Compliance & regulatory considerations
Candidate data is sensitive, contractor compliance is heavily regulated, and the cost of getting either wrong is reputational damage that does not heal quickly.
UK GDPR + DPA 2018
EU GDPR
IR35 / Off-Payroll Working aware
GLAA Licensing aware
REC compliance aware
CCPA
SOC 2 Type 1 (in progress)
Accessibility WCAG 2.2 AA
GDPR is the headline risk. Candidate CVs are special. They contain personal data, sometimes special category data (health, political views, trade union membership), and they are collected from a person who has not yet entered a contractual relationship with you. We treat data subject rights (Articles 15 to 22) as first class endpoints rather than as a customer support workflow: a subject access request returns a downloadable export in 24 hours, a right-to-erasure request flows through a confirmation step into a hard delete plus anonymisation of derived records. Retention is configurable per client and per data category, with automatic deletion after the configured window. ROPA and DPIA documentation is produced as part of the build, not retro-fitted before an audit.
IR35 is engineering, not advice. We do not give tax advice. What we build is the software your tax counsel needs: a Status Determination Statement object with a full version history, a 45 day appeal workflow visible to all three parties, CEST integration where you want a deterministic baseline, and an audit log that survives HMRC questioning. The data model treats inside-IR35 and outside-IR35 engagements as distinct, including downstream effects on payroll, invoicing, and VAT.
Accessibility is non-negotiable in HR tech. If a candidate cannot use your portal because of a screen reader incompatibility, you have an Equality Act 2010 problem. We design to WCAG 2.2 AA and verify with both automated tooling (axe-core, Lighthouse) and manual screen reader testing on NVDA and VoiceOver.