Data security for job postings & applications

For website owners using AI-Recruit · Last updated: August 15, 2026

AI-Recruit is a careers page and applicant tracker for your WordPress site. When a candidate applies, their data — and their resume file — is stored in your database and file storage on your hosting, not on AtoZ servers.

How storage works

• Job postings → ordinary WordPress posts (airec_job), so they get your site's normal permalinks and search;
• Applications → saved to a dedicated WordPress table (wp_airec_applications) on your server;
• Resume files → uploaded to your site's normal Media/Uploads storage via WordPress's own upload handler;
• AtoZ license server → only license email, site URL, and plan (no job or applicant content);
• AI-Inquiro (if you enable the bridge) → applicant data is mirrored into your own AI-Inquiro install, on the same server — nothing leaves your site.

Built-in protections

Feature	Purpose
HTTPS on your site	Encrypts data in transit (you configure SSL on hosting)
Form nonce + honeypot	Blocks forged and bot application submissions
Resume file scan	Checks the real content of every uploaded resume — not just its extension — and rejects executables or embedded scripts before they're kept
Role capabilities	Only authorized staff can view, export, or change the status of candidates
Allowed file types & size limit	Settings → resume uploads restricted to file types and a max size you choose

AI-Recruit doesn't yet include a CAPTCHA option on the application form — the honeypot and nonce checks above are the current spam defenses; this page will be updated when one is added.

What you should configure

1. SSL certificate on your domain (most hosts provide free TLS).
2. Strong wp-admin passwords and few admin users with hiring access.
3. Hosting with encrypted storage and automated backups.
4. A retention plan for candidates you don't hire — delete records and resumes you don't need to keep.
5. Privacy policy on your site explaining how you handle applications.

Encryption at rest

Application fields are stored in plain text in MySQL, and resumes as regular files on disk, so you can search and manage candidates (standard for WordPress). Database and disk encryption at rest is typically provided by your hosting provider. The plugin does not replace a secure host or SSL.

You are the data controller

Your applicants submit data to you. You decide retention, who can access candidates, and how to respond to privacy requests. AtoZ provides the software; you operate it on your infrastructure.

Questions: supports@atozinfoway.ca

← Back to AI-Recruit