Data Encryption Practices
TLS in transit, AES-256-GCM field encryption for sensitive identifiers, and storage encryption.
1. Purpose
This policy describes how JRJ Group Holdings LLC D/B/A UNIFY encrypts UNIFY data in transit and at rest, including expanded field-level encryption for consumer identifiers used in underwriting.
2. In transit
Production UNIFY is served only over HTTPS/TLS. Authentication cookies are set on that TLS session. Password-reset links are absolute URLs on the configured site origin.
3. Field-level encryption at rest
UNIFY encrypts selected personal identifiers before they are written to PostgreSQL, using AES-256-GCM with a 32-byte key. The stored envelope is versioned and includes a random 12-byte initialization vector and authentication tag. Fields using this control today include:
- Owner Social Security number
- Owner date of birth
- Co-applicant Social Security number and date of birth, when provided
- Business EIN
Encryption runs on write; decryption runs on read for callers who also pass field-level access checks. Those fields are admin-only. A partial update cannot double-encrypt an existing envelope.
4. Storage and backups
The application database and private document buckets encrypt data at rest using the cloud provider’s storage encryption. Application documents, broker documents, and job-application files are not publicly addressable. Public marketing media is stored separately.
5. Key management
The field-encryption key is an environment secret. It is not stored in git. A missing or wrong-length key causes encryption and decryption to fail closed rather than write plaintext. Key rotation is a planned operation: decrypt with the old key, re-encrypt with the new key, then retire the old key.
6. Data leaving UNIFY
Deal-pipeline sync to Monday.com is a redacted payload. It may include business legal name, DBA, industry, requested amount, and similar underwriting summary fields. It must not include SSN, EIN, owner name, email, or phone. See the Privacy Policy.
7. Bank connections
Financial-institution passwords entered in Plaid Link are handled by Plaid, not stored by UNIFY. Account data UNIFY receives from Plaid is transmitted over TLS and stored only as needed to underwrite, under the Data Deletion and Retention Policy.