How SynkRecruiter looks after your candidates' data.
SynkRecruiter holds the most sensitive thing a recruitment agency has: the people on its books. This page sets out who is responsible for that data, how it is protected, and how the AI is kept in its place.
Who is responsible for what
Your agency is the controller of the candidate, client and contact data you keep in SynkRecruiter. Service Synk Limited, which provides SynkRecruiter, is your processor: we store and process that data only to run SynkRecruiter for you, as UK GDPR Article 28 requires. Every agency signs a Data Processing Agreement with us before going live.
We never sell your data, never share it beyond the providers listed below, and never combine it with other agencies' data. Each agency runs its own private copy of SynkRecruiter, so your data never sits in the same database as another agency's.
Security
- Individual logins and roles. Everyone signs in as themselves. Five roles, from owner to read-only, control what each person can see and change.
- Protection in the database itself. Row-level security is on for every table that holds your data, so the database refuses access a user's role does not allow.
- Private files. CVs and documents sit in private storage that is never publicly reachable.
- Encryption in transit and at rest.
- A full audit trail of who created, changed, downloaded or deleted each record. Owners can see and export it.
- Monitoring. Automatic alerts on errors and a regular health check.
- Cyber Essentials, the UK government-backed certification: in progress.
AI that advises, never decides
SynkRecruiter uses AI to read CVs, briefs and call notes, to suggest updates to your records, and to score how well a candidate fits a vacancy against a rubric you set. Every score comes with its reasons.
- Names removed before scoring. The AI scores a profile of experience and skills with the candidate's name, contact details and employers taken out.
- Protected characteristics excluded. The AI is instructed never to use age, gender, ethnicity, nationality, religion, disability, or marital or family status, or anything that stands in for them.
- A person makes the call. SynkRecruiter never rejects or contacts a candidate on its own. Under the UK GDPR rules on automated decisions (Articles 22A to 22D), significant decisions need meaningful human involvement, and SynkRecruiter is built around that.
Your data stays under your control
- Retention you set. Each candidate carries a lawful basis and a review date, 12 months after last contact by default and adjustable from 1 to 60 months.
- Deletion on request, with the reason logged, or anonymisation where match history should stay.
- Subject access requests. We help you export everything held on one person within 5 working days.
- When you leave. Ask within 30 days for a full export in CSV or JSON. We delete your data within 60 days, and from backups as they expire.
Who processes data for us
These providers help run SynkRecruiter. Each is bound by data protection terms at least as strict as ours, and we give you 30 days' notice before adding or replacing one.
| Provider | What for | Where | Transfer protection |
|---|---|---|---|
| Supabase | Database, file storage and sign-in | Ireland (EU) | UK Addendum to EU contract clauses |
| Netlify | Hosting the app | USA | UK-US data bridge |
| n8n | Running workflows that call the AI | Germany (EU) | UK adequacy for the EU |
| Anthropic | AI that reads, summarises and scores | Ireland and USA | UK Addendum to EU contract clauses |
| OpenAI | Search and matching (embeddings) | USA | UK Addendum to EU contract clauses |
| Postmark | Receiving emailed applications | USA | UK-US data bridge |
| GitHub | Error alerts | USA | UK-US data bridge |
Slack, Calendly and your email provider are connected under your own accounts, so your own terms with them apply.
If something goes wrong
We tell you within 48 hours of becoming aware of a breach affecting your data, with what happened, who is affected and what we are doing. We then help you report to the ICO within its 72-hour deadline and contact anyone affected.
Documents for your records
When you sign up, we send our Data Processing Agreement, privacy notice wording for your candidates, and an impact assessment template filled in with how SynkRecruiter works.
Questions about data protection: privacy@synkrecruiter.com.