Most searches for a UK-compliant alternative to Lever ATS do not come from teams who think Lever is a bad product. They come from teams who have hit a specific wall: a security review that asked where candidate data is processed, a client contract requiring UK data handling, or a screening bottleneck that no amount of workflow configuration fixes. Those are fit problems, not quality problems, and they deserve an honest comparison rather than a competitor takedown.
This piece sets out where a US-headquartered applicant tracking system can leave a UK buyer exposed, what to verify rather than assume, and when supplementing beats replacing.
Start by Being Fair About What the Incumbent Does Well
Established applicant tracking systems in this category are genuinely strong at several things, and pretending otherwise wastes everyone's time.
They handle pipeline management and collaborative hiring well. Interview scheduling, structured scorecards, stakeholder feedback collection and reporting are mature. Integration ecosystems are broad, so job boards, assessment tools, background check providers and HR systems connect without custom work. The interfaces are polished and adoption is usually straightforward. For a scaling company running a conventional hiring process, that is a well-solved problem.
If you are considering a move, be clear about which of those you would be giving up, because a screening gain that costs you scheduling and collaboration is not obviously a gain.
The Two Gaps UK Buyers Actually Hit
Gap One: Where the Data Goes
Regulated UK buyers, law firms, financial services, government bodies, healthcare, anyone holding client contracts with data clauses, need to answer specific questions about candidate data. Not "is the vendor reputable", but the narrow, verifiable ones.
The important thing here is that these are questions to ask, with answers that vary by vendor, by product tier, by region selected and over time. Do not accept a general assurance, and do not take a blog post's word for it either, including this one. Ask the vendor directly and get it in writing:
- Which region holds primary storage, and which regions hold backups and replicas?
- For every AI feature, where does model inference execute, and which provider operates it?
- Can support or engineering staff outside the UK access production candidate data?
- What is the complete sub-processor list, with regions and the data categories each touches?
- Is candidate data used to train any model, the vendor's or a third party's, and is the answer contractual?
- Where transfers occur, what mechanism applies and is there a transfer risk assessment?
- Who holds encryption keys, in which jurisdiction?
A vendor headquartered outside the UK can answer all of these satisfactorily, and many do. The reason it matters for US-headquartered suppliers specifically is that additional considerations can arise around foreign legal regimes with extraterritorial reach, which contractual safeguards do not fully neutralise. Whether that residual exposure is acceptable is a judgement for your legal and risk functions given the sensitivity of the data, and recruitment data is more sensitive than it is usually treated as, containing employment history, qualifications, sometimes health information disclosed in an adjustment request, and increasingly detailed assessment records.
Gap Two: the Screening Layer Is Thin
This is the gap that persists even when the residency answers come back clean, and in day-to-day terms it is the more painful one.
Applicant tracking systems are, architecturally, workflow and record-keeping systems. They move candidates through stages, capture structured feedback, and report on the funnel. What they generally do not do is read the CV and tell you what is actually evidenced in it.
Where screening exists it typically amounts to keyword matching, knockout questions, and increasingly a generative summary of the document. Each has a real limitation. Keyword matching detects term presence, which is a signal that has been fully commoditised now that any candidate can generate a term-perfect CV in seconds. Knockout questions rely on self-report. And a generative summary condenses the document without validating anything in it, a fluent paraphrase of an unevidenced claim is still an unevidenced claim, now expressed more persuasively.
The practical consequence is familiar: the shortlist is full of people who match on paper and the first call reveals they cannot describe the work. The workflow was never the bottleneck. The reading was.
Replace or Supplement?
This is the decision most teams get wrong in one direction or the other, so it is worth separating the cases.
Supplement When
- Your pipeline management, scheduling and collaboration genuinely work and people have adopted them.
- Your pain is concentrated at the top of the funnel, in the volume of CVs that need assessing.
- Your residency answers came back acceptable, or the exposure is on the screening path specifically and can be addressed there.
- You have integration capacity, even minimal, to move batches out and results back.
In this pattern the screening layer sits between application and pipeline: export the cohort, assess it against your actual criteria with evidence attached, return the outcome and the record to the system everyone already works in. You keep what works and fix what does not.
Replace When
- Residency or sub-processor answers are unacceptable and cannot be remediated for the core record, not merely the screening step.
- Cost is disproportionate to the value you extract, which is common where a team uses a fraction of an enterprise platform.
- Your process has diverged from what the platform assumes, and you are fighting it continuously.
- A client or regulatory requirement makes the current arrangement non-viable regardless of preference.
Replacement is a real project with real disruption. It is justified by a structural mismatch, not by a feature gap that a supplementary layer addresses more cheaply.
Building an Honest Comparison
If you are running a formal evaluation, score these dimensions separately rather than as an overall impression. Mixing them is how evaluations end up preferring the best demo rather than the best fit.
- Data residency and processing location, covering storage, backup, inference, support access and logging.
- Sub-processor transparency: can they produce the current list on request, without negotiation?
- Model training position, contractual rather than stated.
- Screening depth: does it evidence claims, or detect terms and summarise? Ask to see the source passage behind a score.
- Auditability: can you export a complete assessment record, including who decided what and why, without vendor assistance?
- Human-in-the-loop design: is the evidence presented before the score, and is a reason captured on confirmation as well as override?
- Workflow and collaboration, weighted honestly against what you would lose.
- Integration reality, tested rather than assumed from a documentation page.
- Total cost including implementation, migration and the internal time both consume.
Dimension four is where most platforms in this category are weakest, and dimension five is where the awkward silences happen. Ask both with a real CV in front of you.
Frequently Asked Questions
Is a US-based ATS Non-Compliant with UK Data Protection Law?
No. International transfers are lawful where adequacy applies or an appropriate safeguard plus transfer risk assessment is in place. The considerations for UK buyers are residual exposure to foreign legal regimes, supply chain transparency, and whether the arrangement satisfies the buyer's own policy, sector regulation or client contracts. That is a risk judgement, not a compliance verdict.
Can a Screening Layer Work Alongside an Existing Applicant Tracking System?
Yes, and for most teams that is the sensible route. The screening layer takes a bulk export of applications, assesses them against your criteria with evidence attached, and returns outcomes and records to the system of record. Pipeline management, scheduling and reporting stay where they are.
What Is the Most Commonly Overlooked Question in an ATS Security Review?
Where model inference runs for AI features, followed by whether error tracking and logging export personal data. Both move candidate data out of a nominally compliant primary region, and neither appears on most standard questionnaires, which were written for systems that stored data rather than transmitted it for processing.
Does AI-assisted CV Summarising Count as Screening?
It shortens reading time and does not validate anything. A summary of an unevidenced claim is still unevidenced, and a fluent one may be more persuasive than the original. Validation requires assessing the context, outcome and scale behind a claim, which is a different operation from condensing text.
How Long Does a Migration Realistically Take?
It depends on data volume, integration count and how much historical record must move, and the cost is dominated by internal time rather than licence fees. Because of that, supplementing is usually worth evaluating properly before replacement, since it delivers the screening improvement without the migration.
The Honest Position
If your applicant tracking system works and your problem is that shortlists keep disappointing, you have a screening problem and replacing the workflow will not fix it. If your problem is that a security review cannot get satisfactory answers about where candidate data is processed, that is structural and no amount of configuration resolves it.
CVSense is built as a UK-focused, evidence-based screening layer: it evaluates the substance behind claims rather than counting keywords, attaches the source passage to every assessment, records the human who confirmed each outcome, and operates on a zero-model-training position for customer candidate data. It works alongside an existing pipeline rather than requiring you to abandon one that works. If you are midway through a security review and need those answers in writing, that is a document request rather than a demo.
Sources
Information Commissioner's Office. International Transfers.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/
National Cyber Security Centre. Cloud Security Guidance.
https://www.ncsc.gov.uk/collection/cloud
Information Commissioner's Office. Guidance on AI and Data Protection.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/
Information Commissioner's Office. Data Protection Impact Assessments.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/
InsightCircle
