Technology due diligence on a staffing firm: ATS, data and AI use

What technology diligence on a staffing firm should answer#

Technology diligence on a staffing firm answers three questions: can the platform keep the target's desks running after close, can it combine the target's data with its own, and can it govern the AI tools already in use. For a buy-and-build platform, integration effort and data usability usually matter more than the target's feature list.

Scope the work around records, not software brands. Recruiters can learn a new ATS in a few training sessions; a candidate database that cannot be exported cleanly, or that was collected under narrow notices, cannot be fixed by training.

Map the systems before reading any contract#

A system map shows where every record family lives and how records move between systems. Ask the target's operations lead to walk through one placement from job order to final invoice and note every system it touches, including spreadsheets.

The walkthrough usually surfaces shadow systems that never appear in the IT inventory: a recruiter's personal texting app, a shared spreadsheet of client rates, or a VMS portal where the only copy of a timesheet lives.

ATS contract, ownership and export rights#

The ATS contract decides whether the platform can take the data with it, and an export test decides whether that right works in practice. Ask for the full subscription agreement, order forms and any data processing agreement, not a summary from the vendor's sales team.

• 1Confirm the contracting entity and whether the subscription can be assigned on a change of control.
• 2Read the data ownership, export and post-termination access clauses, including any fees for bulk export.
• 3Check API limits and whether attachments such as resumes and signed documents export with their records.
• 4Run a full test export of candidates, contacts, job orders, submittals, placements, notes and files.
• 5Note custom fields and workflow configurations that will need mapping in a migration.
• 6Find out whether the ATS vendor uses customer data to train its own AI features, and how to opt out.

Data quality tests to run on the export#

Data quality tests turn a vague claim about database size into a usable record count. Run them on the test export, not on a dashboard the target provides, and have someone from the platform's own operations team review the results.

Record the results as findings with examples rather than scores. An integration team needs to know which fields are broken and why, not just that quality is low.

AI tools inventory and governance#

An AI tools inventory lists every tool that reads, scores or writes candidate and client data, including features switched on inside the ATS. Staffing firms now use AI for resume parsing, matching, outreach drafting, interview scheduling, candidate chatbots and call or interview note-taking, often without a central list.

For each tool, record the owner, the decisions it influences, whether a person reviews its output before a candidate is rejected, the vendor's terms on training with customer data, and any bias audits or candidate notices required where candidates are located. Ask whether any client MSA requires AI disclosure or prohibits specific tools.

Gaps here are usually integration items rather than deal breakers. A tool that rejects candidates automatically with no human review, however, is a governance issue to fix soon after close and may warrant a closer look from employment counsel.

Privacy notices, consent records and provenance#

Privacy notices determine what the platform may do with the candidate database after close, so collect every version with the dates it was live. Match those dates to record creation dates and flag records collected under notices that do not cover the platform's plans.

A provenance record makes this repeatable. The Data & Trust Alliance's Data Provenance Standards define a Use group of metadata that includes consent documentation location, confidentiality classification, license to use and intended data use. Capturing similar fields for each record family gives the platform a ready answer when a client, regulator or data buyer later asks where records came from.

Also ask how deletion requests were honored, what retention schedules apply to screening and onboarding documents, and whether any data has been shared with or licensed to third parties.

Illustrative: a staffing platform finds two databases in one#

Illustrative: a fictional PE-backed engineering and IT staffing platform is acquiring a regional firm. The target reports a large candidate database in its ATS and runs an AI matching feature on every new job order.

The test export shows that a migration from a previous ATS left two copies of many candidates, with notes split between them, and that resumes from the old system did not export with their records. The matching feature ranks candidates, but recruiters see only the top results, which counsel treats as a human-review gap. The platform budgets a migration and deduplication project, adds a review step to the matching workflow, and keeps the legacy archive under a retention plan instead of merging it blindly.

How SourceX helps after close#

Platforms often inherit legacy ATS archives that will be retired after migration. SourceX can assess those archives with a metadata-only fit check before subscriptions lapse, so the platform knows whether any de-identified workflow records are worth preparing and licensing.

Any package that proceeds follows the SourceX five-step transaction, with candidate personal data removed in Preparation and a SourceX Evidence Packet recording provenance, licensing rights, permitted use, the privacy record and release authorization.