Access Control Policy

This policy defines how JRJ Group Holdings LLC D/B/A UNIFY grants, limits, and revokes access to GroFi systems that store or process consumer and merchant data.

• Least privilege: a user receives only the access their role needs
• Need to know: merchant PII is not visible to users who do not underwrite or administer it
• Fail closed: missing role, missing approval, or unknown identity is a deny
• No shared staff accounts

GroFi uses a single user directory with these roles:

• Admin. Full access to applications, documents, users, and system settings. Encrypted SSN, date of birth, and EIN decrypt only for this role. Admins approve brokers and manage funding files.
• Editor. Staff access to the admin application for content and operational work that does not include admin-only PII fields. Editors cannot open the admin panel unless the role is editor or admin.
• Broker. Self-registered, pending until an admin sets approval. Brokers cannot use /admin. They see only applications they own. They cannot read encrypted owner SSN or date of birth. They cannot submit deals until approved and until onboarding documents and the ISO agreement are complete.

Access is enforced in the application layer on every collection:

• Users: admins manage all records; other authenticated users read only themselves
• MCA applications: admins see all; brokers are scoped to their own `broker` relationship
• Encrypted identity fields: field-level read limited to admins
• Application documents, broker documents, and job-application files: private storage, not a public URL
• Statement analyses: admin only
• Public create is limited to intended entry points (contact, merchant apply, broker signup, job apply)

Broker signup forces `role: broker` and `brokerApproved: false` on the server. A client cannot self-promote to admin. Deal-preference updates write only to `req.user.id`. Offer tokens on the public offer page expose business name and terms, not owner PII, and can only move a deal from offer-sent to accepted or declined.

Production hosting, database, and object-storage consoles are limited to staff who operate GroFi. Secrets are not committed to the repository. The Payload signing secret must be at least 32 characters or the application will not start.

Identity and Access Management · Access Reviews · MFA