Mercury Recruit Security & Compliance | Data Protection

Security isn’t a feature you add later — it’s something Mercury Recruit is built around from the ground up. Every piece of candidate data your team collects, every hiring decision recorded, and every document uploaded is handled with strict access controls, encrypted storage, and full compliance with the General Data Protection Regulation (GDPR). This page explains exactly how Mercury Recruit protects your organization and your candidates.

---

​

GDPR Compliance

Mercury Recruit is fully GDPR-compliant, which means your use of the platform — collecting applications, processing candidate data, and storing hiring records — is structured to meet the requirements of EU data protection law regardless of where you operate. In practice, GDPR compliance through Mercury Recruit means:

• Lawful basis for processing: Candidate data is collected only in the context of a legitimate job application. Mercury Recruit does not repurpose candidate data for any other use.
• Data minimization: The platform collects what is necessary to evaluate a candidate for a role and nothing more.
• Transparency: Candidates interact with a structured application process that clearly defines what information is being collected.
• Data subject rights: If a candidate requests deletion or export of their personal data, your team can fulfill that request by contacting our support team at support@mercury360.com.
• Retention limits: Data is not held indefinitely. See the Data Retention Policy section below for specifics.

---

​

Role-Based Permissions and Access Controls

Not everyone on your team needs access to every candidate record. Mercury Recruit’s role-based permissions system gives administrators precise control over who can see, edit, and act on candidate information. You can assign access levels based on each team member’s role in the hiring process:

• Hiring managers see only the roles and candidates relevant to their department.
• Recruiters can manage pipeline stages, leave notes, and communicate with candidates within their assigned jobs.
• Admins have full visibility and control over all jobs, users, and settings.

This structure ensures that sensitive candidate information — compensation expectations, assessment results, interview notes — stays visible only to those who need it to make a decision.

​

Enterprise: System-Wide Admin Visibility

Enterprise plan administrators gain System-Wide Admin Visibility, giving leadership and compliance teams a complete view across all active jobs, users, and hiring activity on the account. This is especially useful for organizations running multiple hiring teams or operating across different departments and geographies.

---

​

Private & Confidential Hiring (Enterprise)

Some roles require discretion. Executive searches, sensitive backfills, or internal succession planning cannot always be run through standard open pipelines. Mercury Recruit’s Private & Confidential Hiring mode — available on the Enterprise plan — restricts visibility on specific jobs to only a named set of authorized users. When a job is marked Private & Confidential:

• It does not appear in the general jobs list for users outside the authorized group.
• Candidate records associated with that role are hidden from users who lack explicit access.
• All activity on the role is still fully logged in the audit trail for compliance purposes.

---

​

Audit Logs

Every action taken inside Mercury Recruit is recorded. When a recruiter advances a candidate, when a hiring manager leaves a note, when an admin changes a permission — it’s all timestamped and attributed to the individual who performed it. This creates a complete, tamper-evident audit trail for every hiring decision made on the platform. Audit logs serve two important purposes:

1. Internal accountability: Your team can always look back and understand how a hiring decision was reached, who was involved, and what happened at each stage.
2. Compliance readiness: If your organization is subject to an audit, HR review, or legal inquiry, the audit trail gives you a clear, defensible record of your hiring process.

​

Enterprise: Compliance-Ready Audit Logs

Enterprise customers receive Compliance-Ready Audit Logs — a structured, exportable record of hiring activity formatted for use in formal compliance reporting. These logs are designed to satisfy the documentation requirements of HR audits, GDPR investigations, and equal opportunity reporting.

---

​

Secure Document Storage

Resumes, cover letters, portfolios, assessment results, offer letters — hiring involves a significant volume of sensitive documents. Mercury Recruit stores all uploaded files in secure, encrypted storage. Documents are:

• Encrypted at rest to prevent unauthorized access in the event of a storage-level breach.
• Accessible only to authorized users based on the role-based permissions configured for your account.
• Linked to the candidate record they belong to, so documents stay organized and cannot be accessed outside the context of the associated application.

---

​

Data Retention Policy

Mercury Recruit retains your account data — including candidate records, job postings, hiring history, and uploaded documents — for 30 days after the date of account cancellation. During this 30-day window, you can log in, review, and export any data you need to retain for your own records. After 30 days, all data associated with your account is permanently and irreversibly deleted from Mercury Recruit’s systems.

---

​

Requesting Data Deletion or Export

Mercury Recruit supports your ability to fulfill candidate data subject requests as required under GDPR. If a candidate contacts you requesting deletion or a copy of their personal data, your team can action these requests through our support channel. To request a data export or early data deletion — for a specific candidate or for your entire account — contact our support team:

• Email: support@mercury360.com
• Phone: +1 (855) 551-0417
• Web form: mercury360.com/recruit/contact-us

Include the account name, the type of request (export or deletion), and any relevant candidate identifiers, and our team will process the request in accordance with GDPR timelines.