The email we send, and why.
If you have had an email "via Trojan CRM", a building firm you deal with sent it to you through its job system. Here is exactly what we send, how we look after it, and where your data lives.
What we send
Trojan CRM is job software for building firms. The only email it sends is a document a firm chooses to send, one at a time, from inside the system:
- Quotes, to the firm's own customer who asked for one.
- Invoices, to the firm's own customer for work done.
- Purchase orders, to the firm's own suppliers and subcontractors.
Each email carries the document as a PDF. That's all. We never send marketing or newsletters, and we never send to bought, rented or imported lists. There is no way in the system to email a list of people at once.
Who it comes from
Email is sent from trojan-crm.co.uk through Amazon Simple Email Service (SES) in London, on the firm's behalf. The sender shows the firm's name followed by "via Trojan CRM", for example Oast & Weald Building Ltd via Trojan CRM <[email protected]>.
Replies go straight to the firm's own mailbox, not to us. If you want to talk about the quote, invoice or order, just reply.
A firm can instead connect its own Microsoft 365 mailbox, in which case its documents come directly from the firm's own address.
Bounces and complaints
Each firm is kept separate in Amazon SES, with its own sending reputation and its own list of addresses not to email. When an email cannot be delivered permanently (a "hard bounce"), or when someone marks it as spam:
- the system records it automatically, the moment Amazon reports it;
- it then refuses to email that address again for that firm;
- and it shows the firm why, next to the person's details and on the document, so the firm can contact them another way.
We keep a plain summary of what happened, never the content of the bounce message from the receiving server.
If you got an email you didn't expect
Reply to it to reach the firm that sent it. If that doesn't resolve it, or you think our system has been misused, email [email protected] with the date, the sender name and the address it came to. We will look into it and, where a firm has broken our rules on sending, stop it.
Where data lives, and who handles it
- Hosted in London. The system and its databases run on DigitalOcean in London. Email is sent through Amazon Web Services in London.
- One database per firm. Each firm has its own separate database with its own credentials. Firms never share one, so one firm's records cannot appear in another's system.
- Encrypted in transit. Pages are served only over HTTPS, and the system's connection to its database is encrypted and verified.
- Passwords are stored only as strong one-way hashes, and sign-in is rate-limited against guessing.
- Who decides what's kept. The firm decides what goes into its system and holds its records about its own customers and suppliers. We look after them on the firm's behalf (in data protection terms, we are the firm's processor). Our privacy policy has the detail.