Quick answer: Protect your database in this order: tighten who can see and export what in your ATS, control every AI connection to it, log activity, cut access the moment someone resigns, and back it all up with contracts. AI changes the speed, not the rules. An assistant connected through MCP sees exactly what the recruiter can see, so permissions are now your main defense.
Why it matters legally: a New York appeals court ruled in June 2026 that a staffing firm’s candidate database was a trade secret, and made a rival pay for using an up to date resume a recruiter took from it. Courts protect data you visibly protect.
Who this is for: agency owners and ops leads who are about to connect AI to the ATS, or already have.
Why is a recruiting database easier to take with AI?
Because AI removes the effort. Taking a database used to mean exporting lists screen by screen or copying records by hand, which is slow and leaves traces. With an MCP connection, a recruiter can ask an assistant to summarize every client contact they have touched, every candidate placed in a skill area, or every open job with its pay rate, in one request. If their ATS role allows it, the assistant does it.
The vendors are clear that the AI does not get extra access. Workable says its MCP server inherits each user’s permissions and an administrator cannot grant the AI more access than the user already has, in its MCP security post. The other side of that is simple: whatever a recruiter can see, their AI can pull. We cover which platforms offer MCP in agencies and MCP access.
Is your candidate database actually a trade secret?
It can be, if you treat it like one. In Columbia Technology Corp v EJR Search Partners, decided June 30, 2026, a New York appellate court upheld a finding that a rival misappropriated trade secrets when it placed a candidate using information a recruiter took from his employer’s database. The defendants did not dispute that the database was a trade secret, and the court said the secret was not the candidate’s existence but the up to date resume pulled from the database, per the court’s decision. The rival had earned a $45,787 commission on that placement.
The catch is reasonable secrecy. A Loyola University Chicago analysis of staffing trade secrets notes that protection depends heavily on how carefully the business keeps the information secret, and that a bare candidate list may not qualify because candidates post resumes publicly, per Loyola’s IP blog. Every control below also strengthens your case if you ever need to sue.
Which ATS permissions should you lock down first?
Start with what each user can see and what each user can export. Using Bullhorn as the example, because so many agencies run on it:
| Control | What Bullhorn says | What to do |
|---|---|---|
| Record visibility | Departments decide whose records a user sees; user types decide what they can do | Use View Own or View Department where full visibility is not needed |
| Export to CSV | Can be allowed or blocked per user type and capped at 5,000, 10,000 or 20,000 records | Block for recruiters; keep for one or two admins |
| Export logging | Bullhorn does not log export history | Limit who can export, because you cannot check later |
| Bulk edit and mass mail | Controlled by action entitlements | Remove from roles that do not need them |
| Changes to roles | Only Bullhorn Support can change user type entitlements; ATS Growth edition cannot customize them | Open a support ticket with the exact restrictions you want |
Sources for the table: Bullhorn on departments, Bullhorn on entitlements, Bullhorn on exporting and Bullhorn user types.
Two details stand out. By default only admin users can export records in Bullhorn, so check whether that default still holds in your account. And because Bullhorn does not keep an export history, the only real protection is limiting who can export in the first place. Other ATS platforms differ, so ask your vendor the same five questions.
How should you control AI and MCP connections?
Treat each connection like a new user with a key to the building:
- One person creates connections. Recruiters can use an approved connection; they cannot add their own. Put this in your agency AI policy.
- Connect through a narrow account. For bridges that use an API user, such as the Bullhorn MCP options, give that user only the records and fields the job needs.
- Start read only. Add write actions one at a time once the team trusts the setup. Workable gives the same advice in its MCP guidance.
- Keep a connection register. Tool, connection, account, access level, who approved it and when.
- Ban personal AI accounts for agency work. A personal account’s chats, projects and saved memory leave with the recruiter.
What about connections recruiters already made?
Assume some exist. A BlackFog survey of 2,000 employees found 51% had connected AI tools to other work systems without IT approval, per BlackFog’s research. Ask the team, without blame, what they have connected, then rebuild the useful ones under an agency account.
What should happen the day a recruiter resigns?
Move fast, because the risk peaks before the last day, not after. In the New York case, the recruiter sent the resume to the rival while still employed. Run this checklist the day notice is given:
| Step | Why |
|---|---|
| Move them to a restricted user type with no export | Stops bulk downloads during the notice period |
| Remove their access to every AI tool and connection | Closes the fastest extraction route |
| Review recent activity in the ATS, email and AI admin logs | Spots forwarding to personal email or large AI requests |
| Reassign their open records and inbox | Keeps candidates and clients with the agency |
| Remind them in writing of confidentiality and non solicit terms | Shows the court you treated the data as secret |
Watch for personal email in particular. In a 2025 lawsuit, Employbridge alleged a departing executive spent the two weeks before resigning forwarding company files to his personal email, per HRD America’s report.
Which contracts back all this up?
Technology slows people down; contracts give you a remedy. At minimum, recruiters should sign a confidentiality agreement that names the candidate and client database, the job order details and pay rates as confidential, plus whatever non solicitation terms your state allows. Add a clause that agency data in any AI tool, chat history or project belongs to the agency. Have employment counsel draft these for your state, because enforceability varies widely.
What about candidate privacy?
Protecting the database from your own staff is half the job. The other half is what you let AI do with candidates’ personal data at all, which depends on your privacy notice and the laws where you recruit. Our candidate data and AI guide covers it, and our guide to resume prompt injection covers the risk of outside files steering your AI.
Quick answers
Can a recruiter use AI to copy our whole database?
If their ATS role can see it and they have an AI connection, yes, much faster than by hand. Restrict visibility and connections first.
Does Bullhorn log exports?
No. Bullhorn’s own help center says it does not log export history, so limit export rights to trusted admins.
Is a candidate database a trade secret?
It can be. A New York appeals court treated one as a trade secret in June 2026, but protection depends on keeping it reasonably secret.
Should we block AI entirely?
Bans push use into personal accounts you cannot see. An approved tool with tight permissions is safer.
What is the first thing to do this week?
Ask your ATS vendor who in your account can export records and how many, then cut that list to the people who truly need it.
The bottom line
AI does not create new ways to take your database; it makes the old ones faster. Lock down visibility and exports in the ATS, let one person own every AI connection, start read only, move quickly when someone resigns and keep your contracts current. For every guide in this series, see MCP for staffing agencies.
Sources: Workable, NY Appellate Division, Loyola IP Bytes, Bullhorn departments, Bullhorn entitlements, Bullhorn exporting, Bullhorn user types, BlackFog, HRD America
Free newsletter
Get the Work Insiders weekly
One email a week: the recruiting and HR tech news that mattered, the tools we just added to the directory, and one practical guide. No spam, and you can unsubscribe in one click.