Who owns the data on Brandfora and how is it protected?

The network owns its data. Stores, orders, customers, artwork and the ledger sit inside the network's own boundary, encrypted at rest and in transit, and leave by API or webhook whenever the network says so.

Tenant isolation keeps each network's records separate, so nothing is pooled and no other network can query across the line. On the admin side, roles decide what each seat sees across the three tiers of network, location and store. Multi-factor authentication protects admin accounts. Impersonation lets a network admin sign in as a location to help them, with a record of who did it and when. The system log keeps the history of everything that happened to an order. API keys and webhooks are how data comes out: orders, stores and customers into your warehouse, your accounting system or whatever else you run.

On a vendor-owned platform the answer to "can we have our order data" is a CSV export, on request, in the shape the vendor chose. Customer records and artwork often stay behind entirely, which is what makes leaving expensive and what keeps a network dependent on a tool it has outgrown.

This matters most to networks whose members are independent businesses, because the trust question is real. A franchisee wants to know headquarters can see the sale and not take the customer. Franchise locations sell direct to their own customers and keep those relationships; headquarters gets visibility of every sale and collects what it is owed. The honest note: we are a growing company, and a security review is a normal part of our sales process rather than a page we point at and move on.

See tenant isolation, the audit trail and API keys.