Recruitment Agency Portal: Work Without Sharing Your ATS

How to Open a Recruitment Agency Portal Without Sharing Your ATS

You can work with an external recruitment agency inside one ATS without handing it a seat in your system. The way to do it is a recruitment agency portal: a separate sign in on its own path, where you assign specific jobs, set the rules before the first submission, and receive every submission as a timestamped frozen record with a coded decision. Your jobs, candidates, interviews, and offers stay yours, and the agency sees only what it needs.

A recruitment agency portal is a sign-in path separate from your company system that lets an outside agency work on specific jobs without seeing the rest of your candidate pool, your stage names, or your interviewers' scorecards. This article shows how to build one on three pillars: a standalone portal, rules before the first submission, and a frozen record that stays audit-clean.

Key takeaways

A recruitment agency portal is a separate path such as /agency/<tenant>/login, isolated from your company system, and the agency needs no seat in Attract.
The agency sees only its assigned jobs, its own candidates, and its submissions, plus numeric progress like "Step 2 of 5" with no stage names, no interviewers, and no other agency's candidates.
You set each job's rules before the first submission: priority, salary shown or hidden, a submission cap, deal breakers, and excluded companies.
Every submission is a frozen snapshot taken at send time, with the candidate's consent timestamped to support Personal Data Protection Law (PDPL) compliance.
When you swap one agency for another, only the operational follow-up moves, while credit for the original submission stays put. That matters for fees.

What is a recruitment agency portal, and why isn't a login in your system enough?

Share a role with an agency over email and spreadsheets and you lose track of who sees what. Give the agency a full account in your system and you open the door to everything: your other candidates, your other jobs, sometimes your internal scores. The fix is not more trust. It is a clearer boundary.

A recruitment agency portal draws that boundary with a fully separate sign in. The agency logs in through its own path, something like /agency/<tenant>/login, kept apart from the company system, and it holds no Attract seat and no license.

Inside the portal, visibility is deliberately trimmed. The agency sees only its assigned jobs, its own candidate list, its submissions, and the follow up. The company stays the owner of the jobs, the candidates, the interviews, and the offers.

The important part is what the agency never sees. It gets numeric progress only, such as "Step 2 of 5." No stage names, no interviewer names, no scorecards, and no candidates from any other agency. The module is off by default for every company and switched on from settings when you need it.

Diagram comparing what your team sees in the ATS versus what a recruitment agency sees in its separate portal

This separation is not a security nicety. In Verizon's 2025 Data Breach Investigations Report, the share of breaches that involved a third party doubled from 15% to 30% in a single year. Every outside party with access to your system is another risk surface, and shrinking it starts with giving that party no more than it needs.

Bar chart showing third party involvement in data breaches doubling from 15% to 30%

Which approach fits your team?

Before you choose, compare the three common ways to work with agencies:

Criterion	Full seat in your ATS	Email and spreadsheets	Separate agency portal
Sees your whole pipeline?	Yes, and that is the risk	Partly, and messily	No
Candidate data exposure	High	High and scattered	Limited to its own
Rules set before submissions	Weak	Absent	Built in
PDPL ready audit trail	Fragmented	Manual and fragile	Complete and timestamped
Clear fee attribution	Ambiguous	Memory-based	Locked per submission

The practical difference: a separate portal gives you the collaboration without giving up ownership or compliance.

How do you set the rules before the first submission arrives?

The thing that wears out a talent team is not a shortage of candidates. It is the flood of CVs that don't fit. Control starts before the first submission lands, not after.

In the recruitment agency portal, every job carries its own assignment. You set the priority, choose to show or hide the salary per assignment, cap the number of submissions, list the deal breakers, name the excluded companies, and fix the dates. The agency works inside those limits, not around them.

On top of that you set visibility policies. You can require screening before an agency submits, and hide agency candidates until you accept them internally. With that in place, no agency candidate reaches the hiring manager until you say yes.

The result is a governed number of matching submissions, instead of a pile of CVs that never fit the job description in the first place.

This is where the AI in Attract works as an assistant, not a replacement for your judgment. It reads the CVs, scores them against the job description, and ranks the best fit to the top, so the governed submissions you do receive arrive sorted by relevance. The time saving is real: in LinkedIn's Future of Recruiting 2025, teams using AI saved about 20% of their work week, close to a full working day. Adoption is climbing in Saudi Arabia and worldwide too. SHRM found AI use in HR tasks rose to 43% in 2025 from 26% in 2024, with recruiting among its most common uses.

Why should every submission be a frozen snapshot and a coded decision?

When two agencies disagree over who sent a candidate first, or when an audit asks "when did this candidate consent to share their data?", you need a record that does not change. The frozen snapshot is that record.

Every submission is a frozen snapshot taken at send time: the identity, the CV, the pitch, the expected salary, the notice period or availability, the candidate's timestamped consent for PDPL, and the screening result. None of it changes after the send.

Diagram of the submission lifecycle from assignment and rules to a frozen snapshot, coded decision, and locked attribution

After you review, you make one clear decision: accept the candidate onto a pipeline stage, reject with a coded reason the agency can see, or mark a duplicate source. A coded rejection gives the agency a structured answer instead of silence, alongside a private internal note that stays with you.

Rejection reason code	When to use it
Skills don't match	Experience doesn't cover the role's requirements
Job level	Seniority is above or below what's needed
Salary out of range	Expectation sits outside the role's band
Location	Candidate is outside the required location
Notice period too long	Availability is later than the hire needs
Role filled	The job closed before review

This discipline is not just an operational detail. It is a compliance pillar. Saudi Arabia's Personal Data Protection Law (PDPL) has been fully enforceable since 14 September 2024, overseen by the Saudi Data and AI Authority (SDAIA), and unauthorized disclosure of personal data is among the violations it enforces, with fines reaching five million riyals. A timestamped consent inside each snapshot gives you ready evidence instead of a late search through old email.

One last point matters for the money: attribution. When you replace one agency with another, only the operational follow-up moves to the new agency, while credit for the original submission stays put. Whoever sent the candidate first keeps the attribution, and that is what settles commission disputes before they start.

Where does Solvait Attract fit?

These three pillars are built into Solvait Attract, Solvait's AI powered recruitment system, through its Recruitment Agency Module. The agency works on the same tenant from a separate partner portal with no Attract seat, you set the assignment and the rules, you receive frozen submissions, and you decide with an accept, a coded reject, or a duplicate flag, while attribution stays locked.

The AI here is an assistant: it parses, scores, and ranks CVs against the job description so your internal team reaches a decision faster without surrendering ownership of the data. If you want to try the AI screening on its own first, the CV Match Analyzer is a light place to start.

Solvait is a Saudi company built on Microsoft Dynamics 365, serving more than 260 enterprise clients, live in 30 days, with time savings of up to 50%. You can review implementations on the customer stories page.

See how the recruitment agency portal looks on your own data. Book a demo with Solvait.

Frequently asked questions

Can a recruitment agency see the rest of your candidates?

No. In its portal, the agency sees only its assigned jobs, its own candidates, and its submissions. The rest of your candidate pool, your other jobs, and other agencies' candidates are hidden from it, and ownership stays with the company.

Does the agency need an Attract license or seat?

No. The recruitment agency portal is a separate partner path on the same tenant, and the agency logs in without an Attract seat or license. The module is off by default for every company and enabled from settings when needed.

How does the frozen snapshot support PDPL compliance?

Each submission is saved as a fixed snapshot that includes the candidate's timestamped consent and the screening result, so you hold a ready audit trail showing what the agency shared and when the candidate consented. This supports the PDPL requirements SDAIA enforces.

What happens to attribution if you swap agencies?

The operational follow up for the job moves to the new agency, while credit for the original submission stays with whoever sent it first. That separation protects commission accounting from disputes when agencies change.

Can you cap the number of submissions per job?

Yes. Each assignment has its own rules, including a submission cap, salary shown or hidden, deal breakers, and excluded companies, so you receive a governed number of matching submissions only.

References

Verizon: 2025 Data Breach Investigations Report, 2025 (third-party involvement in breaches doubled from 15% to 30%).
SDAIA: Regulations and Policies, Personal Data Protection Law (PDPL), 2024 (full enforcement, oversight, and penalties).
LinkedIn: The Future of Recruiting 2025, 2025 (about 20% of the work week saved with AI).
SHRM: 2025 Talent Trends: AI in HR, 2025 (AI use in HR tasks rose to 43%).
Solvait: Solvait Attract (Recruitment Agency Module and Solvait's first-party numbers).