brand collecting an ad fund every month has somewhere to put what the fund produced, and off-brand local creative stops being the default because the right file was hard to find.

• Customer feedback and NPS per outlet Not built yet Module ↗

  A feedback capture at the counter and public review scores roll up per unit and per period, trend against the network, and sit beside the audit score on the same unit health reading.

  You see the outlet the customers have already downgraded before your next scheduled audit finds out, and the mystery shop stops being your only outside opinion.

The network

• Outlet records are free; outlet logins are the paid unit Module ↗

  Creating outlet records is unlimited. Issuing a login to an outlet consumes a seat, counted as members plus still-usable pending invitations, and an over-cap invitation is refused with the seat ledger attached. The limit resolves from the outlet’s own entitlement first, then the brand’s.

  You map your whole network on day one without a bill, and pay only for the outlets you actually switch on — whether the brand pays or the outlet does.

• An outlet that is not paid for cannot trade Module ↗

  The outlet-users surface reports a lock reason per outlet — suspended, awaiting payment, no seats, no users — beside its seat ledger and its opening project. The awaiting-payment posture is enforced: every business route in that outlet’s workspace is refused until the first invoice is settled. The seat and user reasons are reported rather than enforced.

  You build the store before you bill for it, and trading is what the meter runs on.

• Bulk outlet import Module ↗

  Creates outlet records from a CSV with per-row validation, and refuses a row marked opened that does not say when it opened. Imported rows are outlet records only — link one to a franchisee record before royalty terms and the missing-report board can see it.

  A brand already running forty stores gets its network in on day one, without pretending each one went through the opening workflow.

• Sales reports the outlet files and you approve Module ↗

  A unit files gross and deductions for a period and net is derived; the report moves due to submitted to approved, with filing and approving behind separate capabilities. Only a monthly report in a closeable status is ever used as a royalty basis.

  The number royalty is computed from was filed by the outlet and accepted by you — the disagreement happens before the invoice, not after.

• Weekly management reporting that cannot become the royalty basis Module ↗

  Reports carry a grain — weekly (2026-W24), fortnightly or monthly — and only the monthly grain is picked up by the close or fed into the trailing median.

  You can run weekly reporting without a weekly rollup ever being mistaken for the month and flagging every honest outlet as an anomaly.

• POS variance and the anomaly flag Partly built Module ↗

  Flags a report whose gross deviates from that unit’s trailing three-period median by more than your threshold — 25% out of the box — into a royalty audit queue. That half is live. The POS side is not: an imported POS gross is stored beside the declared figure and the variance computed, but the import runs through the API only, there is no import screen in the console, and re-importing the same file adds to the imported figure again.

  Under-reporting against a unit’s own history surfaces as a flagged row before the month is billed. POS-versus-declared is a seam we would switch on with you rather than hand over.

Requests, cases and announcements

• Twenty typed request templates, split by who is asking Module ↗

  The catalogue is split into outlet-to-brand and brand-to-outlet queues — discount approval, royalty dispute, supply shortage, equipment repair, renovation approval on one side; document request, licence evidence, missing sales report, royalty chase, audit corrective action, inspection follow-up on the other — each with its own typed fields and decision SLA in hours, with required fields refused on the server.

  A discount request arrives with the percentage on it instead of as prose somebody has to read and re-key, and both sides can see who owes whom an answer.

• Delegated discount authority Module ↗

  A discount request’s approval level is computed from the percentage on it and stored on the record — up to 10% marked self-approve, up to 20% area manager, anything above head office — and a percentage that is not a number is marked head office rather than waved through. The level is a label the decision screen shows: it does not route the request, and it does not itself stop a decider who holds the capability.

  The request arrives already classified, so nobody reads prose to work out whose call it is, and an out-of-band approval is visible on the record afterwards. Binding the ladder to who may press approve is not built — today that boundary is the capability grant.

• A decision clock separate from the resolution clock Module ↗

  Templated requests carry their own decision due date, and the decide action records the approval or rejection with who decided and when — only on approval-kind requests, and only once.

  "We answered you" and "we finished the work" are tracked as the two different promises they are.

• SLA policies with a pause that actually pauses Module ↗

  Per-priority first-response and resolution targets drive a clock where moving a case to pending banks the paused minutes and slides the resolution due date forward, so a case waiting on the franchisee cannot breach.

  Your SLA measures your own response time rather than punishing you for the days a franchisee took to send the photo you asked for.

• Daily SLA sweep that does not nag Module ↗

  Each morning a command walks open and pending cases carrying a policy and writes a note when the first-response target is missed and when resolution breaches, each firing at most once per case.

  A late request is visible as late rather than as silence, without the system generating the same reminder every day.

• Case thread with internal notes and canned responses Module ↗

  Replies append to the thread, can be marked internal so they stay private, and can be pasted from a saved canned response the message then cites. The first non-internal reply stamps the first-response time.

  The handling notes and the reply the franchisee sees live in one record, and the clock is stopped by an actual answer rather than by someone claiming they called.

The everyday surface

• Install it on the phone like an app

  The console installs to a phone or tablet home screen with its own icon and no browser chrome, and the shell is precached so it opens instantly; API calls are never cached, and a new deploy prompts to reload rather than swapping under somebody mid-task.

  Your field team taps an icon, not a bookmark, and nobody is looking at last month’s build because their browser held onto it.

• My Work: one list across every module

  Tasks, calls, meetings and third-party calls are one activity record with an owner and a due date, grouped into overdue, today, upcoming and someday, and created or closed from the same screen.

  Somebody managing forty franchisees works from one list instead of remembering which of nine screens holds the thing due today.

• Unread counts, per person, per channel Module ↗

  Every channel carries an unread count for the person reading it, computed from their own read cursor; polling a channel advances only their cursor, so opening a thread never marks it read for anybody else.

  Someone back from two days out sees which conversations moved, and one person catching up does not clear the badge for the whole team.

Not built yet — on the plan

Nothing in this group is built yet, and every row is tagged that way. It is here because you will ask, and because a roadmap you can argue with beats one you find out about later — what we build next should be decided by the people paying for it, so tell us which of these actually blocks you.

• A live POS connection, not a CSV Not built yet Module ↗

  The outlet’s till pushes the day’s sales, tender split and item mix straight into the trading day, so the declared figure and the machine agree without anyone exporting a file.

  The royalty basis comes off the till rather than off a person’s memory of the till, which is the single change that makes under-reporting hard rather than merely detectable.

• WhatsApp Business messaging Not built yet Module ↗

  Templated WhatsApp messages go out from the system for royalty reminders, missing reports and announcements, and replies land in a shared inbox against the franchisee’s record.

  In India the message that gets read is the WhatsApp message. Click-to-chat opens the conversation; this one keeps it.

• Inventory and approved-supplier ordering Not built yet Module ↗

  Outlets order from your approved supplier list inside the system, with par levels, stock counts and a purchase record that feeds cost of sales.

  Supply-chain compliance — the thing an F&B or retail franchisor polices hardest — becomes a record rather than a WhatsApp order and a hunch about leakage.

• Apps in the stores, for the field team and the franchisee Not built yet

  A native app for each side — the field team’s audit and visit app, and the franchisee’s day, statement and request app — with push notifications and a camera that behaves like a camera.

  An icon your network installs from the store is one nobody has to be talked through, and push is how a missing report gets filed the same day.

Capture

• Public capture form that creates the lead Module ↗

  A published form has its own token URL anyone can fill with no login; a capture form creates the lead on submit and stamps its last activity so a fresh entry sorts to the top of quiet-lead views rather than the bottom.

  The record exists before anyone gets back to the office, and a counter capture is chased first instead of last.

• Unpublishing kills the link Module ↗

  Unpublishing a form nulls its share token, so a link already handed out stops working immediately, while the responses already collected stay exactly where they are.

  A form printed on last season’s standee cannot keep feeding your pipeline after you have moved on.

• Typed fields with Indian money parsing Module ↗

  Form fields are typed — text, number, money, boolean, date, select, multiselect — and answers are coerced on submit, so "₹2,50,000" typed on a phone becomes the integer 250000 and lakh-grouped commas read as separators, not decimals.

  Numbers collected at a stall arrive as numbers you can report on, rather than as text that silently breaks the first summary somebody runs.

• Explicit field-to-lead mapping Module ↗

  Only a field carrying an explicit mapping — name, email, phone, city, company, notes — writes onto the created lead. Everything else stays in the submission.

  A visitor’s company name can never land in the phone field, which is what happens when a tool guesses from labels.

• Answers pinned to the schema they answered Module ↗

  Adding or removing a field bumps the form’s schema version, and each submission stores the version it was answered against.

  Changing a question next month does not rewrite what people answered last month.

• Shareable form link with copy, WhatsApp and QR Module ↗

  Generates a tokenised seven-day link to a specific form for a specific person — only the SHA-256 hash of the token is stored — and offers copy, an email send, or WhatsApp with a scannable QR beside it.

  You send the investor the form instead of typing their answers for them, and at a counter they scan the QR straight off your screen.

Work the pipeline

• Your own stages, with guardrails Module ↗

  Stages are rows you name, reorder, retone and deactivate, each carrying a role — open, qualified, lost — that automation keys off. A stage in use by any lead cannot be deleted, only deactivated, and the set must always keep one active open stage.

  You run your pipeline rather than the vendor’s, and nobody can delete a stage out from under two hundred live leads.

• Franchise India preset, applied non-destructively Module ↗

  Ships two named presets — a FranOpero default and Franchise India (New, Hot, Call Back, NR, QL, BQL, NQL, Churned). Applying one upserts the preset stages to the front; stages you already had are deleted if unused and deactivated if in use.

  A team that already thinks in QL and BQL keeps its vocabulary from day one, and applying a preset never orphans a live lead.

• Three emails and three phones per lead Module ↗

  Stores up to three emails and three phones with one primary of each kind, dedupes case-insensitively, and mirrors each primary onto the lead’s own columns so lists and search stay fast. Search reaches the secondary numbers too.

  The second phone number the person actually answers on is on the record instead of in a note.

• Call, WhatsApp and email from the row Module ↗

  Every row with contact details carries always-visible call, WhatsApp and email actions; hovering reveals the value with one-tap copy, and the WhatsApp action shows a QR that opens the chat with that number on your phone.

  A desk conversation moves to the phone in your hand without anyone reading a number aloud. Click-to-chat and scan-to-chat only — this is not a WhatsApp Business API inbox.

• Action-typed timeline with automatic system entries Module ↗

  A timeline entry is a note or a logged action — call, meeting, WhatsApp, email, visit — and every stage change, owner change, contact edit, archive and conversion writes its own system entry.

  When you ask why a lead stalled in March, the record answers instead of the person who worked it.

• Follow-ups, overdue buckets and quiet leads Module ↗

  A lead carries a follow-up date and note; the list filters by overdue, today, this week or none, and the stat band separately counts leads with no follow-up set that have had no activity for fourteen days.

  The two ways a lead dies — a missed date, and nobody ever setting one — are both visible on the same screen.

Qualify and match

• Investment profile as structured criteria Module ↗

  Twelve fields per investor — capital band, liquid capital, geographic scope, preferred locations, operating model, sectors, formats, the maximum royalty they will accept, timeline, multi-unit appetite, franchise experience, narrative — each scored into a completeness percentage.

  What the investor can and will do is a record you match against, not a paragraph in somebody’s proposal.

• A half-filled profile cannot be padded out Module ↗

  An investor can hold several named profiles with one primary, but another can only be added once the primary passes the workspace’s completeness threshold.

  Nobody escapes an incomplete profile by starting a second one.

• Explainable score on five weighted dimensions Module ↗

  Scores a profile against a franchise model on capital, format, geography, sector and royalty — weighted 30/20/20/20/10 by default, normalised to 0–100 whatever weights you set — and returns a per-dimension verdict of yes, partial, no or unknown with the weight that produced it. Unknown counts as half.

  When a colleague asks why those two were matched, the score itself answers, so the reasoning can be reviewed, taught and handed over.

• The rules behind the score, in plain arithmetic Module ↗

  Capital scores full inside the band and half within half the minimum to one and a half times the maximum; royalty scores zero the moment the model’s royalty exceeds the investor’s stated ceiling; geography and sector are token overlap.

  A prospect can argue with the rule rather than with a black box, which is the only kind of argument that improves the shortlist.

• Bands and weights you can retune Module ↗

  Dimension weights, the rupee edges of each capital band, and which model variants satisfy each multi-unit appetite are workspace vocabulary you edit. The shipped defaults reproduce the standard scoring exactly.

  A brand whose ₹50 lakh band means something different in its category changes the band instead of arguing with the score.

• Matched against offers you can actually place Module ↗

  From an investor it ranks every live franchise model; from a brand it ranks investors by their best-fitting model. Retired models drop out of the pool entirely.

  The shortlist never includes a model that was withdrawn last quarter.

Candidates and the committee

• Candidate financials and a qualification score Module ↗

  A franchise candidate carries net worth, cash available, funding source, a 0–100 qualification score, source and broker attribution, and the discovery day — scheduled and attended — alongside the applied → screening → interview → approved or rejected stage.

  Whether somebody can actually fund the unit is on the record before the committee meets, not discovered after a disclosure pack has gone out.

• Disclosure pack with a cooling-off clock Module ↗

  Sending a pack snapshots the workspace’s cooling-off window — 14 days by default, settable 0 to 365 — onto that pack. Recording the acknowledgment starts the clock, and recording a deposit is refused, naming the date it clears, until the window has fully elapsed. The acknowledgment is filed by a signed-in staff user; there is no candidate-facing acknowledgment page yet.

  The waiting period is enforced by the system rather than by everyone remembering it, and a later settings change cannot retroactively unlock a window already running.

• Committee decision as its own gated action Module ↗

  Approving or declining goes through a decision action that stamps the decision, the timestamp and who decided; a decline requires a reason from your own list. A general edit that tries to move a candidate straight to approved or rejected is refused and told to use the decision action.

  An award is always attributable to a person and a date, and there is no back door that quietly approves somebody through a field edit.

• Attribution freezes at award Module ↗

  Approving a candidate locks attribution: source, broker network and broker reference become read-only and a patch that tries to change them is silently dropped.

  Nobody re-attributes a signed franchisee to a different broker after the fact, which is the argument that otherwise happens when the referral commission is calculated.

• Deposit recorded with its refund terms Module ↗

  A deposit stores the amount, whether it is refundable, and whether it is credited against the franchise fee, with the moment it was recorded.

  The two questions that come up when a candidate walks away — do we return it, and does it count toward the fee — are answered by the record.

• Heat-ranked call-next queue Module ↗

  Ranks open candidates by qualification score plus a stage weight — interview 30, screening 20, applied 10 — plus a recency bonus that decays over twenty days. Approved, rejected and declined rows drop out entirely.

  The morning call list orders itself, and stays a live list rather than becoming a report of everyone who ever applied.

Finding things, and forms beyond capture

• Search from the keyboard, anywhere Module ↗

  One shortcut opens a palette that jumps to any screen you have access to and searches leads live — matched on the server by name, phone, email and city — with the records you opened recently listed before you type anything.

  A caller says a phone number and the lead is on screen before they finish the sentence, without anyone navigating to a list and filtering it.

• Forms are not only for lead capture Module ↗

  A form carries a purpose — capture, onboarding, survey or checklist — and only a capture form mints a lead. A survey or checklist published to its own public link stores each submission against the schema that was live when it was answered.

  A pre-opening checklist or a franchisee satisfaction survey uses the same builder, the same public link and the same QR as your enquiry form, without polluting the pipeline with rows that are not leads.

Not built yet — on the plan

Nothing in this group is built yet, and every row is tagged that way. It is here because you will ask, and because a roadmap you can argue with beats one you find out about later — what we build next should be decided by the people paying for it, so tell us which of these actually blocks you.

• Lead-source ROI, down to cost per signing Not built yet Module ↗

  Spend is recorded against each source — portal, expo, broker, paid search, referral — and read against leads, qualified leads, signings and franchise fee collected, so each source carries a cost per signed franchisee.

  You stop renewing the portal contract on the strength of lead volume, and the expo either survives the arithmetic or it does not.

The network row for a period

Outlets trading

Units with sales in the period

Network net sales

Summed from the units’ own reports

Same-store growth

Only units present in both periods

Royalty billed

From the period’s statements

Royalty collected

Receipts banked against them

Collection rate

Collected over billed

Average audit score

Across completed visits

Open findings

With an unresolved corrective action

Period still partial

Flagged, so nobody quotes it as final

• Rollups you can rebuild from source Module ↗

  Three narrow derived tables — unit-day, unit-period and brand-period — built over a trailing sixty-day window, every method safe to run twice because each writes on a natural key. They rebuild when you ask them to; there is no nightly schedule.

  Head office reporting is always recomputable from source, so a late correction changes the reports instead of leaving them wrong.

• A deterministic insight stream Module ↗

  Eighteen coded rules are declared against your rollups, ten of which the engine evaluates today — sales drop, record month, prime cost, negative four-wall EBITDA, cash-mix spike, missing licence, overdue royalty, bottom-quartile audit score and health band moves in both directions. Each finding names its rule and carries the numbers behind it.

  You get told what changed instead of being handed twelve charts, and each item can be argued with because the rule and the figures are on the card.

• Insights that close themselves Module ↗

  Raising the same finding twice updates one row rather than adding another, a finding that stops being true resolves itself and says it closed automatically, and something a person resolved by hand is never reopened by a re-run.

  The stream stays worth opening, because nobody has to dismiss forty warnings about problems they already fixed.

• Tunable thresholds, mutable rules Module ↗

  The number on any rule can be changed per workspace and a rule you do not want can be muted entirely, while the logic itself stays in code where it can be read. Runs are triggered rather than scheduled, and nothing is emailed out.

  You set what counts as a sales drop for your format without inheriting somebody’s unexplainable model.

• Cash-mix spike as a signal, not an accusation Module ↗

  Compares each outlet’s cash share of takings against its own trailing thirty days and raises a warning only on an upward move past your threshold — cash falling is just card uptake.

  The oldest tell in retail gets surfaced against the unit’s own baseline, and it is phrased as look at this.

• Outlet health score with its drivers Partly built Module ↗

  Scores each unit 0–100 from five weighted drivers — royalty settlement, sales against the unit’s own trailing average, audit score, open requests and reporting discipline — each scored 0–100 before weighting, with weights configurable. It is returned by the API and used by the insight rules; there is no console screen for the score itself yet.

  One number sorts forty outlets, and five drivers mean the first question — why is Whitefield a 62 — has an answer beside it.

The home queue

• A “needs you” queue that is cards, not rows

  The home queue returns one card per problem — count, money at stake, at most three named examples and a link to the full list — ranked by severity, and each section is dropped entirely for a viewer who lacks the capability behind it.

  A hundred overdue royalties is one card that says a hundred, not a hundred rows you scroll past; and what a person sees on the home screen is already scoped to what they are allowed to know.

Not built yet — on the plan

Nothing in this group is built yet, and every row is tagged that way. It is here because you will ask, and because a roadmap you can argue with beats one you find out about later — what we build next should be decided by the people paying for it, so tell us which of these actually blocks you.

• The Monday report, in your inbox Not built yet

  A network report — openings at risk, royalty billed and collected, missing reports, audit scores, licences expiring — is scheduled to named recipients on a cadence you set, as a PDF that matches the screen.

  The people who need the number never log in, and a system nobody opens tells nobody anything.

The access kernel

• Forty-seven named capabilities, default deny

  Every action in the product is gated by one of forty-seven named capabilities declared in a single registry, grouped by module, and refused unless granted.

  When you ask whether your area manager can approve a royalty statement, the answer is a named permission you can point at on screen, not a guess about what a role implies.

• Role defaults per workspace type

  Brand, master franchise, area developer, outlet, consultancy and QA workspaces each carry their own role-to-capability matrix, so an outlet trainee, an outlet manager and a brand admin start with different bundles — and an outlet’s roles use outlet words.

  A new store manager gets the right access the day they are added, without anyone deciding permissions from scratch.

• Per-member overrides

  On top of the role default, one capability can be granted or revoked for one named person, recorded with who granted it. A reason is captured when the grant comes from an approved access request.

  You give the finance person royalty and receivables visibility by name, instead of promoting them to admin and handing over agreements, consent and operator seats along with it.

• Desk scoping on the pipeline

  A membership can be limited to one or more desks — investor, brand, advisory, network ops, finance — and an investor- or brand-scoped desk only sees its side of the lead book, enforced in the query. The capability-level desk refusal is built but not yet armed, because no capability is assigned to a desk today.

  Two teams work one pipeline without seeing each other’s book, and the API is what enforces it.

• Explain-the-gate refusals

  A refused action returns why — capability, desk, operator scope, feature not in plan, or AI budget — the capability needed, and the names of the people in that workspace who can grant it. The button greys out and says so rather than disappearing.

  Nobody files a ticket saying "the button is missing". They read who to ask, and ask them.

• Self-service access requests

  From the locked action a user raises a request for the exact capability; an approver approves or denies, and approval writes the override automatically.

  Access changes happen in minutes with a record of who asked, who approved and when, instead of over WhatsApp with no trail.

Configuration you own

• A settings registry of thirty-seven declared keys

  Every configurable setting is declared in code with a key, type, default and validation across identity, locale and money, tax, pipeline, matching, fees, royalty, sales, visits, analytics and candidates — and only a declared key can be written. The India profile is in there: GSTIN with a format check, GST state code 01–38, default SAC, GST rate, expected TDS section and rate, and an April fiscal year start.

  Configuration is a fixed validated list you can walk through, not a free-text blob that drifts per customer — and a bad value is refused at the API rather than found three months later in a report.

• Every settings change is audited

  Each effective change writes one audit row carrying the key, the old value, the new value, the actor and the IP.

  When a royalty variance threshold or a cooling-off window changes, you can see who moved it and from what.

• Tenant vocabularies with safety floors

  Status and category lists across the product — invoice statuses, payment modes, royalty bases, visit types, territory grant types, licence types, finding severities, candidate decline reasons — are editable per organisation, with engine behaviour keyed to a semantic role rather than a label. A set can never be left with zero active values, and a set with a role floor must keep one.

  You rename a stage to what your team calls it and the engine still knows an invoice is open — and nobody can deactivate their way into a system that will not accept a new invoice.

• Custom fields per entity

  Define your own extra fields with typed definitions, ordering, immutable keys and deactivate-rather-than-delete, and every mutation writes an audit row naming the actor.

  The one thing your business tracks that nobody else does gets a real field with real validation, instead of living in a notes box.

• Export, clone and template a configuration

  An organisation’s settings, vocabularies and lead stages export as one payload with no ids and no secrets, which can be applied to another organisation, cloned from an existing one, or saved as a reusable template — with a per-section skip or overwrite policy and a manifest written to the audit log.

  Setting up a second brand, a new master-franchise region or a pilot workspace takes a configuration you already trust, and it never drags users, invoices or commercial terms across with it.

• Plan entitlements and module toggles

  Fifteen module toggles and three numeric limits resolve per organisation as tenant override, then plan, then catalogue default, enforced by middleware on the routes themselves. While a first subscription invoice is unpaid every module gates off and the shell keeps working.

  You buy the modules you run, and a module you have not bought is unreachable at the API rather than merely hidden in the menu.

AI, on a leash

• AI governance panel

  Per workspace: turn individual AI features on or off, pick a model tier, set a monthly budget and a per-user daily budget, see this month’s and today’s spend, and hit a kill switch that pauses AI entirely.

  AI is a line item you control rather than a background cost, and you can stop it for the whole workspace in one click.

• The budget is enforced by the access kernel

  The same check that decides every capability refuses an AI action when the workspace is paused, the feature is off, or the month’s or day’s budget is spent — and says which of those it was.

  A budget enforced where the decision is made cannot be overspent by a user who ignored a banner.

• A usage ledger, successes and failures alike

  Every AI call appends a row with the user, workspace, feature, model, prompt and completion tokens, cost priced per model, status, error and duration.

  You can answer what AI cost you last month, per feature and per person, from the ledger rather than from an invoice.

• Guardrails on every prompt

  A per-user per-minute rate limit, a hard clamp on output length, all field text framed as untrusted data the model must never obey as instructions, and explicit rules against inventing facts or reasoning from protected attributes.

  A rep pasting a customer’s email into a note cannot turn it into an instruction to the model, and a suggestion never quietly invents a commitment you did not make.

DPDP

• An append-only consent ledger

  Consent is a receipt, not a checkbox: each record stores the person, the purpose, the legal basis, the collection point, the method, an evidence bag with IP and user agent, and a hash of the exact notice version shown. Withdrawal appends a new row referencing the grant instead of editing it.

  You can show, per person and per purpose, what was agreed to, when, through which channel and against which notice text — and nothing in that trail can be rewritten.

• Data-principal rights queue with the clock running

  Access, correction, erasure, grievance and nomination requests run through a guarded state machine with a thirty-day response target set at intake — our default rather than a statutory figure, and configurable, because DPDP sets an outer ceiling and expects you to publish the window you will actually keep — plus assignment, identity verification as a first-class step, and an audit row on every edge. Disclosure is withheld until identity is verified, and what is disclosed is a summary of purposes, categories held, processing activities, recipients and retention.

  The window you publish starts its own clock, and the illegal shortcuts are closed by the software rather than by training.

• Erasure that preserves your books

  Erasure is planned before it runs — the confirm screen groups the person’s mapped columns into what will be nulled, what will be tokenised and what is under a statutory hold — then executes per column, appends a withdrawal to every granted purpose, and resolves the request as partially fulfilled when a hold remains.

  You honour an erasure request without deleting a GST invoice you are required to keep for six years, and the request records honestly that a hold remains.

• A PII register kept honest by CI

  Every column holding personal data is declared in a code register with its category, purpose, how rows for a person are located, and its erasure strategy — and a build check fails if a known personal-data column is not mapped.

  The data map cannot go stale, because adding a personal-data column without registering it stops the build rather than quietly creating something erasure would miss.

• Public rights intake with email verification

  Somebody outside the system requests a code by email, verifies it, submits their request, and gets back a reference number and the response window. The receipt never reveals whether any record matched.

  You have a real intake channel rather than an inbox somebody has to watch, and it cannot be used to find out whether you hold data on someone.

Signing in, sessions, language and your subscription

• Sign in with Google

  Members sign in with their Google Workspace account through a redirect-and-callback pair, and the login screen offers the button only when a client id and secret are actually configured, so nobody is bounced to Google’s error page by a half-set-up tenant.

  A head office already living in Google Workspace onboards its team without issuing anybody a second password to forget.

• Your signed-in devices, and one button to cut the rest

  Every session lists with its IP, browser and last activity, with the one you are using marked, and a single action ends every other session on every other device.

  An area manager who leaves, or a laptop left signed in at an expo, is handled by the person who owns the account rather than by a support ticket.

• The whole console in Hindi

  Language is a per-person preference in account settings across six string namespaces, any key Hindi does not carry falls back to English rather than showing a blank, and the choice sets the document language so Devanagari renders in the right face.

  The person at head office and the person at the counter do not have to share a reading language for the same record to be worked by both.

• Your own subscription, self-serve

  Plan, entitlements, seat ledger, every subscription invoice and a payment link sit on a billing screen inside your workspace, and changing plan is an action you take rather than an email you send.

  You can see exactly what you are paying for and what you are using without asking us, which is also how you check we have not quietly added a seat.

Not built yet — on the plan

Nothing in this group is built yet, and every row is tagged that way. It is here because you will ask, and because a roadmap you can argue with beats one you find out about later — what we build next should be decided by the people paying for it, so tell us which of these actually blocks you.

• Enterprise SSO and directory sync Not built yet

  SAML and OIDC sign-in against Okta, Entra or Google, with SCIM provisioning so a leaver loses access when HR closes the record rather than when somebody remembers.

  Your IT function can approve the rollout on its own terms, and offboarding a regional manager is one action in one system.

• The rest of the Indian languages Not built yet

  Tamil, Telugu, Marathi, Kannada, Bengali and Gujarati join English and Hindi as full interface languages, chosen per person.

  A national network stops having its southern and western outlets work in their second language while head office works in its first.

Four settings override the preset sparsely — the industry preset itself, the reporting grain, the channel vocabulary and whether cash-up runs — so absent means inherit. An F&B brand that also does catering adds a channel rather than asking for a new preset.

1. Day one — the workspace exists Your organisation identity, registered address, GSTIN and place-of-supply state code, default SAC and GST rate, and the expected TDS section go into the settings registry. Every generated document reads from there afterwards.
2. Day one — your words Apply a pipeline stage preset or build your own, rename the vocabularies your team argues about — invoice statuses, visit types, licence types, decline reasons — and add the custom fields nobody else would have anticipated.
3. Week one — your network in Import your outlets from CSV against a downloadable template, with per-row errors so one bad row does not sink the file, and import leads through the same validation. Link imported outlets to their franchisee records so royalty and the missing-report board can see them.
4. Week one — the licence register wakes up The statutory library seeds on first use with the brand pack plus your industry’s outlet pack, and the register immediately shows what each unit must hold against what it does.
5. Week two — terms and templates Enter royalty terms per unit with their effective dates, clone the opening pack closest to your format and edit the durations you disagree with, and build the audit template your field team already uses on paper.
6. Month one — the first close Outlets file, you approve, the period closes on the 4th, statements carry their working and invoices carry Rule 46 fields. Anything that looks wrong is a term or a report you can fix and close again, because re-running corrects rather than duplicates.
7. Later — the second brand Export the configuration you now trust and apply it to the next brand, region or pilot workspace, with a per-section skip-or-overwrite policy and a manifest in the audit log. Users, invoices and commercial terms never travel with it.

What you need to hand before we start

• Your GSTIN and the state code you supply from.
• The royalty terms per unit or per model, with the dates they became effective.
• A list of outlets — name, city, status and, for the opened ones, the date they opened.
• Your pipeline stages, if you already have names for them.
• The audit checklist your field team uses today, in whatever form it exists.
• Which modules you actually want switched on to begin with.

Getting configured

• A setup checklist that checks itself off

  Nine items — legal identity, branding, tax profile, team, invitations sent, pipeline stages, first leads, vocabulary, outlets — are computed from your live data rather than ticked by hand, each links straight to the screen that satisfies it, and the meter shows a completion percentage. Anyone can dismiss it for themselves without hiding it from the rest of the workspace.

  Nobody has to remember what a properly configured workspace looks like, and “are we set up” is a number instead of an opinion.

• We are early. This is a young product being deployed with its first brands, not one with a decade of networks behind it. Everything on this page is built and testable in front of you — what we cannot offer is somebody else’s five-year story about running it. Ask what an early-brand arrangement looks like.
• Requests, chat and announcements live inside one workspace. If your outlets run their own consoles, automatic routing between them is not built.
• It is a browser application. It works on a phone, but there is no native app in an app store today.
• There is no file upload except the organisation logo. Licence scans, audit photos and vault documents are referenced, not stored.
• WhatsApp is click-to-chat and scan-to-chat QR only. There is no Business API inbox and no template messaging.
• E-invoicing has columns and a status, and no IRP integration behind them.
• Payment links exist for your own subscription invoices. There is no route today that mints a pay link for an invoice you raise on a franchisee.
• Dunning reminders are recorded against the invoice and written to the franchisee timeline. Outbound email for them is not wired.
• Payroll is a boundary, not a feature. Staff records carry a payroll reference; the product never computes pay.
• Insight runs and analytics rollups are triggered, not scheduled, and nothing notifies anybody — the stream has to be opened.
• An opening project is created and its template applied deliberately. Nothing provisions a journey automatically the moment a lead converts.
• The outlet-side "my opening" view is built and gated in the API, with no screen wired to it yet.
• Chat channels are created by hand. Nothing provisions one per outlet automatically.
• Announcement audiences are stored but not honoured — today an announcement goes to every member of the workspace.
• Master-franchise clearing computes and persists the split rows. Trust-account ledgers and automated remittance are not built.
• Stamp duty has columns on the signing session and nothing that writes them.
• Withholding a mystery-shop report is not settable yet; releasing one is recorded properly.
• SLA clocks measure elapsed time. The business-hours-only flag is stored, but a working calendar is not computed.
• There is no accounting-package sync and no Tally export. What leaves the system leaves as CSV or as a PDF.
• Bulk-imported outlets are outlet records only — they need linking to a franchisee record before royalty and the missing-report board pick them up.
• The brand half of signing — open a session, inspect the certificate, seal it — runs through the API with no console button yet. The signer’s own screen is real and finished.
• A discount request is classified by percentage and the level is stored on it. Nothing routes on that level and nothing blocks on it: today the boundary is who holds the capability to decide.
• A licence record carries a visibility field you can set. Nothing reads it back, so it does not restrict who sees the record — what actually separates your register from an outlet’s is that they are different workspaces.
• POS sales import runs through the API with no console screen, and re-importing the same file adds to the imported figure again rather than replacing it.
• Lead CSV import validates 500 rows at a time through the API. The console’s import screen is wired for outlets, not for leads.
• The tax invoice PDF carries almost all of the Rule 46 particulars. The supplier’s signature block is not drawn on it, and the recipient line prints their city rather than a full address.
• The credit-note cutoff enforces 30 November following the financial year. Section 34 is the earlier of that and the day you file the annual return, and the second limb is yours to watch.

None of that is on a promised date, because a date we cannot keep is worse than a gap we admitted. If one of these is the thing that decides it for you, say so — it moves up the list on merit, not on hope.

That is also how to read the tags earlier on this page. A row marked “Partly built” means the behaviour exists and you cannot reach all of it from a button yet — we can still show it to you. A row marked “Not built yet” means there is nothing to demonstrate: it is on the page so you can tell us whether it belongs at the top of the list. Everything untagged is shipped, and you should ask us to open it.