Security & Data Protection
Last updated: October 2026
ATSpro processes your recruitment data on your behalf: you are the data controller and ATSpro is the data processor under UK GDPR. This page explains, in plain terms, where your data is held, who can see it and how it is protected. The binding commitments are in our Data Processing Agreement (DPA), which we sign with every customer.
ATSpro is operated by Laurence Doherty trading as ATSpro, Oxford, UK. Data protection and security questions: privacy@atspro.co.uk.
Where your data is held
Your data is stored in the UK (London); the application that serves it runs on servers in the Netherlands.
| What | Where | Provider |
|---|---|---|
| Database (all records) | London, UK | Neon, on Amazon Web Services |
| Files (CVs, documents) and backups | London, UK | Amazon Web Services |
| Application servers and job queues | Netherlands, EU | Railway |
| AI processing (CV parsing, matching, writing help) | USA | OpenAI, Anthropic |
The UK recognises the EU as providing adequate protection. Transfers to the USA use safeguards recognised in UK law (the UK Extension to the EU-US Data Privacy Framework or the International Data Transfer Addendum). OpenAI and Anthropic do not use data sent through their business APIs to train their models; OpenAI may keep it for up to 30 days to monitor abuse.
Who can see your data
Your own users see your data, within the permissions you give them. ATSpro staff see it only when signing in to support you, and you can require your permission first.
- Your users: each user signs in with their own account. Roles control what each person can see and change. Two-factor authentication is available to every user.
- Other ATSpro customers: none. Every request is restricted to the signed-in user's own agency, and an automatic check flags any database query that is not.
- ATSpro support: to fix issues, ATSpro can sign in to your account as one of your users. Every sign-in is recorded with the reason and listed for your owners and admins in Settings → Privacy & Security.
- Require my permission: with this setting on, ATSpro can sign in only while one of your owners or admins has allowed it, for 1 hour to 7 days. They can close access at any time, which ends a session in progress, and they are emailed each time ATSpro signs in.
- Production systems: only ATSpro's founder has access to the database and hosting. ATSpro's administrative sign-in is protected by two-factor authentication.
Connected email accounts
Connecting a mailbox lets ATSpro read and send email for that user, and you decide which correspondence ATSpro may hold or pass to AI.
- What connecting grants: each user connects their own Microsoft 365 or Google mailbox and approves the permissions on Microsoft's or Google's own sign-in screen. ATSpro uses them to show the user's inbox in ATSpro, send email they write in ATSpro, and log email with candidates and contacts. The user can disconnect at any time, and the access tokens are stored encrypted.
- What is logged against records: only emails to or from people already in your ATSpro database are logged against their candidate or contact record.
- Inbox view: to show a Microsoft 365 user's inbox inside ATSpro, ATSpro keeps the sender, recipients, subject and a short preview of their last 90 days of email. Full messages and attachments open live from Microsoft. This copy is deleted when the mailbox is disconnected.
- Excluded domains and addresses: for confidential clients, such as one under an NDA, add their domain or address in Settings → Privacy & Security. Email to or from them is then never logged, stored or read by AI, even when a candidate is also on the thread. Adding an exclusion also deletes what ATSpro already holds for it.
- AI on email: AI reads email from candidates and contacts to spot replies and updates. Switch it off and no email content from your account is sent to any AI provider.
Security controls
Data is encrypted in transit and at rest, and ATSpro adds its own encryption to the most sensitive fields.
| Control | How it works |
|---|---|
| Encryption in transit | All connections use TLS |
| Encryption at rest | Database and file storage encrypted by their providers |
| Field encryption | Email access tokens, two-factor secrets, and bank and National Insurance details encrypted by ATSpro (AES-256-GCM), with the key held separately from the database |
| Passwords | Hashed with bcrypt, never stored readable |
| Sign-in protection | Two-factor authentication for every user, rate limiting and lockout after failed attempts |
| Separation between customers | Every request restricted to the signed-in user's own agency |
| Backups | Encrypted weekly backup kept 56 days in London, plus 7 days of point-in-time recovery |
| Monitoring | Application errors reported to ATSpro automatically, without user details attached |
| Updates | Software dependencies and hosting kept up to date |
Sub-processors
ATSpro uses these providers to run the service. Customers get 30 days' notice before any new one is added.
| Sub-processor | Service | Location | Purpose |
|---|---|---|---|
| Neon | Database hosting | UK (London) | Stores all application data |
| Amazon Web Services | File storage, backups | UK (London) | CVs, documents, encrypted backups |
| Railway | Application hosting | EU (Netherlands) | Runs the application and job queues |
| OpenAI | AI services | USA | CV parsing, matching, writing help and, unless switched off, reading candidate and contact emails |
| Anthropic | AI services | USA | AI assistant and backup AI processing |
| Microsoft / Google | Email and calendar | Global | Only mailboxes and calendars your users connect |
| Resend | Email delivery | USA | System emails and notifications |
| Cloudflare | Careers sites, DNS | Global | Hosting your careers site |
| PostHog | Product analytics | EU | How the application is used, with on-screen text masked |
| Sentry | Error monitoring | USA | Technical error reports, without user details |
| Stripe | Billing | USA / EU | Subscription payments |
| Google Maps Platform | Geocoding | Global | Turning addresses into map locations |
| Google Firebase | Push notifications | Global | Notifications to your users' devices |
Optional integrations (telephony, SMS, job boards, accounting and similar) process data only if you turn them on.
Retention, deletion and your data rights
You control your data while you use ATSpro, and it is deleted within 120 days of your subscription ending.
- During your subscription: you decide how long records are kept and can delete them at any time.
- Export: export your data as CSV at any time, without fees.
- Erasure requests: erase or anonymise an individual candidate in ATSpro, including their logged emails.
- When you leave: export what you need; ATSpro deletes all your data within 120 days, or sooner on written request. Backups expire within a further 56 days, and confirmation of deletion is available on request.
- Data subject requests: ATSpro helps you answer access, correction, erasure and portability requests.
If something goes wrong
ATSpro will tell you about a personal data breach affecting your data within 48 hours of becoming aware of it.
- Contain the incident and secure the affected systems.
- Notify you within 48 hours, with what happened, what data is affected and what has been done.
- Give you the information you need for any report you must make to the ICO or to the people affected.
- Work with you on the investigation and fix the cause.
Documents and contact
- Data Processing Agreement: sent for electronic signature when you subscribe, or on request before. It sets out these commitments, the full sub-processor list and international transfer safeguards.
- Security questionnaires: we will complete your or your insurer's questionnaire on request.
- Audits: available on reasonable notice, once a year, as set out in the DPA.
Questions: privacy@atspro.co.uk. See also our Privacy Policy and Terms of Service.