Quick answer
Client data is stored on AWS infrastructure in the EU, in the Ireland region, with backups held in the same region. It is encrypted in transit and at rest. Each firm's data is isolated from every other firm's in the database itself, not only by contract, and every sign-in requires multi-factor authentication.
What the public security page states
AllDone's Trust & security page, the sub-processor list and the privacy policy set out the position, and this article repeats only what they say.
Hosting. Amazon Web Services, EU (Ireland), for cloud hosting, storage and transactional email, and for reading scanned pages and photos (Amazon Textract, inside AllDone's own AWS account, with AWS's opt-out applied so the content is not kept or used to improve AWS's services). Processed files and generated working papers are stored in that region, encrypted at rest with managed keys and in transit with TLS.
Isolation between firms. Access is least-privilege, with row-level isolation between firms enforced in the database, and the application connects as an unprivileged role. One firm's data is never visible to another.
Sign-in. Multi-factor authentication for every user, every time. Authentication is operated by the identity provider on an EU tenant; AllDone never sees or stores your password.
Uploads. Every uploaded file is scanned for malware before acceptance. The raw upload sits in a quarantined area only for the duration of the request and is deleted immediately after processing, with a one-day automated deletion rule behind that.
Environment. A dedicated, isolated cloud environment with its own keys and access controls, shared with nothing else, with application and infrastructure audit trails retained and reviewable.
Backups. Automated daily backups, with point-in-time recovery for the database and a rolling retention for file-system backups, and deletion protection in production.
The sub-processors
The published sub-processor list names four: Amazon Web Services (hosting, storage, email and text recognition of scanned pages, EU Ireland), Anthropic (AI model processing of pseudonymised prompts, including page images with names painted over, United States, under no-training terms with zero data retention on AllDone's organisation), Auth0 by Okta (identity and authentication, EU tenant) and Intercom (the in-app support chat and the help centre: users' names, work email addresses, roles and firm name and what they write in a support conversation, never client data, United States). Companies House is a data source AllDone reads from; nothing is sent to it. Changes to the list are made on written notice under the Data Processing Agreement.
Your position
You remain the data controller for your clients' information. AllDone processes it on your instructions as your processor under its Data Processing Agreement.
Related