Know why you hold every candidate record, and for how long

Every candidate record carries the basis you are relying on, chosen from a fixed list rather than typed: consent given by the candidate, legitimate interests you have assessed and recorded, a contract you are performing, or a legal obligation. Where the basis is consent, the record also carries the channel it arrived through, the wording that was shown at the time, the timestamp, and the user or form that captured it.

The fixed list matters for the same reason coded dispositions matter elsewhere in the product. A free-text field lets sixty recruiters describe the same basis forty different ways, and the resulting database cannot be counted, reviewed or defended. Four values in a dropdown can be counted on a Monday morning.

Basis changes over a record's life. A candidate sourced under legitimate interests who later replies and opts in moves to consent, and the record keeps both events rather than overwriting the first. Withdrawal is its own dated event too. The history is the evidence, so nothing in it is edited in place.

Retention measured from record creation is the wrong clock. A candidate you placed eighteen months ago and spoke to last week is a live relationship. A candidate parsed three years ago who has never replied to anything is not, whatever the creation date says. The clock in Surhires will run from the last meaningful contact: a reply, an answered call, an application, a submittal, an interview, or an update the candidate made themselves in the portal.

Meaningful is defined narrowly on purpose. A bulk campaign the candidate ignored does not reset the clock, because if it did, retention would become a function of how often you email people rather than of whether the relationship still exists. Opens and delivery receipts do not count either. A machine event is not a relationship.

Windows are configurable per tenant, and they can differ by record type and by market, because a UK contract desk, an in-house team in the EU and a US agency do not sit under the same expectations. The defaults are set during onboarding and they are your decision. The product will tell you what the field controls; it will not tell you what number your counsel should choose.

When a record reaches the end of its window it does not disappear quietly. It surfaces in a review queue carrying the basis, the last meaningful contact, the reason it was flagged, and the three options: extend with a recorded justification, contact the candidate to refresh consent, or erase.

Automatic deletion on a schedule sounds tidy and is usually wrong. It destroys records somebody had a live reason to hold, and it leaves you with no evidence that any decision was taken. A review queue produces a dated decision with a name against it, which is the thing an auditor, a client or a candidate actually asks to see.

The queue can be worked in bulk. Selecting three hundred dormant records and erasing them together is one action for the recruiter, and the decision is still written three hundred times, once against each record, with the actor and the date.

A candidate who asks what you hold about them is entitled to an answer, and the answer is more than the profile. The export assembles the structured record, the parsed resume text, the custom fields, the notes, the message history, the call and interview records, the stage and disposition history and the consent events, as CSV for a person to read and JSON for a system to ingest.

It runs from the record rather than through us. There is no support queue in the path, because a request that carries a statutory deadline should not depend on a vendor's response time. The request itself is logged against the record, with who ran it and when, so you can show that it was answered and how quickly.

Where a note names a third party, such as a referee, a client contact or another candidate, the export flags it for review rather than releasing it blindly. The redaction decision belongs to you. The flag exists so you know there is a decision to make before the file leaves the building.

Most systems that offer deletion delete a row. The uploaded resume stays in object storage, the parsed text stays in the search index, the derived representation stays wherever it was written, and a copy of the whole record sits inside last month's export. The candidate was told they had been removed, and they had not been.

Erasure here is defined as the profile, the custom fields, the notes, the messages, the original uploaded file, the extracted text and the search representation derived from it, removed together. The workflow reports what it removed and from where, and it keeps a fulfilment record, which is the fact of the request and the date it was completed, rather than the data the request was about.

It is worth naming what erasure cannot reach. Anything already exported to a spreadsheet, forwarded to a client or copied into another system is outside the tenant and outside the workflow. That is an argument for exporting less, and the product will show you which exports contained the record so you know what to go and chase.

Not everything can be erased on request, and pretending otherwise is worse than saying so plainly. A completed placement creates a financial record: an invoice raised, a fee earned, a contractor paid, tax reporting that has to be reconstructable for a statutory period. Deleting the candidate identity out of that chain breaks the accounting, and the obligation to keep the record generally outranks the erasure request.

The workflow handles this in the open. When an erasure request touches a candidate with a completed placement, it separates the personal data that can go from the financial record that has to stay, erases the first, retains the second under a named retention reason, and produces a candidate-facing summary of exactly what was kept and why.

The common alternative is a deletion that quietly leaves everything intact because deleting properly would have broken a report, and nobody tells the candidate. Naming the exception is the honest version. It is also the only version you can defend when somebody asks.