Security & Governance
A search firm's platform contains employment histories, salary expectations, confidential client mandates and the fact that a named executive is quietly looking. RayCruit is built so that each of those can be protected specifically, rather than behind a single blanket permission.
Each firm operates in its own tenant with its own subdomain, branding and white-labelled login. Data does not cross tenant boundaries.
Access is controlled by role. RBAC (Role-Based Access Control) means you decide who may see and edit candidate data, customer information or commercial terms — so a shared talent pool and a confidential search can exist in the same tenant without either leaking.
Enterprise sign-in that fits an existing identity stack rather than adding another credential to manage.
Two separate trails, because delivery review and security audit are different questions asked by different people.
Role model
Generic admin-or-user permissions force firms to over-grant. These roles reflect the actual division of labour in a placement team, and permission groups refine them further.
Full control of the tenant, including commercial configuration and role assignment.
Platform administration, permission groups, branding, portals and integration configuration.
Full delivery work: mandates, candidates, evaluations, submissions and client communication.
Builds and enriches candidate records without access to client commercials or mandate internals.
Inspects evaluations and shortlists for quality without altering the underlying delivery work.
Visibility for stakeholders who need to see progress but must not change anything.
AI processing
AI processing is confined to defined actions with defined inputs. Which provider handles which action is an operational setting, and every call is recorded.
AI runs on specific actions — CV extraction, job ad extraction, named analyses — rather than as an open-ended assistant with access to everything.
The platform supports OpenAI, Anthropic, Google and Mistral, and routing can be changed per action without a redeploy. The managed service currently runs on Mistral AI in Europe.
Responses are checked against a fixed structure before being accepted, so malformed or unexpected output never reaches a recruiter.
Provider, model, prompt version, input and output are recorded, and can be streamed live to administrators.
AI output is decision-support material. A person stands between generation and anything that reaches a client.
AI fills blanks and proposes changes; it does not overwrite human-authored content.
Auditability
Data handling
Candidate consent is captured through the Candidate Portal as a deliberate action, with the legal basis documented.
Candidate documents are tenant-scoped and delivered through signed download links rather than open URLs.
Anonymised CVs are generated systematically rather than edited by hand, which removes the most common source of accidental disclosure.
Retention follows the customer agreement and account configuration, and deletion requests are supported.
The categories of data processed, the purposes and the provider types involved are documented in the privacy information.
The read-only integration API uses scoped API keys and OAuth rather than shared credentials.
Contractual matters — the data-processing agreement, sub-processor list, hosting region and retention periods for your tenant — are handled as part of the customer agreement. Ask for them during the demo and we will provide the current documentation.
Procurement and data-protection review are easier when the answers are specific. We are happy to go through yours directly.
