Published copy of Annex 3 of the Data Processing Agreement · Last updated 12 August 2026
This page is the published copy of Annex 3 of the AllDone Data Processing Agreement: the authoritative list of sub-processors authorised to process Client Data on behalf of client firms. Additions and replacements are made under clause 6.2 of the DPA, on at least 30 days' written notice to client firms, and take effect as updates to this page without re-execution of the DPA.
| Sub-processor | Role | Location of processing | Safeguards |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Cloud hosting, storage and transactional email (SES) | EU (Ireland, eu-west-1; backups held in-region) | UK GDPR Article 28 terms; EU processing |
| Anthropic, PBC | AI model processing of pseudonymised prompts (Messages API only) | United States | No-training and 30-day deletion under Anthropic's Commercial Terms (DPA incorporated); zero data retention enabled on the Processor's organisation (August 2026): prompts and responses are not stored once the API response is returned, except content flagged by Anthropic's automated trust-and-safety systems or retention required by law, which Anthropic may retain for up to two years; transfer mechanism per clause 13.2 of the DPA |
| Auth0 (Okta, Inc.) | Identity and authentication (staff names, email addresses, roles) | EU tenant | UK GDPR Article 28 terms (Okta's customer DPA, executed August 2026: EU SCCs with UK transfer coverage via its Annex IV; covers Auth0) |
Customer support is handled in-app on It's All Done Ltd's own infrastructure, and no analytics or tracking tools process Client Data, so no rows are required for either. Companies House (UK government) is a data source the service reads from (director and officer names); no Client Data is sent to it. Netlify (marketing-site hosting only), HubSpot (marketing-website contact-form enquiries only), Microsoft 365, Dashlane, GitHub and Bitdefender process no Client Data and are not sub-processors.
Questions about this list: privacy@itsalldone.co.uk.