Yes. Replacing an enterprise ATS touches IT, security, every recruiter and every hiring manager, and most teams plan it as a programme measured in quarters. Adding AI screening beside the ATS is a smaller decision: candidates leave the ATS as an export, get scored somewhere else, and the ATS stays the system of record. What stands between you and a pilot is the vendor security review. Its scope depends mostly on one design choice: whether the tool connects to your ATS or works from files you upload. HyreTech is the second kind. It reads a CSV export and a resume archive and never writes back.
This guide covers both kinds, the six questions a security team will ask of either, and what a good answer looks like.
Two Ways an AI Screening Tool Sits Beside an ATS
Tools in this category reach your candidates in one of two ways. Neither is better in general. They trade the size of the security review against day-to-day effort.
| API or marketplace connection | File upload | |
|---|---|---|
| How candidates reach the tool | The tool pulls them from the ATS, on a schedule or as they apply | Someone exports a CSV and the resumes, then uploads them |
| Credentials | An API key or OAuth grant held by the vendor | None. The tool never signs in to the ATS |
| Write-back | Often: scores, tags or notes appear in the ATS | None. Results stay in the tool |
| What security reviews | The connection, its permission scopes, token storage and the sync | The upload, storage, sub-processors and deletion |
| Day-to-day effort | Low once it is set up | One export for every batch you want scored |
| Where recruiters read results | Often inside the ATS | In the tool |
A connection makes sense when you want a score inside the ATS for every new applicant. A file upload is the smaller review and suits a pilot on one team or one role family, because nothing is installed and there is no standing access to revoke later. The cost is manual work: every batch is an export, and nothing flows back into the ATS by itself.
The Six Questions a Security Review Will Ask
Whichever route a vendor takes, the questionnaire comes down to the same six questions. A good answer is specific enough to check. A red flag is an answer you can't check, or one that answers a narrower question than the one you asked.
1. Does it connect to our ATS, and with what access?
For a connected tool, ask for the exact permission scopes it requests, where the token is stored, and how you revoke it. Read access to candidates is a different review from write access to candidates, jobs and users. For a file-based tool, the answer should be that there is no connection at all, and the review moves to what happens to the files you upload.
Red flag: "read-only", with no list of scopes.
2. Does it write anything back into our system of record?
Write-back changes the compliance picture, because your ATS then holds content a third party generated. If the vendor writes scores or notes back, ask which fields, whether a person can edit them, and whether you can switch the write-back off. If nothing is written back, the ATS record stays exactly as your team left it.
Red flag: "only metadata", without the field names.
3. Can it reject a candidate without a person?
Vendors often blur two things here: a model's recommendation and an automated decision. Many tools label candidates, and some of those labels say "reject". What matters is whether the label changes the candidate's status or sends a rejection email before anyone on your team acts on it.
Regulators draw the same line. If you hire people in the EU, GDPR Article 22 gives them the right not to be subject to a decision based solely on automated processing that significantly affects them.
In Singapore, the PDPA applies whether a person or a model reads the resume, and the PDPC's advisory guidelines on AI recommendation and decision systems encourage telling people what the system does and which personal data it uses. The guidelines are advisory, not binding.
Red flag: "a human is always in the loop", with no answer to what the software does on its own.
4. Where is candidate data processed, including by the AI model?
The hosting region is only half the answer. An AI screening tool sends resume text to a language model, and the model provider may process it somewhere else. Ask for the sub-processor list, where each one is located, and which of them receive resume text.
Red flag: one region given as the whole answer.
5. How long is candidate data kept, and how is it deleted?
Ask for the retention period, the deletion timeline for a verified request, and whether deleting a candidate also deletes their scorecards. Get the timelines into the contract, because a sales deck can change without notice.
Red flag: "we delete on request", with no timeline.
6. Can you show why a candidate ranked where they did?
Nobody can review a bare score. A score broken down by criterion, each with its reasoning, can be checked by a hiring manager this week and by someone else next year.
In Singapore this will matter more from end-2027, when the Workplace Fairness Act is slated to take effect. It makes adverse employment decisions based on protected characteristics illegal, including decisions made when hiring (TAFEP). Scoring against written, job-related criteria makes it easier to show what a ranking was based on.
Red flag: a score with no breakdown, or a breakdown with no reasoning.
How HyreTech Answers The Six
HyreTech works from uploaded files, so its answers look like this. The procurement detail is on the enterprise page.
| Question | HyreTech's answer |
|---|---|
| Connection to your ATS | None. You upload a roles CSV, an applicants CSV and a ZIP of PDF resumes |
| Write-back | None. You read scorecards in HyreTech, and your ATS is never modified |
| Rejection without a person | None. The model can recommend "reject", but only someone on your team can move or reject a candidate |
| Public posting | Imported roles start unlisted and stay off the public job board unless you list them |
| Processing location | The application and database run in Singapore (asia-southeast1) under HyreTech Pte. Ltd., with the PDPA as the primary regime. The privacy policy names the sub-processors that receive resume text, including the AI providers, and not all of them are in Singapore (details) |
| Deletion | Deletion requests are actioned within 30 days of a verified request (how to ask) |
| Rationale | Each criterion gets a score from 1 to 100 with written reasoning, weighted into one overall score. HyreTech drafts the criteria from the role, and every one is yours to edit before applicants are scored |
When a Full Migration is The Better Project
Some teams do want to consolidate onto one newer system eventually. If candidate history, approval workflows and reporting all need to move, that is a migration, and the Greenhouse migration walkthrough covers where candidate history gets lost on the way.
A screening layer beside the ATS suits teams that aren't ready for that project or don't want it. It doesn't rule a migration out later, because the ATS stays untouched either way.
Test it on a Role You've Already Filled
The fastest evidence, for your security team and for you, is a back-test. Take a role you've already closed, export its applicants, upload them, and compare HyreTech's ranking with the person you actually hired.
- Export the role and its applicants. What to export from your ATS lists the files and where to find them.
- Check the applicants file against the applicants CSV reference. Each row's
cv_filenamehas to match a PDF in the ZIP. - Upload the roles CSV, the applicants CSV and the ZIP together. One import takes up to 200 applicants.
- Read the ranking against your hire. Look at the criteria where they scored low as closely as at the overall number.
The free plan includes 20 AI credits and each scored applicant uses one, so a free back-test fits a closed role with up to 20 applicants. The import guide goes through the files column by column.
To run the back-test yourself: Start free and compare the ranking with your actual hire.
If your security team needs answers under your own vendor terms first: Book a demo and we will go through the six questions with them.
FAQ
Do I need to replace our ATS to use AI resume screening?
No. A screening tool that works beside the ATS gets candidates through a connection or a file export, and the ATS stays the system of record. HyreTech works from a CSV export and a ZIP of resumes and writes nothing back.
What does a security review for an AI hiring tool cover?
Six things: how the tool reaches your candidate data, whether it writes anything back, whether any step rejects a candidate without a person, where resume text is processed (including by the AI model), how long data is kept and how it is deleted, and whether each score comes with reasoning you can check.
Which platforms support exporting shortlists and writing decisions back to our ATS?
Tools that connect to your ATS through its API or marketplace can, usually by writing a score, tag or stage change onto the candidate record. Ask which fields they write and whether you can switch that off. File-based tools do not write back. HyreTech is one of them: you read the ranking in HyreTech and move candidates in your ATS yourself.
Is a file upload safer than an ATS integration?
It is a smaller review, because there are no stored credentials and no standing access to your ATS to revoke. It is not automatically safer: the uploaded resumes still need the same answers on storage, sub-processors and deletion. The trade-off is effort, since every batch needs a fresh export.
Is an AI "reject" recommendation the same as an automated decision?
Not while a person has to act on it. A label that ranks or flags a candidate supports a decision. Software that changes a candidate's status or sends a rejection without anyone acting on it makes the decision itself. Ask each vendor which of the two its tool does.
How many candidates can I test for free?
HyreTech's free plan includes 20 AI credits, and scoring one applicant uses one credit, so a free back-test covers a closed role with up to 20 applicants. One import takes up to 200 applicants, and pay-as-you-go top-ups cover the rest.