Sound familiar?
- A consultant who left last month can still log in to the CRM
- Candidate CVs are saved in personal downloads folders and email attachments
- Job alert emails to candidates land in spam
- Passport and right to work copies are stored on a shared drive anyone can open
- Consultants' laptops are slow with dozens of browser tabs and plugins
- You are not sure how long you should keep candidate records
Key facts
- MFA and single sign-on for recruitment CRMs such as Bullhorn, Vincere, Firefish and Access Recruitment
- The Conduct Regulations 2003 require work-seeker records to be kept for at least a year; UK GDPR limits keeping them longer than needed
- Right to work evidence from certified identity service providers stored securely
- SPF, DKIM and DMARC so candidate and client mailings reach the inbox
- Joiners and leavers process so consultants lose CRM and LinkedIn-connected access on their last day
- Complete plan £99 a month + VAT; ad-hoc £45 an hour + VAT
Candidate data, GDPR and the Conduct Regulations
Recruitment agencies hold a great deal of personal data: CVs, contact details, salaries, references, and sometimes health and diversity information. Under the Conduct of Employment Agencies and Employment Businesses Regulations 2003, agencies must keep certain records about work-seekers and clients for at least one year from their creation and from the last time services were provided, as the REC's guidance explains. UK GDPR then requires you not to keep personal data longer than you need it.
Your CRM can usually automate retention, but only if it is configured and the data is not also sitting in inboxes, downloads folders and shared drives. We help you find where candidate data really lives, lock down shared drives, set Microsoft 365 retention policies on mailboxes and make sure CVs are not synced to personal devices. See GDPR IT compliance.
CRMs, job boards and integrations
Agencies run on a CRM such as Bullhorn, Vincere, Firefish, Access Recruitment or Mercury, connected to multiposting tools such as Broadbean or idibu, LinkedIn Recruiter, e-signature, timesheet and payroll systems. Each integration is another set of credentials and permissions.
We set up single sign-on with Microsoft 365 where your CRM supports it, enforce MFA, review which integrations and API keys have access, and remove access promptly when consultants leave. If the CRM's Outlook add-in stops logging emails or the browser extension conflicts with others, we diagnose it and liaise with the supplier.
Right to work checks and ID documents
Employers can use a certified identity service provider to carry out digital right to work checks on British and Irish citizens with a valid passport or Irish passport card, under Home Office guidance. The output report and copies of documents must be kept securely for the period the guidance sets, and identity documents are a prime target for criminals.
We help you store this evidence in a restricted location, either within your IDSP or CRM, or in a locked-down SharePoint library with access logging, rather than in email or on consultants' phones.
Email that reaches candidates
Agencies send a lot of email: job alerts, interview confirmations, timesheet reminders and client mailings. Google and Yahoo have required bulk senders to authenticate with SPF, DKIM and DMARC since February 2024, and poorly configured agencies see job alerts go to spam. We set up authentication on your domain, separate marketing sending from consultants' everyday mailboxes, and check blocklists when delivery drops. See email deliverability.
Fast laptops and a busy sales floor
Recruiters live in the browser, the CRM, LinkedIn and Teams all day, on calls with headsets. We keep laptops updated and fast, manage them through Intune, set up headsets and softphones, and make sure Wi-Fi and broadband can cope with a full floor of video interviews. See VoIP phone support.
Recruiters are also prime phishing targets, because they open attachments from strangers all day as part of the job. A fake CV carrying malware or a link to a fake Microsoft sign-in page is an easy way in. We filter attachments, turn on Safe Links and Defender protections where your licence includes them, and give consultants short, practical training on spotting fake CVs and fake client enquiries. Combined with MFA, that stops most mailbox takeovers before they start. See phishing protection.
Plans and prices for agencies
Most agencies choose the Complete plan at £99 a month + VAT, which includes an IT and Microsoft 365 helpdesk for consultants, monitoring, daily backups and 3 hours of fixes or changes each month. Website care alone, including job board pages, starts at £25 a month + VAT, and Business at £50 a month + VAT adds an hour of changes and priority support.
One-off work is £45 an hour + VAT. Office moves and new branch set-ups are quoted. See pricing.
What it costs
Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Pick a plan if you want it looked after every month, or pay by the hour for a one-off job.
Essential
Keep it updated, backed up and watched.
- Website software updates (core, plugins, themes) applied and checked
- Daily backups
- Uptime monitoring
- Security monitoring
Business
Updates plus an hour of fixes every month.
- Everything in Essential
- 1 hour of fixes or changes every month
- Priority support
Complete
Website and your team's IT, covered.
- Everything in Business
- 3 hours of fixes or changes every month
- IT and Microsoft 365 helpdesk for your team
No plan? The first 30 minutes are the minimum charge, then we bill in 15-minute blocks.
Frequently asked questions
How long should a recruitment agency keep candidate data?
The Conduct Regulations 2003 require certain work-seeker records to be kept for at least one year from creation and from the last service provided. UK GDPR says not to keep data longer than necessary. Set your policy with legal advice; dijitul configures retention in Microsoft 365 and helps clean up stray copies.
Can you secure our Bullhorn or Vincere access?
Yes. dijitul enforces MFA, sets up single sign-on with Microsoft 365 where the CRM supports it, reviews connected integrations and API keys, and removes access promptly when consultants leave. CRM configuration itself stays with your supplier.
Where should we store right to work documents?
In a restricted location such as your identity service provider's platform, your CRM or a locked-down SharePoint library with access logging. Not in email or on phones. dijitul can set this up and review who has access.
Why are our job alert emails going to spam?
Usually missing or misaligned SPF, DKIM or DMARC, or bulk mail sent from the same domain as everyday mailboxes. dijitul fixes authentication, separates marketing sending and checks blocklists so job alerts reach candidates' inboxes.
How much does IT support for a recruitment agency cost?
dijitul's Complete plan is £99 a month + VAT, including a helpdesk for consultants and 3 hours of fixes each month. Ad-hoc work is £45 an hour + VAT, and office moves or new branch set-ups are quoted.
Related
Hand it over and stop worrying
Updates, backups, monitoring and fixes from £25 a month + VAT. Real UK people on the phone.