Access Control Policy
Role-based access, least privilege, and how UNIFY staff and brokers reach merchant data.
1. Purpose
This policy defines how JRJ Group Holdings LLC D/B/A UNIFY grants, limits, and revokes access to UNIFY systems that store or process consumer and merchant data.
2. Principles
- Least privilege: a user receives only the access their role needs
- Need to know: merchant PII is not visible to users who do not underwrite or administer it
- Fail closed: missing role, missing approval, or unknown identity is a deny
- No shared staff accounts
3. Roles
UNIFY uses a single user directory with these roles:
- Admin. Full access to applications, documents, users, and system settings. Encrypted SSN, date of birth, and EIN decrypt only for this role. Admins approve brokers and manage funding files.
- Editor. Staff access for content and operational work that does not include admin-only PII fields.
- Broker. Self-registered and pending until an admin sets approval. Brokers cannot use the admin application. They see only applications they own, cannot read encrypted owner SSNs or dates of birth, and cannot submit deals until approved and onboarding is complete.
4. Collection and field controls
Access is enforced in the application layer on every collection:
- Users: admins manage all records; other authenticated users read only themselves
- Commercial financing applications: admins see all; brokers are scoped to their own broker relationship
- Encrypted identity fields: field-level read is limited to admins
- Application documents, broker documents, and job-application files: private storage, not a public URL
- Statement analyses: admin only
- Public creation is limited to intended entry points such as contact, merchant application, broker signup, and job application
5. Broker and public boundaries
Broker signup forces the broker role and pending approval on the server. A client cannot self-promote to admin. Deal-preference updates write only to the authenticated broker’s own record. Offer tokens on a public offer page expose business name and terms, not owner PII, and can only move a deal from offer-sent to accepted or declined.
6. Infrastructure access
Production hosting, database, and object-storage consoles are limited to staff who operate UNIFY. Secrets are not committed to the repository. Application signing secrets must meet required length and strength checks or the application will not start.