Access Reviews and Audits

JRJ Group Holdings LLC D/B/A UNIFY reviews access to GroFi on a set schedule so accounts that no longer need consumer data are removed.

• Quarterly. Review all admin and editor accounts, production cloud consoles (hosting, database, object storage, email), and any account that can decrypt SSN, date of birth, or EIN.
• Quarterly. Review broker accounts: disable brokers who are no longer partners; confirm pending brokers have not been approved by mistake.
• On termination. Same-day disable of staff identity in GroFi and in hosted consoles.
• After incidents. Extra review of the affected system.

• Whether each user still needs their role
• Whether brokers remain approved and active
• Whether any user can open /admin who should not
• Whether shared or generic accounts exist (they are not allowed for staff)
• Whether MFA is still enrolled on in-scope systems

Each review produces a dated record: reviewer, system, accounts removed or changed, and exceptions. Records are kept for at least one year, aligned with the retention policy.

Management may run additional audits of access logs, failed logins, and document downloads. Findings feed the Information Security Policy annual review.