Most of AllDone is not AI: the mapping, the reconciliations, the computations and the schedules apply explicit rules the same way every time. The AI drafts wording, suggests classifications, and helps read the documents you upload. It never receives a file in the form you uploaded it. When it helps read a document it gets text taken from the document and, where a page needs to be seen (a scanned page, for example), an image of that page made for that one request and discarded afterwards. Before anything is sent, known names are replaced with reference tokens, or painted over on a page image, and a hard check blocks the request if personal data remains. The file you uploaded is never altered, and the real names are restored only when your documents are produced.

AllDone reads most documents itself. Where it asks the AI for help, the page text goes through the same replacement as a note. Where a page has to be seen as a picture, AllDone first finds every name and identifier on it and paints over each one before the picture is made, then reads the painted picture back and checks it again. If a name cannot be located on the page with confidence, or the check finds anything left, no picture is sent and the read falls back to you. Figures and dates are left as they are, so the AI can still read the balance.

The client's name, its directors and shareholders, and the customers and suppliers named in its own records, are replaced with numbered placeholders such as a person token or an organisation token. The same person keeps the same token across every note on the job, so a note still reads sensibly to the model without identifying anyone. The client's own name is its own token. A name the platform does not hold, such as a third party mentioned in passing in a note, is not guessed at: the replacement works from the names on the job, so keep incidental third-party names out of notes where you can, and the provider's zero data retention covers what remains. Financial identifiers (account numbers, sort codes, UTRs, National Insurance numbers, IBANs, card numbers, emails, phone numbers) are masked and never mapped back.

Every request, text or picture, passes a personal-data gate before it leaves. It looks for the job's real names in any form, including with the legal suffix dropped or with look-alike characters, and for the identifier shapes above. If anything is found the request is refused and nothing is sent. The name and identifier definitions the gate uses are the same ones the upload scrub uses, so the two cannot drift apart.

On a client call note, the "Model view" control shows the stored note with its placeholders, "exactly what the model sees"; "Partner view" shows it with the names restored for you. The stored note holds the placeholders; the mapping from token to name never leaves the platform.

The AI runs on Claude from Anthropic under commercial terms that exclude training on your data. AllDone's organisation has zero data retention, so prompts and responses are not stored once the answer comes back, with the provider's stated exception for content flagged by its automated safety systems or held where the law requires.