Published copy of Annex 3 of the Data Processing Agreement · Last updated 15 October 2026
This page is the published copy of Annex 3 of the AllDone Data Processing Agreement: the authoritative list of sub-processors authorised to process Client Data on behalf of client firms. Additions and replacements are made under clause 6.2 of the DPA, on at least 30 days' written notice to client firms, and take effect as updates to this page without re-execution of the DPA.
| Sub-processor | Role | Location of processing | Safeguards |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Cloud hosting, storage, transactional email (SES) and text recognition of scanned pages and photographs (Amazon Textract), with AWS's AI services opt-out applied so that content is not stored or used to improve AWS services | EU (Ireland, eu-west-1; backups held in-region) | UK GDPR Article 28 terms; EU processing |
| Anthropic, PBC | AI model processing of pseudonymised prompts, including redacted page images (Messages API only) | United States | No-training and 30-day deletion under Anthropic's Commercial Terms (DPA incorporated); zero data retention enabled on the Processor's organisation (August 2026): prompts and responses are not stored once the API response is returned, except content flagged by Anthropic's automated trust-and-safety systems or retention required by law, which Anthropic may retain for up to two years; transfer mechanism per clause 13.2 of the DPA |
| Auth0 (Okta, Inc.) | Identity and authentication (staff names, email addresses, roles) | EU tenant | UK GDPR Article 28 terms (Okta's customer DPA, executed August 2026: EU SCCs with UK transfer coverage via its Annex IV; covers Auth0) |
| Intercom R&D Unlimited Company (Dublin, Ireland) | In-app support messaging and the help centre (help.itsalldone.co.uk): the name, work email address, role and firm name of platform users, and whatever a user types into, or attaches to, a support conversation. Client Data is never sent to it by the service; users are asked not to paste client figures or attach client records | United States (workspace hosting region) | Intercom's Data Processing Agreement (UK GDPR Article 28 terms) with the UK Addendum to the EU Standard Contractual Clauses for the transfer |
Customer support conversations run through Intercom (listed above); support staff never ask for, and users are asked never to paste, client figures or documents into a support chat. No analytics or tracking tools process Client Data, so no row is required for those. Companies House (UK government) is a data source the service reads from (director and officer names); no Client Data is sent to it. Netlify (marketing-site hosting only), HubSpot (marketing-website contact-form enquiries only), Microsoft 365, Dashlane, GitHub and Bitdefender process no Client Data and are not sub-processors.
Questions about this list: privacy@itsalldone.co.uk.