How we look after your data

Overview

MyReflo helps BNI members log referrals and run meetings. You sign in with a MyReflo account. If you choose to, you can also connect BNI Connect and your job or invoicing system (ServiceM8, Halo, Xero, or Formitize).

We do not keep a copy of your whole job book or of BNI Connect. MyReflo looks up what it needs at the time, and keeps only a small working record — for example the job number, the amount, the referrer’s email, and whether the referral has been logged.

How your information is looked after

You always use https://bni.myreflo.com. SSL encrypts the connection between your browser and MyReflo.
Your MyReflo password is stored as a one-way hash. Nobody on the team can read it. If you forget it, you get a one-hour, single-use reset link — we never email the password itself.
BNI Connect and job-system passwords or keys you choose to save are encrypted in our database, and only unlocked when MyReflo needs to talk to that system for you.
If a referrer who is not on MyReflo uses a claim link, they type their BNI login once. We use it to complete the referral and do not save that password.
Claim links expire after 7 days and work only once.

Who can see your workspace

You — and any staff you invite from your company email — see your company’s workspace.
Other MyReflo members cannot see your job-system details or your job list.
Chapter meeting tools use the same roster already in BNI Connect (names, companies, emails, and phones).
A small support team can approve new accounts and, if you need help, look at your workspace the way you see it. They cannot read your stored passwords.

Extra care built in

New accounts are approved before they get full access.
Repeated failed logins or claim attempts are automatically slowed down.
Emails come from bni@myreflo.com, and you can unsubscribe from automation mail.
The site only runs over HTTPS, and browsers are asked not to embed it in other websites.

A few simple habits that help

Choose a unique MyReflo password (at least 8 characters).
Connect BNI Connect or your job system when you are ready for MyReflo to log and update referrals for you.
Keep claim and password-reset emails to yourself — the link is your key, and it only works once.

Technical details

MyReflo is built so members can connect BNI Connect and their job system with confidence. Traffic is encrypted, logins are hashed, integration secrets are encrypted at rest, and each company’s workspace is kept to that company.

Hosting and boundary

Public site: https://bni.myreflo.com, served over SSL.
Nginx terminates SSL and reverse-proxies to the application container.
The application listens on localhost only. Public traffic reaches it only through nginx.
Forwarded-client headers are accepted only from private peers, so the public internet cannot spoof them.
Production API documentation is turned off.

What is stored, and where

Customer data lives in a dedicated MyReflo database on the application host. Each company is scoped to its own account (logical tenancy).

MyReflo does not keep a full copy of BNI Connect or the job system. It reads what it needs from those APIs when it needs it, and keeps a small, purposeful working set:

Account identity email, name, company, role, approval status Login password is bcrypt — stored as a one-way hash, never plaintext.

Integration secrets BNI Connect password; ServiceM8 / Formitize API keys; Halo client secret; Xero client secret + refresh token Encrypted at rest; decrypted only for the outbound call.

Slim job ledger job id, job number, amount, referrer email, process status, BNI tracking id Enough to automate referrals — not invoices, notes, or attachments.

Claim / reset tokens guest claim links; password-reset tokens Reset tokens stored as SHA-256; claim tokens are random, one-time, and expire in 7 days.

Chapter cache roster name, email, phone, company, category, photo id The same chapter details already held in BNI Connect, reused for meeting tools.

Email archive outbound message copies Available for admin support; claim links stop working once used or expired.

Analytics visitor key, IP, user-agent, path First-party only — no third-party trackers.

Meeting ops check-ins, seating, lucky-door results Lucky-door rows are removed after about four weeks.

If someone who is not a MyReflo member uses a claim link, their BNI password is used in memory to complete the log and is never written to the database.

Confidentiality of secrets

MyReflo passwords use bcrypt (minimum 8 characters). Nobody can read them back.
Third-party credentials use Fernet (AES-128-CBC + HMAC-SHA256). They stay encrypted in the database and are decrypted only for the API call that needs them.
Password-reset links are 32-byte random tokens, hashed in the database, valid for one hour, and single-use. A new request invalidates unused links. The form always shows the same “if that email exists…” message, so accounts cannot be probed.
Guest claim links are 32-byte random tokens, single-use, and expire after 7 days. Attempts are rate-limited.
Secrets are not stored in source control. Passwords, session tokens, and cookies are not written to logs. Xero tokens are never logged; when Xero rotates a refresh token, MyReflo re-encrypts it before saving.
Only operators who administer MyReflo have host access. Integration secrets remain encrypted in the database until the application needs them.

Transport and browser hardening

HTTP is redirected to HTTPS, with HSTS (max-age=31536000; includeSubDomains).
Browser headers lock down framing, MIME sniffing, referrers, and camera/microphone/geolocation.
Content-Security-Policy is in report-only mode while it is tightened.
Login, register, claim, and public meeting routes are rate-limited at nginx and again in the application (for example: 8 login attempts per email+IP in 15 minutes).

Sessions and access control

Sessions use a signed HTTPS-only cookie (SameSite=Lax, HttpOnly). Production will not start unless sessions are HTTPS-only.
The session is rotated on login and register, and cleared on logout. Disabled or rejected accounts are signed out immediately.
next= redirects are limited to local paths.
State-changing requests must come from MyReflo’s own origin (CSRF protection). Webhooks, analytics beacons, and one-click unsubscribe are the only exceptions.
Credentials and company data live on the company owner. Invited staff work in that workspace but cannot open credential or settings screens. Staff must use the company’s email domain (or an approved alias).
New accounts stay pending until they are approved.
Platform administrators can step into a workspace to help with support; while they do, admin tools are locked. Administrators cannot impersonate one another.
Halo connection URLs must be HTTPS and must resolve to a public host.

How MyReflo talks to other systems

With the credentials a member chooses to save, MyReflo can:

BNI Connect — log referrals, update tracking and TYFCB, and refresh chapter roster and meeting reports.
Job systems (ServiceM8, Halo, Xero, Formitize) — read jobs or invoices that have a referrer, then match or log them in BNI.

Mail is sent from bni@myreflo.com.

Designed-in limits (by choice)

Claim links are meant to be private (like a reset link). They work once and then stop.
Meeting tools reuse the chapter roster already in BNI Connect.
First-party analytics records IP and path so we can keep the product reliable.
Lucky-door results are cleared after about four weeks. Outbound email copies are kept so support can confirm what was sent.