Company records in personal accounts and unpaid tools: who owns them?

Who owns company records kept in a personal account?#

Company records kept in a personal account are often owned by the company but controlled by the account holder. Under 17 U.S.C. 201(b), the employer is treated as the author of a work made for hire and owns the copyright unless a signed written instrument says otherwise, which generally covers documents an employee writes as part of the job. Copyright is only part of the picture, though: many business records, such as customer lists, prices and job facts, are not protected by copyright at all, and the company's rights to them usually rest on employment and confidentiality agreements, trade-secret law and the systems where the records were created.

Control is a different matter. A personal account's agreement is between the vendor and the individual, the login and recovery options belong to that person, and the company has no admin console to reach the files. Dropbox's terms, for example, tell the account holder that 'Your Stuff is yours' and give Dropbox only the limited rights needed to run the service.

Neither point settles a real dispute on its own. Employment agreements, confidentiality policies, state law and the facts of how a record was created all matter, and they are assessed case by case with counsel.

Where shadow records usually hide#

Shadow records sit wherever work got done fastest. A short survey of managers and a review of expense reports for small software charges usually surface many of them.

• 1Personal Google Drive or Dropbox folders with proposals, price lists and templates.
• 2Free chat or project workspaces a team set up before the company bought a paid tool.
• 3Personal email used with customers, suppliers or carriers, often by founders and early sales staff.
• 4A founder's or early engineer's personal code repositories from before incorporation.
• 5Text messages and messaging apps on personal phones used for dispatch or customer updates.
• 6Free form, survey and spreadsheet tools signed up for with a personal address.
• 7Contractors' own tools where deliverables were drafted and stored.

Risk matrix for records outside company systems#

The risk depends on who created the record, whose account holds it and what personal data it contains. Rank each location on those three before deciding what to move first.

Contractors and founders: the work-for-hire gap#

Contractors and founders create the most common ownership gap. Under 17 U.S.C. 101, a commissioned work counts as a work made for hire only if it falls into listed categories, such as a contribution to a collective work, a compilation or an instructional text, and the parties expressly agree in a signed writing.

Much contractor work, such as code or a process design, may not fit those categories, so companies usually rely on a written assignment of rights instead. Founders who built code, documents or customer lists before the company existed may need to assign them too. Confirm that signed assignments exist before a buyer's diligence team asks for them.

Free plans delete history on their own schedule#

Free plans delete history on their own schedule, whoever owns the content. Slack says free workspaces can view and search only the last 90 days of messages and files, and that messages and files more than one year old are permanently deleted.

Unpaid tools also lack the admin features that make an orderly exit possible: ownership transfer, audit logs, retention settings and full exports. A free workspace a team lead created with a personal address can leave the company with no admin at all once that person leaves. Vendors also change free-tier limits over time, so a workspace that kept everything when it was created may not keep it now.

A plan to consolidate shadow records#

A consolidation plan moves records into company-managed accounts and documents the move. Run it as a project with a named owner, not as an email asking staff to tidy up.

• 1Adopt a written policy that company records live only in company-managed systems.
• 2Survey managers and review software charges to find personal and free accounts in use.
• 3For each location, decide whether to migrate, archive or delete, with counsel on anything sensitive.
• 4Ask account holders to transfer ownership or share files into company storage, then confirm completeness.
• 5Upgrade or convert free workspaces worth keeping, and add a company owner.
• 6Log what moved, from where, by whom and when, and keep the log with the records.
• 7Remove company content from personal accounts once the move is verified.

Illustrative: a freight brokerage pulls dispatch history out of a free workspace#

Illustrative: a fictional freight brokerage grew quickly, and its carrier sales team coordinated loads in a free chat workspace an operations manager had created with a personal email. The founder also handled early shipper relationships from a personal email account.

Preparing for a recapitalization, the COO finds that the free workspace shows only recent history and that older messages are gone. The company upgrades the workspace, makes a company account the owner and exports what remains. The founder moves shipper threads into a company mailbox under a documented process that counsel reviews.

The outcome: diligence receives a short memo listing each former shadow location, what moved and what was lost. The missing dispatch history is disclosed as a known gap rather than discovered by the investor.

How SourceX treats records outside company systems#

SourceX treats records in personal accounts and free tools as out of scope until they are consolidated and documented. In the Rights step of the SourceX five-step transaction (Supply, Rights, Preparation, Approval, Delivery), the question is whether the company can show where each record came from and that it controls it.

That provenance goes into the SourceX Evidence Packet with licensing rights, permitted use, the privacy record and release authorization. Records whose source cannot be traced are left out, which protects the company from a dispute later.