Applicant Tracking System Security Questions to Ask Before You Buy

The applicant tracking system security questions that matter most cover who can see candidate data, how long it is kept, whether you can export and delete it, where it is stored, and which outside companies process it. Ask for answers in writing, and remember that rules differ by country, so check local law.

Why security questions belong in the buying process

An applicant tracking system holds some of the most personal data a business collects: names, addresses, work histories, sometimes photos, ages, salary expectations and notes about people you did not hire. If it leaks, is misused or is kept for years with no reason, the harm lands on candidates first and on your reputation second. Many small teams skip these questions because they feel technical, or because the vendor's website shows a padlock and a list of badges. A badge is not an answer. The questions below are written in plain language so an owner or office manager can ask them, and a vendor who cannot answer them clearly is telling you something. This is a buyer's checklist, not legal advice. Data protection and employment rules differ by country and sometimes by region, and some require notices, lawful reasons, retention limits or reports of breaches. Check local law, and take advice if you are unsure. For related reading see /blog/applicant-tracking-system-implementation-checklist-first-30-days and /blog/ai-resume-screening-compliance-checklist-for-small-employers. We do not state other vendors' security practices as fact, so ask each one directly.

Access control: who can see what

Start with people. Ask whether each user has their own login, or whether accounts are shared. Ask what roles exist and whether you can limit someone to the jobs they work on. A hiring manager often needs to see a shortlist and vote, but not every CV in the company. Ask whether there is a view-only role, whether interviewers can give feedback without a full account, and how access is removed when someone leaves. Ask whether sign-in can be protected by a second step, such as a code from an authenticator app, and whether an owner can require it for everyone or only switch it on for themselves. Ask whether the vendor's own staff can see your candidate data, under what conditions, and whether that access is logged. Finally, ask whether you can see a log of who viewed, changed or exported records. Weak answers include a single shared password, no way to limit access to a job, and no record of who did what. Strong answers describe roles, per-person logins, a second sign-in step and an activity log you can read.

Retention: how long data stays

Candidate data should not be kept longer than you have a reason to. Ask whether you can set a retention period, and whether deletion runs automatically or relies on someone remembering. A good setting lets you choose a period after a job closes, such as a number of months, with an exception for people you hired, whose data moves to the employee record. Ask what happens to backups, and how long deleted data survives in them. Ask what is recorded when something is deleted, so you can show it was done. Ask whether rejected candidates can be removed one by one on request, because people in many countries can ask you to delete their data, and you need a way to do it fast. Many candidates also apply speculatively, and talent pools are a retention risk: keeping people for years because they might suit a future role needs a lawful basis and often their consent in some places. Rules on how long you may keep candidate data differ by country, so check local law and set a period you can defend.

Export and deletion: leaving without losing control

You should be able to take your data out and to make the vendor remove it. Ask what formats you can export, whether export is self-service or a support request, and whether it includes notes, scores, interview feedback and emails, or only names and contacts. Ask whether CV files are included. Ask what happens to your data if you cancel, how long it is kept after cancellation, and how you ask for complete deletion and receive confirmation. Ask whether there is a fee. A vendor that makes export hard is making leaving expensive, which affects your bargaining power at every renewal. Also ask how a single candidate's request is handled: can you export one person's data so you can answer an access request, and delete one person's data on request? Test export during your trial, with real fields, before you commit. A clean export also protects you when you change tools. See /blog/how-to-move-from-a-spreadsheet-to-an-ats-without-losing-candidates for what to check in a file. Rules on access and deletion requests differ by country, so check local law.

Subprocessors, location and transfers

Almost no software vendor runs everything alone. They use hosting providers, email services, analytics tools and, if AI features exist, AI providers. These outside companies that handle your data on the vendor's behalf are often called subprocessors. Ask for the current list, what each one does and where it operates. Ask where candidate data is stored, and whether you can choose a region. Ask what happens when data crosses borders, because some countries limit transfers or require specific safeguards. Ask how you are told when a subprocessor changes, and whether you can object. For AI features, ask which provider receives CV text, whether your data is used to train any model, and whether you can switch AI features off. Ask whether there is a written data processing agreement that you can sign. A clear subprocessor list is a good sign of an organised vendor. A vague answer such as trusted partners is not. The vendor's published security page is a starting point, but confirm the details in writing before you sign.

Encryption, backups, incidents and testing

Some questions are technical but have plain answers. Is data encrypted when it travels and when it is stored? Are backups taken, and have restores been tested? Is there a documented process for a security incident, and will you be told, and how fast, if candidate data is exposed? Many laws set deadlines for reporting breaches, so the vendor's notice time matters. Has an independent party tested the system, and can they describe the result in general terms? Are CV files stored in a way that makes them private by default, or reachable by a link? How are passwords stored, and does the vendor support a second sign-in step? Do not be dazzled by acronyms. If a vendor cites a certification, ask what it covers, and whether it applies to the product you will use. Honest vendors will say what they have and what they do not. Be wary of absolute claims such as unhackable or fully compliant, because no system is, and compliance depends on how you use it. Your own habits, such as password reuse and sharing exports by email, matter as much.

A scoring checklist for buyers

Ask every vendor the same questions and score the answers. Use the table below, with 0 for no or unclear, 1 for partly, and 2 for yes with evidence.

A score of 20 or more out of 24 is strong. Between 14 and 19, ask for fixes in writing. Below 14, walk away. Any zero on deletion or export deserves a direct explanation.

A worked example with example numbers

An example office of nine people is choosing between two trackers. These numbers are examples. The owner sends the twelve-question list to both vendors and asks for written replies. Vendor A answers in two days, shares a subprocessor list, offers self-service export and an automatic deletion period, but has no way to require a second sign-in step for all users. It scores 21. Vendor B answers in a week, replies that it uses trusted partners, offers export through support, and says deletion is available on request. It scores 11. Vendor B is cheaper by a small monthly amount, an example figure. The owner chooses Vendor A, and asks it in writing how it plans to handle the second sign-in gap, and sets her own rule that every user enables the step voluntarily. She sets a retention period before the first job is posted and tests export on the trial data. The cost of the better answer was a few days of waiting and a slightly higher bill. The cost of the weaker one could have been an unanswerable request from a candidate.

Common mistakes

Believing a badge or a padlock is an answer. Skipping the questions because the tool is small or popular. Failing to ask where AI features send CV text. Leaving retention to default, which often means keep forever. Sharing candidate lists by email or chat outside the tool. Giving everyone full access because it is easier. Never testing export. Forgetting to remove leavers. Accepting a contract with no data processing agreement. Collecting more than you need, such as photos, ages or national identifiers, when the job does not require them, because data you never collect cannot leak. Forgetting that your own habits matter: a secure tool does not help if people reuse passwords or forward CVs to personal accounts. Writing the answers down and keeping them with the contract, so that you can show later what you were told. Rules differ by country, so check local law, and ask a lawyer or data protection adviser if you operate in strict regimes.

Where Rezumz fits

Rezumz states several practical controls in its documentation. Two-step sign-in with an authenticator app protects an individual account; an owner cannot yet require it for teammates. The account owner can invite teammates, with shared mode where everyone sees all jobs and candidates, or private mode where each person sees only what they added. Hiring managers can be given view-only access and a review page that does not show CV text. On a job you can set deletion of candidates 3, 6, 12 or 24 months after it closes, with hired candidates kept, and each deletion is written to the audit log. You can download a job's candidates as CSV, and a hire package for a hired candidate. The apply page shows a data notice. Rezumz has a Security page describing how data is stored and who processes it; read it and ask us anything it leaves open. Rezumz is not a fit if you need enterprise controls it does not list. Prices: free plan with 2 free candidate analyses, $29 a month, $199 a year, limited $499 lifetime, and Team at $79 a month or $699 a year for up to 10 teammates. See /pricing and /demo.

When this checklist is not enough

This list suits small and mid-size teams buying a normal hiring tool. It is not enough if you hire in a regulated sector, such as government, defence, finance or healthcare, where formal vendor assessments, audits and contract terms apply. It is not enough if you handle special categories of data, or operate across several countries with different transfer rules. In those cases involve your legal, privacy or security adviser before you sign, and ask for the vendor's formal documentation. It is also not a substitute for your own practice: set roles, switch on the second sign-in step, set a retention period, restrict exports, and train people not to forward CVs. Review the answers each year, and when the vendor changes subprocessors or adds features, especially AI. Security is not a purchase made once. It is a set of questions you keep asking, and a vendor who welcomes them is usually one you can trust.