By Alexander Rocket, co-founder, FormaCV
In August, Quibench, a UK tool that recruitment agencies used to format and redact candidate CVs, closed. Its website notice says it no longer operates under the brand, existing accounts are shut and stored candidate CVs and uploaded files have been deleted. The notice is dated 11 August 2026.
No agency plans for this. Recruitment tech is a crowded market, though, and small vendors close, get acquired or change direction every year. When one of them held your candidates’ personal data, the closure raises questions that remain your responsibility. Where your agency determines why and how candidate data is used, it is the controller under UK GDPR; a tool processing that data on your behalf is a processor.
What follows is a practical checklist, written for agency owners and operations leads. I co-founded a company that sells CV formatting software, so read it with that in mind. None of the steps depend on which tool you use next.
1. Find out exactly what happened to the data
Start with the vendor’s closure notice and your contract. Article 28 of UK GDPR requires the contract between a controller and a processor to provide for the deletion or return of personal data at the controller’s choice when the service ends, with existing copies deleted unless UK law requires their retention. The ICO’s guidance on processor contracts sets out these requirements.
Ask the vendor, in writing, for:
- confirmation of the date the data was deleted
- whether backups and sub-processor copies were deleted too, and any retention arrangements that still apply
- a written statement you can file
If the vendor is unreachable, record your attempts. A dated note of what you asked and when is useful if the ICO ever asks how you handled it.
2. Update your own records
Review your record of processing activities, where required under Article 30, your supplier records and your candidate privacy notice. Update any references that are no longer accurate. If the vendor used sub-processors, such as a hosting provider or an AI model provider, check whether your notice names them. Only remove references once they no longer receive or retain data on your behalf, and retain an internal record of the previous arrangement.
This is the kind of housekeeping that an audit can bring into focus.
3. Rebuild what only lived in the tool
This is often where the real loss is. Client-specific CV templates, anonymisation settings per client and naming conventions often existed only inside the vendor’s system. If nobody kept a master copy, someone now has to rebuild them from old outgoing CVs.
Pull five recent client submissions per major client and use them as the reference for the rebuild. Store the template files somewhere the agency controls, whatever tool you move to.
Store the template files somewhere the agency controls, whatever tool you move to.
Alexander Rocket, co-founder, FormaCV
4. Ask better questions of the next vendor
The closure is a useful prompt to tighten due diligence. Before you sign with any tool that will touch candidate data, get written answers to these:
- Where is the data hosted, and in which country? UK or EU hosting can simplify some international transfer questions, but check overseas access and onward transfers as well.
- Who are the sub-processors? Ask for the list and how you will be told about changes.
- How long is candidate data kept after processing? A formatting tool rarely needs to keep a CV for long after it has been formatted.
- What happens at the end of the contract? Look for the Article 28 deletion-or-return clause and ask how deletion is confirmed.
- Can you export your templates and settings? If the answer is no, you are rebuilding again next time.
- Will they sign a data processing agreement before the trial starts? A trial with real CVs is processing real personal data.
None of these questions is unusual. A vendor that cannot answer them quickly is telling you something.
5. Keep the redaction habit, even between tools
Quibench was built around redaction, so its users relied on it for blind CVs. Redacting CVs before they go to a client removes details that should not influence a shortlist, such as name, photo, age and contact details, and reduces the personal data you share. Removing these details does not necessarily make a CV fully anonymous: employment history and other information may still identify the candidate.
That habit should not lapse while you choose a replacement. A manual checklist is slower but better than sending full CVs by default for a few weeks.
If you are replacing a redaction tool, test the new one on your hardest CVs: scanned documents, two-column layouts and CVs with photos. Those are the files where automated redaction tends to miss something.
The wider point
Recruitment runs on a lot of small tools, and each one holds a slice of candidate data. Agencies that manage those tools with appropriate contracts, records and an exit plan are better placed to limit disruption when a vendor closes. Agencies that do not can lose their client templates and a lot more time.
Alexander Rocket is co-founder of FormaCV, which makes CV formatting and anonymisation software for recruitment agencies.
