Multi-location operations
How to give GMs their numbers without exposing the group
Every multi-unit operator hits this. Your general managers cannot improve labour or waste without seeing the numbers that measure them — but the group’s margins, other stores’ performance and wage rates are not theirs to see.
What a GM genuinely needs
| Give them | Withhold |
|---|---|
| Their store’s sales, orders and average check | Any other location’s figures |
| Their labour cost and hours against their budget | Group margins and consolidated P&L |
| Their food cost percentage | Supplier pricing and rebate terms |
| Their own schedule, team and time off | Group-wide wage bands |
| Their store’s reviews and guest themes | Operating expenses like rent and franchise fees |
The principle: a GM should see everything they can change and nothing they cannot. Withholding their own labour cost does not protect anything — it just guarantees they cannot manage it.
Hiding menu items is not access control
The most common implementation is to hide navigation for roles that should not see something. That is a presentation choice, not a permission, and it fails the moment someone types a URL, bookmarks a page, or forwards a link.
Real access control resolves scope at sign-in. The session is bound to a role and a named list of stores before the page renders, so the query never asks for data outside it. That is also the only version a franchisee will accept when their numbers sit in the same database as their neighbour’s.
Three altitudes, not two
Most groups build owner-and-manager and then discover the gap. The middle is where overtime accumulates, because it is where hours cross between locations.
Executive · CEO · CFO
All locations. Fleet-wide monitoring, group reporting, configuration. Full financial visibility including COGS, wage rates and budget variance.
Multi-unit · Area manager
An assigned region. Cross-store rota, shift approvals, POS mapping. Operational figures — labour cost, hourly rates, overtime — but not the group’s P&L.
Store GM
One store, full operating surface: schedule, people, time off, attendance, reviews, their own labour totals against budget. No group financials.
Franchise groups need a fourth answer
Franchising creates three simultaneous truths from one dataset: the franchisor needs network visibility, the franchisee needs privacy from their neighbours, and the GM needs their own store. Most software picks one and forces the others into workarounds — usually a manually-built spreadsheet, sent weekly, by one person.
The workable model is scope assigned per store, alongside role, so a brand can be granted group reporting across the locations that have agreed to it and nothing from those that have not — and one person can hold different standing at different sites.
Three things to insist on
- Scope enforced at the session, not the interface. Ask the vendor directly what happens if a store manager types the URL of a group report.
- An audit log of grants and revocations — timestamp, actor, action, role. Without it, “who could see what, and when” is a matter of recollection.
- Access granted by email address before an account exists, binding on first sign-in. It means a manager starting Monday can be set up Friday with nothing provisioned over the weekend.
And remove the passwords
Restaurant teams turn over quickly and share devices. A password model in that environment reliably produces a sticky note by the till and three people on one login — which makes an audit log fiction. One-time codes to email leave nothing to write down.
Three roles — super admin, admin, store manager — each scoped to a named list of stores and resolved at sign-in. A store manager can view, edit and publish schedules, manage people, approve time off and view reports, but cannot view financials, edit operating expenses or view costs. Every grant and revoke is written to an audit log. Sign-in is by one-time email code; no password is stored.