Security and compliance
Candidate data: one record, one chain of custody
Candidate and employee data in most recruitment businesses is decentralised: the CRM, the ATS, consultants’ inboxes, spreadsheets, job board exports and personal devices each hold a copy, and nobody can say where all of it is. That makes subject access requests slow, retention rules unenforceable, breaches wider than they should be, and AI governance impossible, because a model cannot be governed against data nobody has inventoried. Hexploits consolidates candidate data into a single governed record with a chain of custody: where each record came from, who has touched it, what it is being used for, and when it will be deleted.
A named engineer replies within one working day. A written scope and an indicative price within two.
Who this is for
- Agencies and RPOs with candidate data spread across CRM, inboxes, spreadsheets and job boards.
- HR software vendors whose customers ask where their candidates’ data goes.
- Data protection officers handling subject access requests by searching mailboxes.
- Firms preparing for EU AI Act or ISO 42001 work that keeps stalling on the question of what data exists.
What you get
Deliverables, not slogans. Each one appears in the statement of work.
- A data inventory: every system, export and device that holds candidate data, with owner, purpose and lawful basis.
- A single candidate record, integrated with the CRM and ATS you already run, with every source recorded against the fields it supplied.
- A chain of custody on each record: origin, every access and change, every use including by AI, and the deletion date, in an immutable log.
- Retention enforced by the system: records deleted or anonymised on schedule, with written confirmation.
- Subject access and erasure requests answered from the record in hours rather than from mailboxes in weeks.
- Access by named accounts and role, so a leaver’s access ends the day they leave.
Our engineers work across the major languages, frameworks and cloud platforms. We build on the stack you already run, with technology choices explained in writing before work begins.
How it is delivered
The same four stages as every Hexploits engagement, applied to this capability.
Stage 1
Discovery
Two to four weeks. We find where candidate data lives, how it got there, and what the retention and access rules say against what actually happens. Output: the inventory, a target model and a fixed figure or capped estimate.
Stage 2
Build
The governed record and the integrations that feed it, migration of existing data with its provenance recorded, and retention and access rules built into the platform.
Stage 3
Launch
Parallel running with the existing systems, a reconciliation of records between them, then cutover team by team with the old copies retired and their deletion confirmed.
Stage 4
Operate
Retention runs, access reviews and subject access reporting produced on a schedule under deployment and monitoring.
Built by the same team
One record from many sources: JobVantage and Gradvisor
JobVantage brings candidate and role data from specialist providers, CVs, voice notes and documents into one structured, scored record with the provenance of every field. Gradvisor, a UK careers charity, moved from a failing platform to one rebuilt in eight weeks with its data migrated intact. Both are the same discipline this page describes: one record, known origin, enforced retention.
How success is measured
Every engagement agrees its measures and the measurement period in writing before work starts.
- Time to answer a subject access request, measured before and after.
- Number of systems and locations holding candidate data, before and after.
- Records past their retention date, reported monthly and trending to zero.
- Share of candidate data with a complete chain of custody.
Proof
Case studies with numbers, and reviews linked to Google where they were left there.
JobVantage · Recruitment technology · Duration TBC
99.9% availability and sub-100ms responses for a recruitment intelligence platform, at negligible infrastructure cost
Gradvisor · Charity · 8 weeks to production, then ongoing
98% faster page loads and a 12% smaller cloud bill for a UK careers charity
Director, JobVantage
“Working with Hexploits has genuinely been a pleasure, and I see them as my scaling partner for the foreseeable future as JobVantage grows. If you’re looking for a development team who combine strong AI/engineering capability with honesty, flexibility and a real interest in your business, I’d strongly recommend them.”
Director, Gradvisor
“Fantastic company and our development partner for Gradvisor, a social mobility careers platform with national ambitions. Extremely responsive and mission-oriented. Cameron owns any shortfalls humbly - rare for IT providers. Thinks like a client too.”
Questions we get asked
What is a chain of custody for data?
Why does decentralised candidate data matter for AI?
How long should we keep candidate data?
Do we have to replace our CRM?
What about data on consultants’ personal devices?
Related
Sectors where this is most often needed
More in security and compliance
Security architecture review
ISO 27001 and Cyber Essentials readiness
Identity and access management
Penetration test remediation
Data protection engineering
AI system security
Consumer Duty and FCA evidence engineering
Enterprise readiness for start-ups: SSO, audit trails, tenant isolation and the security questionnaire
Next step
Request a proposal.
Tell us about the system and the sector. A named engineer replies within one working day. A written scope and an indicative price within two working days of a short scoping call.