Data protection

Statement

Almost everything this API returns is personal data about real people — the workers an agency places and the people it deals with at its clients. The agency is the controller of that data and decides what happens to it. Recruso is the processor, acting on the agency’s instructions. An integration holding an agency’s API credentials is acting on those same instructions and on no wider basis: the credentials grant access to the agency’s data for the agency’s purposes, and nothing in them makes the data yours to use for anything else.

Scope

This page covers personal data reached through the published API, and the obligations that fall to you as an integrator. It does not cover the Recruso platform or UI as a whole, the agency’s own obligations to the people whose data it holds, or your own compliance as a separate controller of anything you copy out.

For how access is restricted and how credentials are protected, see Security.

What we guarantee

The roles are fixed. The agency is the controller and Recruso is the processor, for every record reached through this API. No credential, header or endpoint changes that.

Data is held in the United Kingdom. The API and the data behind it run on Microsoft Azure in a UK region, and stay there. Microsoft Azure is the only sub-processor for data reached through this API.

Encrypted in transit and at rest. Requests are served over TLS and nothing else; stored data and uploaded files are encrypted at rest.

Access is narrowed twice. Every request is confined to the agency your credentials belong to, and then again to the branches the Recruso user behind your API app can reach. Neither narrowing can be widened by anything you send. See Multi-tenancy and data isolation.

Erasure is honoured. A worker erased under data-protection law disappears from this API entirely — left out of every list and search, and returning 404 for the worker and for everything they held. See Workers.

Uploaded documents are private. Worker documents are held in private storage, protected from public access. The API never returns where a document is stored, so there is no link to one to follow or to leak: a document is read back only through the API, behind the same checks as every other record.

Writes are attributed. Every change made through the API is recorded against the Recruso user your API app belongs to, so an agency can see what an integration did and when.

What we do not guarantee

Stating these plainly is what makes the guarantees above worth relying on.

• No retention period is published. How long a record is kept is the agency’s decision as controller, not a commitment made by this API.
• The API cannot erase anything. There is no endpoint that deletes a worker. Erasure is carried out in Recruso, and this API only reflects it — it will never confirm that a 404 is an erasure rather than any other record you cannot see.
• No breach-notification timescale is published. Report anything you suspect to Recruso support; see Security.
• Uploaded files are checked, not scanned. An upload is validated on its extension and its size. Recruso does not scan file contents for malware and does not inspect what a document contains.
• No certification is claimed. Do not read this page as asserting one.
• Diagnostic telemetry records identifiers, not record contents. Operational logs carry route, status, timings and record and agency ids — not names, contact details or anything else from the records themselves.

Your obligations

The agency’s data is protected up to the point it reaches you. Past that, these are yours:

• Request only what you need. A worker detail response carries considerably more about a person than a list entry does, including data that is sensitive under UK GDPR. Call the narrower endpoint when it answers your question.
• Anything you copy out becomes yours to look after. Once a record is in your system you are responsible for keeping it secure, for how long you hold it, and for erasing it when asked.
• Mirror deletions. A worker id that starts returning 404 may have been erased. Treat it as gone and remove your copy — do not retry it, and do not keep a record the agency has deleted.
• Keep exported data out of logs, error reports and analytics, and encrypt it at rest.
• Never put worker data in a browser or mobile client where a user can read it, and never cache one agency’s data where another agency’s credentials could reach it.
• Have the agency’s authorisation. The agency decides who holds credentials and what an integration may do with the data it reaches. Do not repurpose that data, and do not pass it to a third party without the agency’s instruction.

Data subject requests

A worker or a client contact exercises their rights against the agency, not against Recruso and not against you. If someone approaches you directly, refer them to the agency whose credentials you hold.

The API can help an agency find and export a person’s record, but it cannot erase one. Recruso assists agencies with these requests as processor — contact support below.

Contact and escalation

Contact Recruso support at support@recruso.co.uk for anything on this page, including data protection questions an agency has asked you to raise.

Effective date: 12 September 2026