Permission groups
Groups define create, read, update and delete rights per object type, plus special permissions for sensitive operations — so access is granted deliberately rather than inherited by accident.
All features
Governance, Permissions & Audit
A shared talent pool and a confidential search, in the same tenant.
Search firms need both: a pool everyone can draw on, and mandates only three people may know exist. That only works if access is controlled by role, down to each kind of record, and every action leaves a trace. RBAC (Role-Based Access Control) is what makes it practical: you decide who may see and edit candidate data, customer information or commercial terms — a researcher can work a mandate without ever seeing the fee attached to it. RayCruit is built around that requirement rather than adding it afterwards.
- Who may view, edit and delete — set per record type
- Per-mandate access lists for confidential searches
- OIDC SSO, provisioning and enforced two-factor
- Business activity and append-only security log kept apart
The problem
Coarse permissions force a choice between collaboration and confidentiality.
Most systems offer a handful of roles and little else. A firm then has to decide whether to share everything internally — which makes a confidential C-level search impossible — or lock things down to the point where the shared pool loses its value. Neither answer is acceptable, so the confidential searches end up in a spreadsheet outside the system.
- Role-only permissions cannot express 'this mandate, these three people'
- Sensitive searches leave the platform and lose all governance
- Document download rights are implicit rather than granted
- Reconstructing who changed what requires database access
Permissions precise enough that nothing has to leave the platform.
Access control operates at the object level, roles reflect how search firms actually divide work, and the audit trail is separated by purpose.
Six purpose-built roles
Owner, Admin, Recruiter, Sourcer, Reviewer and Read-only reflect the way a search firm actually divides its work, rather than a generic admin-or-user split.
Per-mandate access lists
An individual mandate carries its own access list. A confidential executive search stays visible only to its assigned team, inside the same tenant as everything else.
Document download permissions
The right to download a candidate document is granted explicitly, because viewing a profile and taking a copy of a CV are different acts.
Tenant isolation
Each firm operates in its own tenant with its own subdomain, branding and white-labelled login. Data does not cross tenant boundaries.
Enterprise sign-in
OIDC single sign-on with automatic user provisioning, plus two-factor authentication the firm can enforce across the whole tenant.
Business activity timeline
A readable history on every customer, mandate and candidate — what happened, when, and who did it.
Append-only security log
A separate audit log that records security-relevant events and cannot be edited after the fact, kept distinct from the business timeline so each serves its own audience.
Portal isolation
Candidate and customer portals run on their own access model and cannot reach the recruiter workspace or each other's data.
Setting up governance for a firm
Governance is configured once at tenant level, then applied per mandate as sensitivity requires.
- 01
Define permission groups
Decide, for each kind of user and each record type, who may view, create, edit and delete — plus special rights such as exporting or seeing fee amounts.
- 02
Assign roles
Place users into the six roles according to how the firm divides delivery work.
- 03
Enable enterprise sign-in
Connect OIDC, turn on provisioning and enforce two-factor across the tenant.
- 04
Restrict sensitive mandates
Give confidential searches their own access list at creation.
- 05
Review the trail
Business timelines for delivery review, the security log for audit.
How search firms use it
Confidential C-level search
A CEO replacement runs inside the platform with an access list of four, rather than in a spreadsheet nobody can audit.
Contractor sourcers
External sourcers get exactly the rights to build candidate records and nothing else — no client data, no commercial terms.
Client due diligence
An enterprise client asking how their data is protected gets a concrete answer about roles, isolation and audit.
What changes
Nothing has to leave the system
Even the most sensitive search stays governed and auditable.
Confident collaboration
A shared pool works because access is precise, not because everyone trusts everyone.
Answerable to clients
Data-protection questions have documented answers.
See it in motion
The platform, end to end, in two minutes.
How the modules hand over to each other in the real product — customer and mandate, candidate and matrix, the workspace where a pairing is decided, and the material that goes to the client.
2 min
Continue across the platform
Placement work does not stop at one module. These parts of RayCruit connect directly to this one.
AI Orchestration & Compliance
Every output checked against a fixed structure, versioned prompts, provider logging and staleness control.
Learn moreCandidate Portal
A white-label portal where candidates keep their own details current — and you approve every change.
Learn moreClient Access
Branded, invitation-only access for named client contacts — no shared logins, no attachments.
Learn moreSee the modules working together.
A demo follows one mandate across every module, which is the only way the connections become obvious.