Privacy and security
Candidate data, handled with care
Interviews, CVs and transcripts are personal data. SmartRecruits limits who can see them, records who did, and deletes them on schedule.
How we protect it
Controls built into the product
Signed candidate linksInvite links are signed, expire after 14 days and can be revoked. An invalid link reveals nothing about why.
Role-based accessStaff see only their own organisation's roles and candidates, with admin and recruiter roles.
Recordings for staff onlyInterview recordings and transcripts are available only to your staff, never to other organisations.
Audit logEvery action is written to an append-only log you can filter and export.
No model trainingCandidate data is not used to train AI models.
Independently certifiedBuilt by Sendient, certified to ISO 27001 and ISO 9001, with Cyber Essentials Plus.
Independently certifiedView certifications
Retention
What happens when the retention period ends
The retention period starts when a role closes. It uses the number of days the candidate was shown when they consented. When it ends, SmartRecruits deletes the application's data automatically.
Deleted
- CV files and text
- Interview recordings and transcripts
- Assessments, plans and meetings
- The candidate's name, email and sign-in link
- Personal details in audit entries
Kept
- A record that the application existed, with its dates and status
- The consent records, which cannot be changed
Questions about compliance?
Talk to us about your obligations
We're happy to share documentation and talk through how SmartRecruits supports your EU AI Act and UK GDPR obligations.