A Separate Door for Applicants: Running a Small UK Hiring Inbox Without Opening a Security Hole

Hiring is one of the few business processes where strangers are actively encouraged to send you files. A small charity, design studio or accountancy practice advertises a role and, within days, the inbox is full of PDFs, Word documents, cloud links and scanned passports. Nobody has done anything wrong. That is simply how recruitment works when there is no HR department and no IT team to build a process around it.

The problem is that the hiring inbox quickly becomes two things at once: a temporary data store full of personal information and an inbound channel for whatever anyone decides to attach. Neither is handled well by a shared info@ mailbox. You do not need a full applicant tracking system to fix that, but you do need a few deliberate habits.

Give applications their own door

Start by creating a dedicated hiring address rather than letting applications land in the general office inbox. Something like jobs@ is fine. Give access only to the people actually involved in the recruitment, not the whole team by default. If your email platform supports it, keep the hiring mailbox separate from the main inbox so a dodgy attachment is not sitting next to a supplier invoice or a client contract.

Turn off auto-forwarding unless you genuinely need it. Check that no one has set a rule sending applicant mail to a personal account because they were reviewing CVs at home. Set a simple auto-reply that points candidates to your privacy notice and explains what happens to their information. That last bit is not just good manners; it gives you a defensible answer when someone asks why you are holding their CV.

If you use a recruitment platform, remember that downloads still end up on someone's laptop. The platform does not remove the need for a clear internal routine.

Treat every attachment as a stranger

A CV is not automatically safe because it is called Jane-Smith-CV.pdf. File names are cosmetic. The useful question is not what the attachment claims to be, but what your machine will do when it opens it.

For a small team, the practical controls are simple. Keep operating systems and antivirus up to date. Leave Microsoft Office protected view and macro blocking switched on. Block executable file types and unusual archives at the mail gateway if your provider lets you. If an applicant sends a ZIP file containing a CV and a covering letter, do not double-click through it on a whim. Look at the file names first, and ask yourself whether a genuine candidate needs to send an archive at all.

Be wary of document bundles that arrive with names like Right to Work Documents.zip or a PDF that is strangely insistent on being opened in a browser. Fake CV links often lead to a page asking you to sign in with your work email. Do not do that. A candidate does not need your Microsoft 365 password to share a CV. If a link looks wrong, ask for a plain PDF instead.

Public file-scanning services are tempting, but do not upload a candidate's CV or passport scan to a random website just to see whether it is malicious. You would be handing personal data to a third party for no good reason. Use the tools you already have on the device, and if something feels off, delete it and request a clean copy through your recruitment platform.

Verify people without hoarding paperwork

The hiring process needs identity and right-to-work checks, but it does not need a permanent archive of everyone who ever applied. Collect what the check requires, at the point it is required. Do not ask for a passport scan, National Insurance number and bank details in the first email just because it saves time later.

Where possible, use a proper identity service or ask the candidate to attend a short video call with their original documents. If you must receive scanned documents by email, keep them in a restricted folder, limit access to the person doing the check, and delete them once the check is complete unless you have a clear reason to retain them. Unsuccessful applicants should not leave a trail of passport copies behind them.

Put a short privacy notice on the application page or in the auto-reply. It should say what you collect, why you collect it, how long you keep it and who to contact with questions. You do not need a legal essay. You need an honest paragraph that matches what you actually do.

Set a retention timetable you can keep

Data retention policies often fail because they are written for a compliance folder and never reach the inbox. Make yours concrete. For unsuccessful candidates, decide a deletion date, such as six months after the role closes, unless you have asked for consent to keep details for future vacancies. For successful candidates, move the necessary information into a personnel file and get it out of the hiring inbox.

Put a monthly reminder in the calendar. Clear the hiring mailbox, the downloads folder and any shared drive where interview notes were saved. Check sent items too, because that is where scanned documents often go to die. If you use a recruitment platform, check its retention settings rather than assuming it tidies up after itself.

The fifteen-minute weekly sweep

Once a week, run a short check. Confirm who still has access to the hiring mailbox. Look for new forwarding rules. Empty the quarantine folder and review blocked attachments. Delete any candidate files that have passed their retention date. Make sure the privacy notice link still works. If someone has left the hiring group, remove their access the same day.

None of this is glamorous. That is rather the point. Smaller organisations do not need a security programme with a steering committee to handle hiring safely. They need a separate door, a suspicious attitude to attachments and a diary reminder that actually gets used.

The first test in the hiring process is not the candidate's CV. It is how your team handles the paperwork. Get that right and the rest of the recruitment process has a much better chance of staying calm.