Vulnerability Management Policy

JRJ Group Holdings LLC D/B/A UNIFY patches identified vulnerabilities in GroFi and its supporting infrastructure inside a defined service-level agreement (SLA).

• Dependency and runtime alerts on the application and CI
• Provider notices from the application host, database, and object storage
• Code review on changes that touch auth, encryption, uploads, or Plaid
• Reports sent to security@grofi.com

Clock starts when the security owner confirms the issue is real and in scope.

• Critical (remote code execution, auth bypass, or unauthenticated access to consumer data): mitigate or patch within 24 hours.
• High (privilege escalation, authenticated PII exposure, or injection on an in-scope surface): 7 days.
• Medium (limited impact, requires unlikely conditions): 30 days.
• Low (defense in depth, no practical exploit): 90 days.

If a vendor patch is not yet available, we apply a compensating control (disable a feature, block a path, rotate a secret) inside the same SLA, then patch when the fix ships.

GroFi deploys on hosted Node.js. Schema changes go through migrations, not ad-hoc database push, so a stale branch cannot drop production tables. Signing secrets and encryption keys have fail-closed startup checks. After a high or critical patch, we verify the original path is closed before calling the item done.

Report vulnerabilities to security@grofi.com. Include the URL, a short description, and impact on consumer data if any. Do not include live credentials or real merchant files. We will acknowledge reports and tell you when the SLA clock started.