Information Security Policy

1. Purpose

This Information Security Policy (ISP) is the umbrella security program for JRJ Group Holdings LLC D/B/A UNIFY’s operation of UNIFY. It exists so consumer and commercial data used in underwriting is protected with defined, documented controls.

2. Scope

This ISP covers:

• The UNIFY web application, admin application, and broker portal
• Production databases, object storage, email, and deal-pipeline integrations
• Staff, contractor, and broker access to those systems
• Merchant, owner, broker, and candidate personal information

3. Roles

• Management. Approves this ISP, provides resources, and reviews exceptions.
• Engineering / security owner. Implements controls, triages incidents, and keeps this policy and its child policies current.
• Staff and brokers. Use assigned accounts only, protect credentials, and report suspected incidents to security@unifyfg.com.

4. Policy statements

• Access is role-based and least-privilege. See the Access Control Policy.
• Identity is centralized in UNIFY’s user directory. See Identity and Access Management.
• Data is encrypted in transit and sensitive fields are encrypted at rest. See Data Encryption Practices.
• Retention and deletion follow the Data Deletion and Retention Policy.
• Access is reviewed on a schedule. See Access Reviews and Audits.
• MFA is required on internal systems that store or process consumer data, and on any consumer-facing UNIFY surface where Plaid Link is deployed.
• Vulnerabilities are patched inside a defined service-level target.

5. Asset and data handling

Production UNIFY runs on hosted infrastructure, including application hosting, PostgreSQL, and S3-compatible object storage. Secrets—including database URLs, field-encryption keys, signing secrets, and object-storage credentials—are environment variables, not source control. Application documents, broker onboarding files, and job-application files use a private bucket with application access controls enabled. Public media uses a separate bucket.

SSN, date of birth, and EIN are stored only in UNIFY, encrypted, and readable by authorized admins. They are not written to the Monday.com deal board.

6. Acceptable use

Staff may access merchant data only to underwrite, service, support, or secure a file. Data may not be copied to personal devices, unsanctioned chat tools, or spreadsheets. Brokers see only deals they own.

7. Incident response

Suspected unauthorized access, malware, lost credentials, or misdirected personal information must be reported to security@unifyfg.com immediately. The security owner triages, contains, documents, and, where law requires, notifies affected people and regulators. Plaid-related incidents that involve connected-account data are treated as high severity.

8. Exceptions and review

Exceptions require written management approval and an expiry date. This ISP is reviewed at least annually, and after a material incident or architecture change.