A recruiter opens a past candidate in an AI search tool, even though the team already anonymized that person in Greenhouse. The ATS cleanup happened. The copied resume and summary remained elsewhere. A useful candidate retention workflow starts with the native Greenhouse rules, then follows the data into every system that reads it.
This guide covers configuration and engineering checks. It does not choose a lawful retention period for your business. Have your legal team approve the policy, office scope and exceptions before enabling destructive actions. Treat the approved policy as an input to the workflow, not a decision for an AI agent.
Start with the candidate, not one rejected application
Greenhouse starts the retention timer when a candidate is hired or rejected on all job applications. A rejection on one role does not tell you whether the person is still active elsewhere. Review all applications before putting a profile into any external cleanup queue.
Greenhouse also documents timer changes when a rejected candidate becomes a prospect for a different job or is otherwise considered for another job. The timer is deactivated and reset. Moving a job to an office without a rejected candidate retention rule can deactivate the timer too. Test these transitions with recruiting operations before relying on a daily export.
Configure the policy and office scope first
A Site Admin can open Privacy & Compliance and configure the retention rules. Hired and rejected candidate rules are created separately. Rejected candidate rules can be scoped by office. Hired candidate rules apply to the whole organization and are available for organizations using Single Purpose Consent.
For unattached prospects, Greenhouse says to select All Offices so the retention rule covers them. These prospects are not associated with offices. Write this case into the configuration review instead of assuming every record inherits an office from a job.
| Decision | Operator check | Engineering check |
|---|---|---|
| Retention period | Legal team approves the period | Test candidates around the expiry boundary |
| Office scope | Confirm covered offices and prospects | Test records with no office association |
| Fields to anonymize | Review names, notes and documents | Check copies and derived data outside the ATS |
| Exceptions | Assign a named reviewer | Keep a separate unresolved queue |
The retention timer applies retroactively. Greenhouse can notify you immediately about candidates already beyond the configured period. Review the existing affected population before saving a new rule. A new setting can expose a backlog, not just affect future applicants.
Choose what anonymization actually removes
Greenhouse lets you choose personal data through the Data to be Anonymized table. Do not treat the label as a promise that every mention of a person disappears. The selected fields matter. Greenhouse specifically notes that selecting Name and Pronunciation Recording does not remove the candidate name from Activity Notes. Activity Notes must be selected separately for that purpose.
Review reporting needs with the people who use them. Anonymized personal data will no longer appear in reports. Define what nonpersonal operational evidence the team needs, and have that design approved before changing the field selection. Avoid making extra resume exports merely to preserve a convenient old report.
Understand Automatic Anonymization eligibility
Greenhouse makes Automatic Anonymization available to organizations using Single Purpose Consent. Its documented eligibility checks require every application to be Rejected and/or Hired, a data retention rule to apply, and the retention period to have expired. Review the feature with legal counsel. If a sandbox is available, test it there first.
The automatic process runs a few times each day. A candidate can briefly appear as due before the next process runs. Do not build a second deletion worker merely because the due queue is temporarily nonempty. First confirm eligibility and inspect the next native processing result.
Separate due, failed and consent queues
The Auto anonymization due filter helps review eligible candidates. With a selected date, it can show candidates eligible by that date. Without a date, the filter shows candidates with a retention timer counting down. Record the filter settings when investigating a discrepancy so two operators are comparing the same population.
Use Auto anonymization failed for candidates Greenhouse attempted but could not anonymize. The documented manual recovery includes the bulk action Delete Candidates' Personal Data. Investigate the failure and confirm the intended records before using that action. Do not let an AI agent approve a destructive bulk retry based only on a count.
Expired consent requests are different. Greenhouse says they are not automatically anonymized. Review Consent not requested, Consent request pending and Consent request expired as separate queues where the configured legal basis makes those filters applicable. Assign an owner and a documented next action rather than assuming retention processing covers them.
Follow the data into external AI systems
Make a data flow inventory for each custom recruiting integration. Include resume storage, parsed text, search indexes, generated summaries, review queues and debugging exports. For each destination, record the source candidate identifier and the process that responds to anonymization or an approved deletion request.
A recommended implementation uses a restricted cross-system identifier map rather than matching deleted records by a name that may no longer exist. Define what the integration can retain after cleanup with legal and security reviewers. A deletion receipt should prove the action without recreating the personal information that was removed.
Keep external cleanup independent from candidate rediscovery. Our ATS database reactivation guide covers finding past candidates for new roles. Retention eligibility must be checked before that workflow reads a copied resume or prepares outreach.
Test the workflow before giving an agent write access
- Build synthetic profiles covering active, rejected, hired and multiple-application cases.
- Check office coverage and the behavior of an unattached prospect.
- Review selected fields, including names inside Activity Notes.
- Confirm due and failed filters are interpreted with their actual settings.
- Test an expired consent request as a separate exception.
- Verify external copied records cannot return in search after approved cleanup.
- Assign notification recipients and a recurring exception review.
Greenhouse records Automatic Anonymization setting changes and automatic anonymization activity in the Change Log. It also sends emails for due candidates and failures. Use those native records alongside the integration's evidence. Neither a dashboard count nor a successful API response alone proves that every external copy was handled.
How Remqa helps with recruiting data workflows
Remqa builds AI agents for recruiting teams and the integrations around them. A retention project can start with one Greenhouse rule, one external destination and a tested exception path. Bring your approved policy and current data flow to an engineer. Agree the deletion boundaries before expanding the automation.