5 ms·

They emailed me about this back on January 30: Subject: Your company ExampleCo will soon manage your Trello account Good news! Your Trello account is g

by mjd 7y ago

They emailed me about this back on January 30: Subject: Your company ExampleCo will soon manage your Trello account Good news! Your Trello account is getting an upgrade. ExampleCo will now manage Trello accounts with a example.com email address, which includes yours (mjd+trello@example.com). The "Good news" part looked like marketing bullshit, but the rest of the message was menacing enough that I was able to contact them by email and get instructions about how to avoid having my personal Trello handed over to ExampleCo. It still sucks. The lesson I take from this is: “Software as a service” is always a security risk. Unless my data is on my server, someone else owns it and might sell it to a higher bidder. This is one of those “fool me twice, shame on me” moments.

deleted 7y ago
[deleted]
cbhl 7y ago
I feel pretty lucky that I've only ever used Trello with one ExampleCo -- so when I got this email, I signed in, removed myself all ExampleCo boards, and deleted my old ExampleCo email address from my account. This process isn't too bad if you actively work at ExampleCo, but if you left it years ago and are still on some boards... yuck.
LeifCarrotson 7y ago
My takeaway is that you shouldn't link personal data to an example.com email address.
dx034 7y ago
Isn't it standard to open separate accounts for companies? My employers would've never even allowed me to use a personal account or personal email for business content. In the end, they need to be able to claim the content if an employee leaves the company. Mixing personal and company accounts or even accounts of several employers sounds dangerous to me.
- mjd 6y ago
  I opened the account with my personal address. Then later, I added a secondary email address to it so that I could post items to my personal account by emailing them from my work email. I didn't realize that Trello would interpret this as the account now being owned by my employer and, in hindsight, I don't think I could have foreseen this.
- geocar 7y ago
  > Isn't it standard to open separate accounts for companies? I understood that these were separate accounts in separate systems, they just had the same email address attached to both because it was convenient to log into each system from separate workstations - a little bit like using a company phone for a personal telephone call. When one company (Atlassian) acquired the other (Trello), the "accounts" were merged by someone who has no taste. > In the end, they need to be able to claim the content if an employee leaves the company. I don't agree with this at all, and thankfully tort doesn't work this way. > Mixing personal and company accounts or even accounts of several employers sounds dangerous to me. Indeed. This is a big reason why I don't like to create "free" accounts, because I know unless I pay them, I cannot sue them for fucking something like this up.
  - rileymat2 7y ago
    Why is payment relevant to lawsuits?
    - naasking 7y ago
      Easy to show you suffered financial loss, potentially also makes for a strong contract violation case.
  - pdonis 7y ago
    > I understood that these were separate accounts in separate systems That's not what I'm seeing in any of the examples discussed in this thread. What I'm seeing is one account which started out as a personal account, then the person added their work email to it so they could get access to their employer's data through that account--instead of creating a separate work account under their work email. Now their "personal" account isn't just personal any more; they have given their employer a means of controlling it, since their employer controls their work email. And then they have problems down the road. The solution to those problems is to never attach an email you don't control to an account you want to have sole control over.
Kiro 7y ago
I got the same and it also said: "Use another Trello account for anything not related to [my previous company]. Grab a new, free Trello account in seconds and move your vacation board (or whatever should be elsewhere!) to that one." My former company is not even using Trello and everything I have there is personal. I created the Trello with my personal email and only afterwards added the company email to it to access some experimental board we never ended up using. I didn't comply and instead just removed the company email from the account. I seriously don't see why I need to create a new account and move stuff for no reason at all. Why does the organisation email trump my personal one that I actually created the account with? Should I be worried?
- TeMPOraL 7y ago
  > Why does the organisation email trump my personal one that I actually created the account with? Because the organization a) pays them money, and b) demands this. Enterprise offerings like SSO tend to support the legal and pseudo-legal aspect of the security theatre of enterprise space. So if you connect a company e-mail to your personal account, that account suddenly falls under whatever random policies organization's IT team implemented.

by mjd 7y ago

deleted 7y ago

[deleted]

cbhl 7y ago

I feel pretty lucky that I've only ever used Trello with one ExampleCo -- so when I got this email, I signed in, removed myself all ExampleCo boards, and deleted my old ExampleCo email address from my account. This process isn't too bad if you actively work at ExampleCo, but if you left it years ago and are still on some boards... yuck.

LeifCarrotson 7y ago

My takeaway is that you shouldn't link personal data to an example.com email address.

dx034 7y ago

Isn't it standard to open separate accounts for companies? My employers would've never even allowed me to use a personal account or personal email for business content. In the end, they need to be able to claim the content if an employee leaves the company. Mixing personal and company accounts or even accounts of several employers sounds dangerous to me.

mjd 6y ago
I opened the account with my personal address. Then later, I added a secondary email address to it so that I could post items to my personal account by emailing them from my work email. I didn't realize that Trello would interpret this as the account now being owned by my employer and, in hindsight, I don't think I could have foreseen this.
geocar 7y ago
> Isn't it standard to open separate accounts for companies? I understood that these were separate accounts in separate systems, they just had the same email address attached to both because it was convenient to log into each system from separate workstations - a little bit like using a company phone for a personal telephone call. When one company (Atlassian) acquired the other (Trello), the "accounts" were merged by someone who has no taste. > In the end, they need to be able to claim the content if an employee leaves the company. I don't agree with this at all, and thankfully tort doesn't work this way. > Mixing personal and company accounts or even accounts of several employers sounds dangerous to me. Indeed. This is a big reason why I don't like to create "free" accounts, because I know unless I pay them, I cannot sue them for fucking something like this up.
- rileymat2 7y ago
  Why is payment relevant to lawsuits?
  - naasking 7y ago
    Easy to show you suffered financial loss, potentially also makes for a strong contract violation case.
- pdonis 7y ago
  > I understood that these were separate accounts in separate systems That's not what I'm seeing in any of the examples discussed in this thread. What I'm seeing is one account which started out as a personal account, then the person added their work email to it so they could get access to their employer's data through that account--instead of creating a separate work account under their work email. Now their "personal" account isn't just personal any more; they have given their employer a means of controlling it, since their employer controls their work email. And then they have problems down the road. The solution to those problems is to never attach an email you don't control to an account you want to have sole control over.

Kiro 7y ago

I got the same and it also said: "Use another Trello account for anything not related to [my previous company]. Grab a new, free Trello account in seconds and move your vacation board (or whatever should be elsewhere!) to that one." My former company is not even using Trello and everything I have there is personal. I created the Trello with my personal email and only afterwards added the company email to it to access some experimental board we never ended up using. I didn't comply and instead just removed the company email from the account. I seriously don't see why I need to create a new account and move stuff for no reason at all. Why does the organisation email trump my personal one that I actually created the account with? Should I be worried?

TeMPOraL 7y ago
> Why does the organisation email trump my personal one that I actually created the account with? Because the organization a) pays them money, and b) demands this. Enterprise offerings like SSO tend to support the legal and pseudo-legal aspect of the security theatre of enterprise space. So if you connect a company e-mail to your personal account, that account suddenly falls under whatever random policies organization's IT team implemented.