Skip to content
AwakastLet's talk

A recruitment agency in Poland, in-house applicant tracking system

A recruitment agency got a clear, prioritized plan for the ATS it built with AI

The agency replaced an expensive commercial ATS with one it built itself using AI tools, and its recruiters use it every day. We reviewed the code and configuration and told the agency, in plain language, what to fix first and what its options were.

Built with AI

report, in plain language
Prioritized
for hosting, plus a development plan with estimates
3 options

Where the agency started

A recruitment agency in Poland was paying for an expensive commercial applicant tracking system. Instead, it built its own with AI tools. The system works: the recruiting team uses it every day, and it holds over ten thousand candidate CVs. It ran on Netlify, with Supabase for the database and files. The agency asked us to review the code and configuration. The review opened with an honest assessment: the system was built consistently and fit what it is today, an internal tool for a team that trusts each other. Some early decisions had never been made on purpose, and some were forced by the hosting setup.

What we did

We read the code and the configuration of the application, database, file storage and hosting. Then we wrote a prioritized report in plain language: what each issue means for the business, how urgent it is and what to do about it. We also recorded what already works well and should stay, such as a well-designed data model, commission amounts calculated on the server and a stage history kept by the database itself. Alongside the report, the agency received a Hosting and care proposal in three variants and a development plan with estimates.

Deliverables

  • Review of the application code, database, file storage and hosting setup

  • Prioritized findings report in plain language

  • A list of what already works well and should stay

  • Hosting and care proposal in three variants

  • Development plan with estimates

What the review found

These were the points that most needed a decision at the time of the review. None of them came from carelessness. Most came from early choices that were never written down, or from limits of the hosting setup.

  • Everyone could see everything.

    The system had roles for recruiters, account managers and administrators, but permissions were checked only in some places. In practice, every logged-in user could see all candidates and clients, including commission data. That can be a fair choice for a small team, but it should be a decision, not a side effect.

  • Access was easy to get and hard to take away.

    An account was created on first login with any company email address and a shared starting password. Deleting a user did not really remove access. We recommended invitations from an administrator, and later sign-in with the company's own Google Workspace accounts.

  • A public diagnostic page said too much.

    A page meant for checking deployments answered anyone and showed configuration details. It did not reveal passwords or keys, but it told outsiders more than they needed to know. We recommended putting it behind login or reducing it to a simple "working / not working".

  • Files and background jobs depended on the setup.

    Candidate files had no backup of their own, because database backups do not cover files. The hosting setup could not run background jobs, so AI search had to be simplified to fit time limits, and automatic deletion of candidate data after consent expires (GDPR data retention) could not run.

What the agency got

The agency continued developing the system itself, working from the findings. The review also showed that the application depends very little on its current platform, so moving to hosting that can run background jobs would be a manageable step whenever the agency decides to take it.

findings report, each finding with its business impact and a recommended fix
Prioritized
of a Hosting and care proposal
3 variants
development plan for the next stage
Estimated

This was a technical risk review, not a legal opinion or a compliance check.

Technology

  • Next.js
  • PostgreSQL
  • Supabase (database and file storage)
  • Netlify
  • An external AI model provider (CV parsing, candidate search, CV anonymization)

Find out who can see what in the app you built with AI.

Tell us what you're building