Recruit CRM landed 2 enterprise clients within 45 days of getting compliant
Recruit CRM is a recruitment software platform that helps staffing agencies manage candidates, clients, and hiring pipelines. The platform captures and processes sensitive, personally identifiable information about candidates and employers, and is used by recruitment firms in 100+ countries.
– Tanuj Sharan
DevOps Engineer, Recruit CRM
– Tanuj Sharan
DevOps Engineer, Recruit CRM
Introduction
Recruit CRM helps staffing agencies worldwide manage their recruiting workflows, from candidate tracking to client management. The platform handles sensitive, personally identifiable information about candidates and employers, making data security a central concern for the business and its buyers.
While Recruit CRM operated security-first and was already GDPR compliant, security questions still surfaced in most sales conversations. The team recognized that operating with strong internal practices was necessary but insufficient. Prospects needed proof: audit reports and certifications that demonstrated the company’s commitment to protecting data.
The Problem
Six out of ten prospects asked specifically about ISO 27001 and SOC 2 compliance, and the absence of certifications was creating real friction in the pipeline. “A lot of business, especially from large and enterprise companies, was being put on hold because we lacked certifications,” remembers Tanuj Sharan, DevOps Engineer at Recruit CRM.
The team tried to bridge the gap by directing prospects to AWS compliance reports, leveraging the native credibility of their cloud provider. It proved insufficient. Prospects continued to send lengthy IT security questionnaires, each one demanding justification for the lack of independent certifications.
After an annual security assessment exercise with a third-party vendor, the urgency to operationalize SOC 2 compliance became clear. “Our security assessment vendor could not help us get compliant, and that’s when we started to look for an implementation partner,” notes Tanuj. Championed by CEO Shoanak (Sean) Mallapurkar, the team chose Sprinto to anchor their compliance program.
The Solution
Recruit CRM kicked off its dual ISO 27001 and SOC 2 journey by integrating the existing tech stack with Sprinto over a short sprint. “Within an hour of the first call, admin users were decided, alerts for potential spikes were set up and a slack channel was created for communicating with the Sprinto team,” remembers Tanuj.
Sprinto’s control-based approach made running both standards in parallel practical. Because compliance evidence tied to a single control can map to every standard that requires it, building a multi-standard audit evidence library became straightforward. “In our case, there was a 95% control overlap between the two so it made sense to tackle both SOC 2 and ISO 27001 together,” remarks Tanuj.
From there, the team focused on administering and strengthening the security controls recommended for both frameworks: two-factor authentication, antivirus installation on devices, security training, policy acknowledgments, and other risk management measures. Sprinto’s compliance workflow automation supported implementation documentation and helped the team move through each requirement methodically.
One particularly significant win came from enabling AWS GuardDuty and connecting its monitoring to Sprinto. “DoS attacks are difficult to check and manage manually. Tagged to Sprinto and supported by automated alerts, we optimized the process and helped set the tone for surveillance,” adds Tanuj.
Impact
Recruit CRM reached audit readiness for both SOC 2 Type 2 and ISO 27001 in under 10 sessions. The team then underwent a combined audit, using the evidence library it had built to move through both audits without back-and-forth delays.
The business impact followed quickly. “Within 30-45 days of becoming compliant, we onboarded 2 enterprise clients!” says Tanuj. Pending deals that had stalled over missing certifications were unblocked, and new opportunities opened up.
Beyond the certifications themselves, Tanuj recognized a qualitative shift across the organization: increased security awareness and discipline among employees. “They have understood that they cannot copy-paste their credentials anywhere and must proactively initiate actions on getting alerts,” he says.
The alerting system proved its value almost immediately. Sprinto flagged the team when message queues in AWS Simple Queuing Service (SQS) crossed 200, bringing the issue to their attention instantly and saving approximately 10 minutes of potential downtime. With visibility across infrastructure, controls, people, and devices consolidated in one place, Recruit CRM now manages its security posture with the same rigor it brings to its product.
Got questions? Talk to our experts!
Recruitment Technology
201-500
India
