Trello handed over my personal account to my previous company

From the comments, there is some confusion about why did i attach my personal email to a company account. That was not the case, let me clarify it. I created my personal account long before Trello was acquired by Atlassian. It did not have any SSO at that point and the login was with username and password. At some point, while working on a side project and to share it with a teammate, I attached a secondary email to my account and created few boards under it. This email was my companies email @company.com

The multiple account login used to work the same way it works for github now. The boards were very clearly labeled under the email/username they were created and clearly had the ownership well defined. As soon as I left the company and my email was disabled, all the boards under that email disappeared from my account. This was expected and kept using my primary email (i always used to login with my username) and completely forgot about an attached secondary email (which anyways is now deactivated). Fast forward 5 years with tons of personal boards under this account, one morning it stopped working without any notification (yes i revised my spam to be sure about it) with all my data gone.

GitHub did this to me a few years ago. I still feel violated. Not by my idiot former employer. I feel violated by GitHub. I got my account back. Sort of. They detached a significant amount of my content from my account, and returned to me a gimpy lobotomized version of myself.

All my old GitHub comments are credited to “ghost” now. I was somewhere in the first 12,000 GitHub accounts.

My relationship with GitHub significantly predated my dalliance with this one employer years ago. I trusted GitHub. My GitHub account was a formative part of my identity. I still can’t believe it and I still can’t forgive them. I lost some of my sparkle that day.

They emailed me about this back on January 30:

  Subject: Your company ExampleCo will soon manage your Trello account
   
  Good news! Your Trello account is getting an upgrade.
  
  ExampleCo will now manage Trello accounts with a example.com email address,
  which includes yours (mjd+trello@example.com).

The "Good news" part looked like marketing bullshit, but the rest of the message was menacing enough that I was able to contact them by email and get instructions about how to avoid having my personal Trello handed over to ExampleCo.

It still sucks.

The lesson I take from this is: “Software as a service” is always a security risk. Unless my data is on my server, someone else owns it and might sell it to a higher bidder.

This is one of those “fool me twice, shame on me” moments.

Beware the Atlassian's SSO "2 factor authentication" (2fa).

I remember asking them every month years back their hand over to Atlassian - to create / enable backup codes functoonality.

Several months ago after changing countries and phones I discovered that my backup codes didn't work.

Their "support" offered me a "solution" - to delete all my boards associated with my email so that I could create fresh ones.

Zero apologies, zero explanation as of why my perfectly double-backed up 2FA codes were not working, all blames on me the user.

There were sensitive details for approx 16 projects collected daily over the span of 5 years.

That SSO 2FA is flawed the same way across all Atlassian products.

Never again would I trust my data to Atlassian.

WeKan is open source and welcome.

Atlassian, at its core, is a software integrator. They buy stuff and add it to the heaping pile of duct tape garbage they’re schlepping. Trello is just another skull and crossbones on their long list of pillages. It was only a matter of time before the integration got some steam and the atlassian cancer began to take residence.

Sad because it’s my go to tool. It’ll hold on for a while longer but at some point they will turn it into some sort of Jira Kanban+

I have a single E-mail account that I use for everything. I decided more than ~20 years ago that my E-mail is tied to my identity and not to any particular E-mail service or employer, and I started managing my E-mail myself.

Trello just notifided me that:

> At least one of the email addresses linked to your account belongs to an organization: [...] > This usually means it's a work email. If this organization begins using Atlassian products while this email address is linked, your account could become managed by that organization, which means you could potentially lose access. If you don't use Trello for work, just select a non-organizational email.

I use Trello myself, as well as in connection with several organizations. The idea that someone can "claim" and "manage" my account is outright ridiculous.

Even worse, in a show of incompetence, their "Confirm email" link doesn't work (times out because the server is seemingly down).

In this day and age, sharing this community forum discussion here is the only way to get resolution. I'm happy helping people out and tweeting my displeasure with companies, but we need some way to scale this. We can't just help the people that get enough publicity. We think we're helping, and we are, but only a small amount of situations end up getting front paged.

In 2016 I lost access to some repos on bitbucket after a similar occurrence. I made the mistake of using my (student) university email account to register with bitbucket (it was the primary email account I used for everything at the time). At some point, my university apparently decided to use Atlassian services which completely disabled any ability I had to login to that account. I don't know if linking together all accounts under a domain is just the default behavior from Atlassian or if both this former employer and my university decided to screw people over, but either way it's a stupid situation and unsurprising at this point.

Whenever I get a “Good news! We’re changing things” email from Atlassian, I get an ominous feeling.

It typically means they are making some changes to one of their products. The changes don’t benefit me at all, but do cause me disruption.

I think any warm feeling I had towards Atlassian evaporated with the whole HipChat-to-Stride-to-nothing fiasco.

1. “Good news! We are replacing HipChat with Stride, which is a worse product with less features”

2. Soon after, “Good news! To serve you better, we are discontinuing Stride.”

Someone at my company had a Trello account they setup with their work email and recently received an email that said the account was being migrated to an existing Atlassian account. Since her email address matched the domain operated by that Atlassian account all of her todos would be migrated to that account.

Very little information was provided about the migration. My company has multiple Atlassian accounts, so we weren’t even sure which account it was migrating to.

The whole thing was a weird janky process. Anyone with an email address should be able to register for an account and information should never be forcefully migrated or merged. In her case the only way out was to migrate to an account using a different email address.

We had one of these at work earlier this year, except a 3rd party contractor suddenly found that their Atlassian account, including all their other clients, were now listed as part of our account. Neither we nor they wanted this.

After seeing the comment from Blair at Atlassian on Community forum, I also noticed that Support Team replied with a lot more care seeing that the conversation went public. Not good.

In the first stage, they should have already made the right decision, handing over the account to its rightful owner, without any hesitation. I hate companies favoring companies over individuals. I thought this was a mindset of old school businesses, not our current tech ones, the ones that build their success on us.

I was already reviewing new tools for organizing plans, today I'm removing all my boards and closing my account on Trello, as my civil response.

"Apathy is the tyrant's greatest ally."

Trello sent me this email today:

> Using a work email address with Trello

> At least one of the email addresses linked to your account belongs to an organization:

> <redacted>.com

> This usually means it's a work email. If this organization begins using Atlassian products while this email address is linked, your account could become managed by that organization, which means you could potentially lose access. If you don't use Trello for work, just select a non-organizational email.

In my case the "organization" is my personal domain. I'm guessing they classify any email address that isn't with a common free email provider to be a work email address.

So I just clicked on that link with a private browsing window and I'm logged in as someone else in my org's account.

Someone I've never met, talked to or been in the same room as. They live on the other side of the world.

I suspect some sort of IP-based cache has stored their cookie or a set auth-header.

Very creepy, Atlassian.

Always keep separate personal and company accounts. If not for security reasons, then for privacy reasons. Mixing them usually yields little benefit anyway.

The exact same thing happened to me. This was the Trello support team response:

"I've taken a look at your account, and ultimately, the problem is that the email address of your former employer was still attached to the Trello account. In their recent account claim, this triggered your employer to claim ownership of the Trello account, which is something Trello's terms allow Enterprises to do. Because the email address was still on the account, your employer identified it as an account that they should own, and ownership of this Trello account was transferred to your former employer, so no changes can be made to the account, and the company owns that account.

It sounds like you have personal content in this account that you want access to? Given the account ownership, that's not something that we can do on our end, unfortunately. If the company consented, they could remove your account from all company teams, and then we could remove the Enterprise association, but that's something you'd need to explore with them, if they'd be willing to do that."

This is scary. I’m trying to understand - I have several Trello accounts, one that I use for my own personal work and some consulting clients, and several other accounts with @client.com emails. Does this mean that if I have my personal account added as a secondary email anywhere on a client owned board, they can take control of my personal account including other clients’ IP? If so that’s terrifying and we need to find alternatives ASAP.

Easy answer: "An email address attached to your account is being set up for SSO. You must update your account:

1. Remove the example.com address from your account. Warning: You will lose access to all boards shared with this email address.

2. Accept the SSO migration. Warning: You will no longer be able to sign in with your Trello email and password.

OT, but I had this with Azure. My MS account was tied to the AD of a previous customer. Can not access Azure dashboard or services at all. 5 years later and still not resolved, despite numerous e-mails, phone calls, with several people (they even insisted I install a .exe file in order to be able to do screensharing. It took some persistance to make them accept that I shouldn't have to install Windows and install a binary just to be able to restore my account. That was about 6 months ago.

If this is how Microsoft support works for real, no wonder the scammers getting people to install malware are successful).

A reasonably well-known blogging site handed my account to a would-be porn star while I wasn't looking. That link is now way more interesting. And while it was linked to my LinkedIn. Yikes.

The Internet gives, and the Internet takes away.

My company recently started using trello and noted my old login was hijacked somehow and associated with my work domain.

How do I unfuck this situation while still employed with access to both my gmail and wor email?

Seems like unpopular opinion given comments on this thread, but here it is anyway.

Using my employer's email addresses for services I want to control doesn't sound right. Of course, LinkedIn is a different story but for SaaS platforms like Trello, my employer should be the rightful owner of the data I store in there if I used it for work.

Imagine the other scenario, if that Trello account's control didn't move to the employer, the employee would still be keeping the content he created FOR the employer long after his employment has ended. I don't think that is cool.

Your data is your data, likewise, your employer's data is theirs. If you don't want any hassle, keep these two lives different.

If this happened in my country that would breach privacy laws. It might also constitute hacking depending on what kind of administration the company does.

This is fantastic PR for Atlassian.

All their customers present and potential are seeing them do exactly the wrong thing ethically in order to take a side against an individual in favour of an employer.

Big gold star from corporate. Individual developers, rob them, that is fine. The customer is right. The user is not the customer.

The other way around. Taking a firm's IP and denying access to it while giving it to a former employee who did not own it. Words like theft would be bandied about freely.

Oh for the days of the rule of law and equality before it, huh?

The question that I have is... Will the control panel show the multiple addresses and can you delete one off. I just checked both accounts (personal and company) and they seem separate. In everything I do I always keep my work account separate from my personal accounts. I use separate browsers, never check personal email on company PC or network.

What happens if I associate my Trello account with my personal gmail address and two different corporate emails? (from different corporations). Who wins between CorpA and CorpB?

Sounds to me that Trello should have asked users to unlink any old accounts in good time before making this move

Too soon to start talking about Trello Alternatives or should we give them another 5 minutes?

Unbelievable. I've been waiting for the other shoe to drop since the Atlassian acquisition, now strongly reconsidering my Trello usage. What's an easy platform to migrate my data to?

Does anyone have a good suggestion for ergonomic and functional ticket systems you can self host? Preferably with some board management? This is personally my key take away from this.

I have seen 'secure storage' companies pitch to our management that 5,000 users with @example.com emails already use the personal version of the service offered by the company. Now, I'm wondering if we bought the 'enterprise' version of the service if the same thing would happen to these users. If so, it seems the users ought to be given a choice to convert to the enterprise version or change emails beforehand so they can keep their own personal service intact.

I'm not blaming you by any stretch but this just further reinforces my view that everyone should be self-hosting wherever they can.

You simply can't trust any corporation to do the right thing and GAF about people's right to privacy or access to their own information.

I think whoever solves the problem of making it easy to offer web application services while allowing users to own, protect and backup their own data will be rewarded.

Do any accounts have 2 work emails tied to them, I wonder? Would they hand it to Company A, who would gain whatever IP of Company B that was still in the account? Would they arbitrate who gets what?

You know, the one thing nice about using a cloud service is that your data is just there, nice and safe. You know, usually.

I'm on the same boat.

I contacted Atlassian support via my personal email account and they informed me that somehow my subscription is tied to my personal account, but I need to use my former work email to login.

I can't do that, so I've lost access to all my personal boards and apparently to my Gold Subscription too.

This is why I don't use SSO for personal affairs, unless required. The convenience is not worth it to me, especially because I just use a password manager to log me in anyway. The provider will just cut you off at a moment's notice and then tell you to shove it. Besides, logging in is faster than having to be redirected to another page just to use my password manager to log in to my google account, redirect me back and then I'm in...just log in directly.

I also never, ever, for any reason, no matter what, no matter where, or who, or who I am with, or where I am going, or where I've been... ever, for any reason whatsoever link a business email account to a personal account. I use different browser profiles and keep all that stuff segregated.

Heads up: Notion works surprisingly well for trello boards, and they have import functionality straight from Trello. The only thing that didn’t import afaik is card tags/labels that didn’t have a name so I had to reimport after adding names to tags/labels.

This sounds like a major GDPR violation. If they do business anywhere in Europe they could face major fines if someone were to lodge a complaint with a national national data protection authority.

And here is a list of national data protection authorities in Europe: https://edpb.europa.eu/about-edpb/board/members_en

I hear stories like this all the time - I'm all for "cloud" in certain areas, but, there are an increasing amount of companies that either don't care or have short sighted policies.

I really think the future needs to look more at "master" accounts with Azure/AWS and similar services, make it much easier to delegate access to third parties so that the third party contains the core logic/application but the data resides fully with your own account.

Data ownership is so important and overlooked by so many people who want an easy life and want to forget physical servers to look after.

I am far from a lawyer, so would someone with a better understanding of the law explain to me why this wouldn't potentially violate laws around trade secrets?

If someone uses a 'personal' email for setting up their business' trello account (including what could be categorized as trade secrets); and at some point in the future, they added a different companies domain to their account as a secondary login; and then Trello hands everything over to that other company; how isn't that a violation of trade secrets?

Imagine this from the other perspective:

1. You use Trello to track work with your team.

2. You invite your team to use Trello using corporate email accounts.

3. Someone leaves the company. You decommission their corporate email.

4. Five years later, you find out that person still has access to all of your work trello boards.

At this point, I'd be flipping my shit and threatening to sue Trello.

Trello's response would be: sorry, the employee associated a 2nd personal account.

This would be unacceptable from a corporate access control perspective!

In most countries whatever job related work you do is owned by your job (even when you do it at home in your own time).

So never make the mistake to mix private with work.

I don't think Atlassian is to blame here. Maybe they could have communicated this better to the owner of the account. But if you own an account it does not mean you own the content if you used it for work.

I've had a similar thing happen. I got the cheap tier for myself. (first.last@gmail). About the same time, I had a work email (first.last@example).

For some reason, they listed my cheap tier license under the work email. I still have no idea how this happened except for maybe laziness by some Atlassian support person.

Trello has been advertising a lot on some podcasts that I listen to and I was considering using them. Sorry about the problems you are having - good luck with getting them resolved and thank you for posting this as I just crossed Trello off the consideration list :-(

I think this story proofs the saying: Never, ever, ever mix your personal and professional life.

You're a special kind of person if you are concerned about the privacy of your account and also enable your company's SSO on your account. I don't disagree that the conclusion of the story is that it sucks, but the moment you meld your private stuff with your company stuff you're asking for it.

I generally have little sympathy toward people expecting privacy on assets provided by the company, wether that be hardware or software. If you read your private email on a corporate asset, or enable sign-on with a corporate credential, all data can and should be inspected by your corporation. The fact that companies don't MitM _everything_ is what's surprising.

oauth is net negative IMO

Convenience is cool, the fact that one or more third parties has control of your account on the saas service is less cool

also not so hot that it's used for login and information sharing. I had an experience where I read the oauth permissions carefully on a first login, and then on a subsequent login the app included contacts in the permission set. I noticed it too late. Super shady & I'll never use oauth personally again.

So next does Google get to dictate ownership of the Trello account, since there's an @gmail.com login?

Well this was enough to give me some perspective. Time to clean up and delete some accounts. Thank you.

Atlassian is starting to remind me of CA. Acquire something, rebrand it, make it worse.

What about sending Atlassian a cease and desist order, citing copyright law? They are not hosting your personal copyrighted content with your permission any more and have given access of it to unauthorized parties. I think you should consider seeing an IP lawyer. Since they are not being reasonable and are forcing you to legal measures, simply restoring your account is insufficient, you will want a settlement. Each violation of your copyrighted material might be good for $250,000 in fines.

Sounds kinda like the users fault, having a corporate and personal email on the same account. Atlassian probably could put a warning though about the issues that could arise.

This sucks but isn't Atlassians fault. The lesson is of course to never connect an account you don't own to anything you can't afford to lose.

I think atlassian’s position is correct here, sad to say. They had to make a branch cut and i don’t think the other arm would be safe for them (company stuff leaked to a private account). Of course that stuff was already leaked, but I think the liability would fall on Atlassian if the company count delete that stuff.

Don’t connect your personal stuff to your work stuff. That’s messed me up more than once — lesson learned, painfully.