Your company and your kitchen are two different fences
Multi-site traders have two kinds of boundary: the business and the unit. A system can guard one perfectly and leave the other wide open, and from the outside the two look identical.
If you run one kitchen in one hall, you have one boundary and it is obvious. Everything on your side is yours.
The moment there are two of anything, that stops being true, and most hospitality systems grow a second kind of boundary without anybody announcing it. You end up with two:
The business. Your company, your suppliers, your recipes, your invoices. Things that follow you from site to site.
The unit. This kitchen, this till, this week's rota, this shelf's stock. Things that belong to a place.
Why the distinction is not academic
Some records only have one of the two. An invoice from your supplier belongs to your business and to no particular kitchen — it does not make sense to ask which unit an invoice is at. A stock count belongs to a unit and barely to the business at all.
And some records have both. A purchase order is the clearest case: raised by your business, delivered to one kitchen. Ask "whose is this order?" and there are two correct answers.
A document with two owners needs two checks. We learned that by having one.
The expensive version of this lesson
Our purchasing documents had a company check, applied centrally, before any screen got involved. It worked, and we had tested it. For invoices it is the whole answer, because an invoice has no venue — there is nothing else to check.
Purchase orders also carry a venue, and nothing was reading it. So a trader in one hall could reach a trader in another hall's orders, while every note we had said the family was protected. It was protected, against the boundary it knew about.
What makes this worth writing down is not the bug. It is that the half-truth was more dangerous than no information at all: "purchasing documents are guarded" was accurate, reassuring, and stopped anybody looking at the dimension that was missing.
What this means if you are choosing or configuring a system
Ask the two questions separately. Not "is my data separated from the stall next door" — that invites a yes. Instead:
What separates my business from another business? And then: what separates my unit from another unit inside the same business? A franchise with six sites and six managers needs the second one to work.
For each record that matters to you — orders, invoices, stock, rotas, sales — ask which of the two boundaries applies. If the answer is "both", ask how both are enforced. If the honest answer is "one of them, and the other has never come up", you now know where to be careful, which is worth more than reassurance.
The habit on our side
We stopped relying on anybody remembering this. The rule is now derived: for every document type that goes through the central company check, we look at whether that record also carries a venue, and if it does, a venue-level check must be named for it. Add a new purchasing document with a venue on it and the build refuses until somebody has fenced it.
Written-down intentions decay. A check that reads the actual shape of the data does not.