AllDone publishes three pages you can send straight to a client, an insurer or a procurement team: the security page, the subprocessor list and the privacy policy. It's All Done Ltd is Cyber Essentials Plus certified, and the certificate can be verified on the issuer's own register from the link in the website footer.

Cyber Essentials is the UK government-backed scheme, and Cyber Essentials Plus is its independently tested level: an assessor checks the scheme's controls hands-on (firewalls, secure settings, access control, malware protection and keeping software up to date) rather than relying on the organisation's own answers. It's All Done Ltd has held Cyber Essentials Plus since October 2026. The certificate is issued by The IASME Consortium, and the footer of every page on the website links to the issuer's register so anyone can check it independently rather than take the claim on trust. No other certification is claimed, so a questionnaire asking about a standard not named on the security page should be answered as not held rather than assumed.

The published list covers encryption in transit and at rest with key rotation and encrypted backups; multi-factor authentication for every user; separation between firms enforced in the database itself, with the application running as an unprivileged role; role-based access inside the firm, with destructive actions restricted; malware scanning on every upload that fails closed if the scanner is unavailable; a web application firewall, rate limiting and hardened browser security headers; an append-only audit trail of user actions alongside infrastructure logging, threat detection and monitoring; secrets in a managed store with automated database credential rotation; daily backups with deletion protection in production; and dependency scanning in the build pipeline.

The subprocessor page is the published copy of the annex to the data processing agreement, and it is the authoritative version. Four providers are authorised: the cloud provider that hosts and stores everything, sends AllDone's email and reads scanned pages and photos, processing in the EU; the AI provider, which only ever receives text with names already replaced by reference codes, and page images with names painted over; the identity provider that handles sign-in, on an EU tenant; and the support chat provider, which receives users' names, work email addresses, roles and firm name and whatever they type into a support conversation, never client data. Additions and replacements are notified to firms in advance, and the page is updated rather than the agreement being signed again.

Several other tools the business uses handle no client data and are therefore not subprocessors, which the page says explicitly. Companies House is a source AllDone reads from, not somewhere client data is sent.

Where a question asks something none of those answer, ask AllDone rather than inferring it. An answer that is not on a published page is not one to give on AllDone's behalf.