Menu
No data was found
Whether you’re a one-person operation or a growing business with a full team, we’re here to help. Get in touch and let’s talk about what we can do for you.
Whether you’re a one-person operation or a growing business with a full team, we’re here to help. Get in touch and let’s talk about what we can do for you.
Your database is the business. Most agencies can’t prove who’s been taking it out.
Recruitment has a risk profile that doesn’t look like anybody else’s. Your entire value sits in one database. Your consultants are paid to build relationships they could walk out with. Your team opens unsolicited attachments from complete strangers as a core part of the job. And you hold personal data on thousands of people who never even applied to you. This page is about the three that actually cost agencies money, and the one that could cost you the business.
Consultants leave, and the data goes with them. Every agency owner knows this happens. Very few could prove it afterwards. Restrictive covenants are only as good as your evidence, and if your CRM has no record of who exported what and when, you’re relying on someone admitting it. The conversation with your solicitor goes very differently when you can produce a log.
Your job involves opening files from people you’ve never met. A CV arrives from an unknown address, your consultant opens it, because that is literally the work. No other sector trains its staff to do the risky thing all day every day. Which means filtering and device protection matter more for you, and so does the version of security awareness training that acknowledges your people can’t simply stop opening attachments.
You hold far more personal data than you think. Not just active candidates. Every CV ever received, every speculative application, every scraped contact, going back years. That’s a lot of people with rights you’re obliged to honour, and recruitment is a sector the ICO pays attention to.
And payroll has a hard deadline every single week. If the system that pays your temps can’t run on Friday, several hundred people don’t get paid, and they will not be philosophical about it.
Everything in recruitment comes back to one asset. Losing access to it stops you trading. Losing control of it loses you the margin.
Agencies are bought and sold on the strength and cleanliness of their data. A database with no access controls, no audit trail and no retention discipline is worth less at exit and is a liability in the meantime. Meanwhile a departing consultant with a fortnight’s notice and unrestricted export rights can quietly remove a year of business development.
The security exposure is unusual too. Your inbox is a deliberate open door, your brand is attractive to scammers running fake job adverts, and your team churns fast enough that offboarding is never anybody’s priority.
None of this requires anything exotic. Control who can export what. Log it. Make offboarding a process that runs the same way every time. Protect the devices and the inbox properly, given what your people have to do with it. And know what data you’re holding and why. That protects the asset, improves what the business is worth, and means that when something does happen, you can show exactly what.
Access that matches the role, controls and monitoring around bulk exports and mass downloads, and an audit trail that means a departing consultant’s activity is a matter of record rather than suspicion.
Advanced filtering and attachment handling, device protection that assumes something will eventually get opened, and training pitched at people whose job requires them to open things from strangers.
A process that closes every account on the last day, not just email. Your CRM, your job boards, your LinkedIn seats, your shared drives and anything else on the list.
Two minutes, a handful of questions, covering access, exports and offboarding. Most agency owners don’t like the answer, which is the point of asking before it matters.
Three reasons. You hold a large volume of personal data and you’re in a sector regulators notice. Your inbox is deliberately exposed in a way most businesses’ aren’t, so the strongest email and device protection we offer is proportionate rather than excessive. And if you’re on a preferred supplier list or chasing one, larger employers increasingly require Cyber Essentials from their recruitment suppliers, which Professional includes.
For a small or startup agency, Essential covers complete cloud and email security, real Microsoft 365 backup, device security and your Microsoft 365 Business Premium licence. A sound place to start, and the access control work matters just as much at three consultants as at thirty.
Whichever route, the first conversation is about your CRM: who can get data out of it, whether anyone would know, and what happens on somebody’s last day.
The Professional IT Support Service is for businesses that want the best — complete IT support, the strongest security we offer, and Cyber Essentials tools and certification support all in one package. If you need to protect your reputation, meet compliance requirements, and have confidence your IT is in safe hands, this is it.
Key Features
Every package is unlimited support with no ticket caps and no per-incident charges. Rolling monthly terms are available, longer terms carry a discount, and not-for-profit pricing applies across the range. Current prices are on the package pages.
Who can download candidate and client data in bulk, and a record when they do. This single change is worth more to a recruitment business than almost anything else on this list.
CRM, email, job boards, LinkedIn Recruiter, shared drives, phone, any personal devices holding company data. Run the same way every time, on the last day, not the following week.
Your email is where client relationships, terms of business and payment discussions live.
Because they will. Filtering, sandboxing and device protection that catches what gets through, rather than a policy telling people to be careful.
How long you keep CVs and candidate records, and why. Holding everything forever is the default and it’s the wrong answer, both for risk and for data quality.
Your CRM provider backs up their platform. That is not the same as you being able to recover your data, and the distinction matters enormously.
This is the part that stops most people, and it’s usually smaller than imagined.
Who can access what, who can export, what’s logged, and what happens when somebody leaves. About an hour, no obligation, findings in writing, and most agency owners find it the most useful hour they’ve spent on IT.
Usually quick, usually quiet, and it changes behaviour as soon as people know it exists.
Given what your team has to do for a living, this is where the spend earns its keep.
Unlimited support Monday to Friday, 9am to 5pm, monitoring and patching through the week, and an offboarding process that runs properly every time somebody moves on.
Questions recruitment agencies ask us
If the logging is in place, yes, and that’s exactly why it should be in place before you need it. If it isn’t, we can look at what evidence exists, but it’s usually thinner than people hope. Either way, the first call should be to your solicitor and the second to us, and we’ll work with them rather than around them.
We support everything around it: access, devices, email, integrations, connectivity and your ability to recover your own data. We work alongside your CRM provider’s own support rather than replacing it. We’d also want to look at what export permissions your consultants currently have, because that’s usually set up for convenience rather than for protection.
By accepting it rather than fighting it. Strong filtering so less reaches them, attachment handling that reduces the risk of what does, device protection that limits the damage if something runs, and awareness training written for people who can’t simply refuse to open things. Any provider who tells your team to stop opening unsolicited attachments doesn’t understand your business.
A very bad afternoon, which is why we’d want to know your payroll day and treat it the way an accountant’s January gets treated. No changes near it, everything checked before it, and the system and its data backed up so a problem is recoverable rather than terminal. Our support runs Monday to Friday, 9am to 5pm, so if your pay run regularly happens outside that, it’s worth telling us early and we can look at what arrangement makes sense.
Potentially. You need a lawful basis for holding personal data and a retention period you can justify, and recruitment is a sector where the ICO has taken an interest. We can help you see what you’re actually holding and where. The policy decisions are yours, ideally with proper advice, but we can make them possible to implement rather than theoretical.
Unpleasantly common. Some of it is a legal and platform matter rather than a technical one, but we can help with the technical side, including configuring your domain so it’s harder to spoof your email and advising on what to tell candidates who contact you about it.
Increasingly standard for larger employers. We’ll tell you what’s true today, close the gaps, and give you accurate answers. Cyber Essentials is often what they’re really asking for, and it’s included in our Professional package.
It makes the process matter more, which is the whole point. Starters set up properly on day one, leavers closed down completely on the last day. Once it’s a routine it takes minutes rather than being a scramble.
We don’t work to fixed SLA response times. Within our working hours we work on priority, so something stopping the desk from billing is dealt with ahead of something trivial.
No. You can take any package on a rolling monthly term. Longer terms carry a discount, and the current rates are on each package page, but that’s your choice, not a condition.
We look after recruitment agencies and other people businesses across Bristol, Bath, Cheltenham, Gloucester, Somerset and Swindon, with remote support anywhere in the UK. We’re an NCSC Assured Service Provider, Cyber Essentials Plus certified, and ISO 9001 and ISO 27001 accredited, which is usually what a client’s PSL due diligence is checking for.
Start with an hour on your database. Who can take data out, whether you’d know, and what happens on somebody’s last day. You’ll want those answers before you need them rather than after.
We do your IT are very efficient, friendly and quick. super easy to outsource. they currently look after c20 staff for me and i no longer hate IT! 🙂
RecruitUK