Yes. We support agencies running Bullhorn, Vincere, JobAdder, Access Recruitment, Mercury and Salesforce-based systems, along with the surrounding stack — job boards, CV parsing, email integration, dialler and VoIP platforms, and reporting tools.

It is worth being clear about the division of labour. We are your IT partner rather than your CRM vendor: for deep in-application configuration and product bugs we work alongside your platform's support team and manage the escalation, so your operations manager is not chasing two suppliers who each blame the other.

What sits squarely with us is everything the CRM depends on — identity and single sign-on, conditional access, connectivity, endpoint performance, device configuration, integration health with Microsoft 365, and backups covering data the vendor does not retain for you. Most "the CRM is slow" tickets originate in that layer.

By making it a process rather than a favour. Agencies churn consultants far faster than most sectors, and the usual failure mode is that new starters lose their first day to setup while leavers keep access for weeks.

For starters, we work from a defined build per role, so a consultant arrives to a configured laptop, CRM access at the right permission level, mailbox, dialler profile and MFA already enrolled. Given reasonable notice, they bill from day one.

For leavers, we run same-day deprovisioning against a checklist: sessions revoked, mailbox converted and retained, device wiped or collected, CRM access removed, and mobile access cut. Crucially, we log it — so if a dispute arises later about what someone could still reach after their last day, you have a record rather than a recollection.

Both processes are documented and repeatable, so they do not depend on one person remembering every step.

Honestly, no control makes this impossible — but you can make it visible, difficult and evidenced, which is what matters both commercially and if you ever need to enforce a restrictive covenant.

The controls fall into three layers. Prevention: permissions scoped so consultants see the records they need rather than the whole database, restrictions on bulk export and mass CV download, monitored personal cloud storage and webmail, and USB controls where appropriate. Detection: alerting on behaviours that precede a resignation — unusual export volumes, mass record views, mailbox forwarding, out-of-hours downloads. Evidence: audit logs retained so you can establish who accessed what and when.

Timing is the part agencies most often get wrong. Exfiltration usually happens in the weeks before a resignation is announced, not after. Monitoring that only begins when someone hands in their notice is monitoring that starts too late.

Two obligations pull against each other. Under the Conduct of Employment Agencies and Employment Businesses Regulations 2003, records relating to candidates you have acted for must be kept for at least a year from when you last provided services, and made available to Employment Agency Standards inspectors on request. UK GDPR meanwhile requires you not keep personal data longer than necessary — and the ICO's recruitment and selection guidance is clear that unsuccessful applicants' records should not be retained beyond the period in which a claim could be brought, absent a clear business reason.

There is no single lawful number. What matters is that you set a documented, justifiable retention schedule and can show it is actually enforced rather than aspirational.

We make that technically real: automated retention and deletion rules across your CRM, mail and file storage, so records age out without anyone remembering to act. For subject access requests, we configure search and export across your environment so a DSAR can be answered within the statutory month without a fortnight of manual digging.

There is no legal requirement, but commercial pressure is real and increasing. Cyber Essentials is a government-backed certification covering five foundational technical controls, and has become a common threshold in supplier due diligence.

If you bid for public sector work, certification is required on many government frameworks. For a place on a large corporate PSL, expect a security questionnaire covering access control, encryption, breach history and sub-processors — and expect it to get harder each renewal as clients tighten their own third-party risk management. Some insurers now ask too.

Beyond the badge, the assessment reliably surfaces gaps agencies did not know they had: inconsistent patching, dormant accounts belonging to consultants who left months ago, personal devices touching the CRM.

We support agencies through Cyber Essentials and Cyber Essentials Plus, and can advise on whether ISO 27001 is worth pursuing for the client base you are targeting.

Speed and sequence both matter. Our SOC monitors continuously, so indicators of compromise — impossible-travel logins, new mailbox forwarding rules, credential exposure, unusual bulk exports — are triaged rather than discovered later.

On confirmation we contain: isolating devices, revoking sessions and tokens, forcing credential resets, removing malicious rules and closing the entry route. We preserve evidence properly at the same time, because premature clean-up destroys the trail you need for your own investigation and for any insurance claim.

We then support your reporting decisions rather than making them. A personal data breach meeting the risk threshold generally requires ICO notification within 72 hours, and where there is high risk to individuals you may also need to tell affected candidates directly — an uncomfortable conversation, since that data belongs to people who trusted you with a confidential job search. Which is exactly why an accurate account, fast, is worth so much.

Your data protection lead makes the call. We supply the technical facts, a written timeline, root cause analysis and remediation plan.

Managed support for agencies broadly runs from around £40 to £90 per user per month. The range is wide because the label covers materially different scopes.

The main cost drivers are security depth (a managed SOC and data loss prevention cost more than antivirus and a firewall), support hours, whether you still run on-premise infrastructure or work fully in the cloud, how many integrations sit around your CRM, and the volume of starter and leaver activity you generate.

That last driver is worth flagging at quoting stage. Agencies with heavy churn consume more service-desk time than headcount alone suggests, and providers pricing purely on user count often recover the difference through project charges later. We would rather scope it honestly upfront and quote a fixed monthly fee. It is also worth weighing cost against exposure: a morning of CRM downtime across twenty consultants has a calculable cost in lost calls and delayed placements.

Yes, and this is where we differ from most London-focused providers. Northern Star already acts as the European IT arm for multinational organisations, delivering local support in line with standards set by a head office elsewhere.

This matters more here than for a static business, because international expansion is often how recruitment firms grow. Opening a desk in Dubai, Amsterdam or Frankfurt tends to mean a local IT arrangement bolted on in a hurry — and within two years you have inconsistent controls, no unified view of who can reach the CRM, and suppliers nobody has assessed.

We combine a central service desk with scheduled on-site embedded days at satellite offices, so a five-person overseas team gets the same standard as your London floor. Consultants working from home, client sites or airports get secure access through managed devices and conditional access rather than a VPN nobody uses.

Both work. Many agencies have one internal IT person covering everything from laptop builds to CRM administration. A co-managed arrangement lets you set the split — commonly, they keep CRM and business systems while we take the service desk, out-of-hours cover, SOC monitoring and projects. It also provides continuity when your single IT hire takes leave or resigns.

Switching is usually less disruptive than agencies expect. Most Northern Star clients are onboarded within two to four weeks, and a well-planned transition should not require downtime beyond agreed maintenance windows.

We start with a full audit: systems, licences, suppliers, security posture and the undocumented arrangements that always exist — dormant accounts and forgotten admin credentials are near-universal findings in this sector. We then agree a transition plan with defined milestones, running in parallel with your incumbent where possible. Administrative credentials are transferred and rotated securely, the outgoing provider's access is removed and confirmed, and the handover is documented.