ATS security questions: what IT and information governance will ask (and how to answer them)

Before they approve an applicant tracking system (ATS), IT and information governance teams often need evidence of nine things: certifications, where data is hosted, how people log in, who has access, backups, data retention, security testing, incident response and integrations. So, getting answers to these early on will help you avoid the most common reasons recruitment technology projects stall.

Here's the story. The Board has approved the financing for an ATS, the recruitment team loves it, but IT and information governance have to sign it off.

We often see it in tenders and sales conversations. The demo was well received, the recruitment team are keen and then a 90-question supplier security questionnaire needs to be completed. If people are struggling to answer them all, then the project stalls.

With October being Cyber Security Awareness Month (2026's theme is "Don't Make It Easy for Them"), we saw this as a good time to ask: Is your recruitment system doing that?

An ATS holds some of the most sensitive personal data your organisation collects: addresses, dates of birth, National Insurance numbers, right to work documents and equality monitoring data. It's also open to the public (because anyone can apply for a job, right) so security teams take it seriously for very good reason.

Supplier risk is still a blind spot for many organisations. The government's Cyber Security Breaches Survey 2026 found that only 15% of businesses review the cyber risks from their immediate suppliers. Even among large businesses the figure is only 48%. Regulation is tightening too. The Cyber Security and Resilience Bill has passed the House of Commons and will push more security responsibilities down supply chains once it becomes law.

So what questions should suppliers be able to answer? Below are the questions we're asked most often and what a good answer looks like.

1. What security certifications does the supplier hold?

This usually comes first, because it's the quickest way to filter suppliers. Expect questions about Cyber Essentials, Cyber Essentials Plus and ISO 27001, the international standard for information security management. NHS and care buyers will also ask about the Data Security and Protection Toolkit.

What good looks like: current certificates the supplier can send straight away, with a clear explanation of what each one covers. For example, Cyber Essentials Plus independently tests the supplier's own security controls, while a hosting provider's ISO 27001 certificate covers the data centre where your data is held. 

At Jobtrain: We hold Cyber Essentials Plus and IASME Cyber Assurance Level 1 certification and our cloud hosting provider, Microsoft Azure, is certified to ISO 27001:2022. 

2. Where will our data be hosted and who can access it?

Information governance teams will need to know this for their data protection impact assessments and their record of who processes personal data.

What good looks like: UK hosting (for UK-based organisations), a named hosting provider, a full list of sub-processors (the other companies that handle your data) and a clear statement on whether any data or support staff are based outside the UK.

At Jobtrain: Our cloud hosting and data centre are provided by Microsoft Azure and client data is stored under UK data protection law (the Data Protection Act 2018 and UK GDPR). Our support team is UK based and isn't outsourced. 

3. How do users log in and does it meet Cyber Essentials?

This question matters more this year. Since 27th April 2026, Cyber Essentials has required multi-factor authentication on every cloud service where it's available and that's for all users rather than only administrators. If your ATS offers multi-factor authentication and it's switched off, your own certification could be at risk.

What good looks like: Single sign-on through your existing identity provider, multi-factor authentication for anyone not using single sign-on and the option to restrict access to your own network.

At Jobtrain: Every user logs in with their own username and password. Single sign-on is also available through identity providers such as Microsoft Azure and Okta, as well as two-factor authentication.

4. Who can see what?

Internal audits often find the same problem: too many people with full administrator access that don't actually need that level of access anymore.

What good looks like: role-based permissions you can manage yourself, a clear explanation of any accounts the supplier uses for support and equality monitoring data stored separately from applications.

At Jobtrain: Your own administrators decide who can access which features through security roles and users only see the jobs assigned to them. A time and date stamped record of each user's activity is kept against their profile. 

5. How is our data protected and backed up?

Expect questions about encryption, how often data is backed up, where are backups kept and how is disaster recovery tested?

What good looks like: encryption in transit and at rest, frequent backups held securely off site, and disaster recovery plans that are fully tested.

At Jobtrain: Data is protected in transit and backups are encrypted, stored securely off site and taken throughout the day.

6. How long is candidate data kept, and how is it deleted?

This is a UK GDPR question as much as a security one. Keeping unsuccessful candidates' data indefinitely "just in case" is a risk in itself.

What good looks like: retention periods that you set to match your own policy, automatic deletion when they end and secure wiping of data when a contract ends.

At Jobtrain: Your archiving period is agreed when your system is set up and once data is archived only anonymised statistics are kept. Candidates can also delete their applications or their whole profile at any time.

7. How does the ATS supplier test its own security?

Security teams want independent evidence, not just reassurance.

What good looks like: penetration testing (a simulated attack by an independent specialist) at least once a year by a CREST-accredited organisation, regular vulnerability scanning and evidence that any issues are fixed. The National Cyber Security Centre's Software Security Code of Practice now gives buyers a formal set of expectations to hold software suppliers to.

At Jobtrain: CREST-certified organisations carry out full penetration tests at least once a year and we usually run full vulnerability scans every six months.

8. What happens if something goes wrong?

No supplier is immune and security teams know it. What they're testing is how organised and transparent the supplier would be if something does go wrong.

What good looks like: a documented incident response plan, a named security lead, a commitment to tell you within an agreed timeframe (72 hours is typical) and technical support available out of hours.

At Jobtrain: we have a documented disaster recovery plan that is tested and reviewed and critical technical support runs 24/7 at no extra cost. 

9. How will the ATS connect to our other systems?

Integrations with HR, payroll and background checking systems are where data moves most and where weak points can appear if they're not set up properly.

What good looks like: documented application programming interfaces (APIs), secure file transfer and honest advice on which methods to avoid. Buyers are increasingly asking how suppliers use AI and whether candidate data is used to train AI models.

A checklist for recruitment leaders before IT asks

1. Bring your IT and information governance leads in before the demo, not after it.
2. Ask each shortlisted supplier for their information security documents.
3. Check that certificates are current and ask the supplier to explain what each one covers.
4. Confirm that your ATS login meets the new Cyber Essentials multi-factor authentication rule.
5. Review who has administrator access in your current ATS.
6. Agree on your data retention period before a new ATS goes live.
7. Book your data protection impact assessment early, because it's often what holds projects up.

Frequently asked questions

What security questions should I ask an ATS supplier?

Ask about nine areas: security certifications, where data is hosted, how users log in, who can access what, encryption and backups, data retention and deletion, independent security testing, incident response and integrations with other systems. Ask for evidence rather than reassurance, such as current certificates and a clear explanation of what each one covers.

Does an ATS supplier need Cyber Essentials?

It isn't a legal requirement, but it's increasingly expected. UK central government contracts that involve personal data have required Cyber Essentials since 2014 and many public sector buyers now ask for it as standard. Cyber Essentials Plus goes further than the basic certificate because an independent assessor tests the supplier's security controls rather than relying on a self-assessment.

What changed in Cyber Essentials in April 2026?

From 27th April 2026, Cyber Essentials requires multi-factor authentication on every cloud service where it's available, for all users and not just administrators. Critical security updates must also be applied within 14 days. Because an ATS is a cloud service, organisations should check that their ATS login settings meet the new rules.

Is an ATS supplier a data processor under UK GDPR?

Yes. In most cases, the employer is the data controller, because it decides why and how candidate data is used. The ATS supplier is the data processor, handling data on the employer's behalf. UK GDPR requires a written contract between the two, setting out how the supplier will protect the data.

How long should an ATS keep candidate data?

UK GDPR doesn't set a fixed period. Data should only be kept for as long as it's genuinely needed for the purpose it was collected. Many employers keep unsuccessful candidates' data for between six and twelve months, in case of a challenge to a recruitment decision. Whatever period you choose, your ATS should be able to apply it automatically.

Do I need a data protection impact assessment for a new ATS?

Often, yes. A data protection impact assessment is required when processing is likely to be high risk to individuals. An ATS commonly holds equality monitoring data, right to work documents and sometimes criminal record check results, so many organisations treat it as essential. Start early, because it's often what delays go-live.

What is penetration testing and how often should an ATS be tested?

Penetration testing is a simulated cyber attack carried out by independent specialists to find weaknesses before criminals do. Good practice is at least one full test a year by a CREST-accredited organisation, plus regular vulnerability scanning. Ask suppliers how often they test and how they make sure any issues found are fixed.

Who should be involved when choosing an ATS?

Recruitment and HR usually lead, but bring in IT, information governance and procurement from the start, not just after the demo period. IT will review security and integrations and information governance will review data protection. Involving them early stops supplier security questionnaires holding up the project at the final stage.

How does Jobtrain keep candidate data secure?

Jobtrain holds Cyber Essentials Plus and IASME Cyber Assurance Level 1 certification. Our cloud hosting provider, Microsoft Azure, is certified to ISO 27001:2022. Independent CREST-certified organisations test the platform at least once a year, backups are AES-256 encrypted and our infrastructure is monitored 24/7. And we're proud to have our UK-based support team that isn't outsourced.