A recruitment agency lives in its inbox. Candidate CVs, client briefs, interview confirmations and offer negotiations all travel by email, and the quality of your google workspace setup for recruitment agencies decides whether that traffic is organised, secure and deliverable, or a tangle of personal accounts and forwarded attachments. This guide walks through the decisions that matter for staffing firms: shared mailboxes, candidate-data access, Drive permissions per client, outreach authentication, migration, and recruiter onboarding and offboarding.
Nothing here replaces an assessment of your own firm. Use it as a framework, then ask any provider for an itemised quote. If you would like help, our Google Workspace setup service covers the build described below.
Why recruitment agencies need a different setup
A generic office tenant is configured for employees who stay for years and share little. A staffing agency is the opposite, and that changes almost every default.
- High recruiter turnover: people join, move teams and leave often, taking relationships and candidate data with them if access is not controlled.
- Shared inboxes: addresses such as jobs@ or cvs@ must be worked by several recruiters without anyone sending from the wrong identity.
- Personal data at scale: CVs contain contact details, work history and sometimes sensitive information, so you carry real data-protection duties.
- Client confidentiality: one client must never see another client's shortlist, rates or hiring plans.
- Outbound dependence: business development and candidate outreach rely on mail actually reaching the inbox.
Shared recruiter mailboxes and candidate-data access
Most agencies start with a handful of personal mailboxes and a shared password for the jobs address. That is the first thing to fix.
Use Groups and collaborative inboxes, not shared logins
Google Groups can act as a collaborative inbox, so a message to the jobs address can be assigned, tracked and marked resolved by whoever picks it up. Every action is tied to a named person, and nobody needs the shared password. Create one group per function, for example applications, accounts and each client desk, and set who may post, who may view and who may manage.
Separate teams with organisational units
Group recruiters into organisational units that match how you work, such as sector desks, business development and back office. Apply different policies to each. A back-office finance user may need access to payroll folders that a resident recruiter should never see.
Treat candidate data as a controlled asset
The applicant tracking system should remain your system of record, with email and Drive holding supporting material. Limit who can export or bulk-download CVs, restrict external sharing of candidate folders, and use data-loss-prevention rules where your edition supports them to flag documents containing personal identifiers sent outside the domain. Define how long you keep unsuccessful candidate files and set retention rules to match your own policy and local law.
Drive permissions per client
Shared drives are the right container for client work because ownership belongs to the team, not the individual who created the folder. When a recruiter leaves, the files stay.
- One shared drive per client or per desk: keep shortlists, contracts, rate cards and interview notes together.
- Role-based access: use manager, contributor and viewer roles by group, not by individual, so adding a recruiter is a single group change.
- Block uncontrolled sharing: restrict sharing outside the organisation by default, and allow named exceptions for specific clients or partner agencies.
- Client-facing folders: if a client needs to see submissions, give them a dedicated folder with view-only access instead of emailing attachments around.
- Naming and structure: agree a standard layout, for example client, role, then candidate, so anyone can find a file and auditors can follow it.
This structure makes the question "who can see this client's data?" answerable in a minute rather than an afternoon. It is also much easier to explain to a client during a security questionnaire. If you want the folder model designed for you, see our Google Workspace setup for business page.
SPF, DKIM and DMARC for outreach deliverability
Recruiters send a lot of cold and semi-warm email, so authentication matters more here than in most industries. Receiving servers check three records to decide whether your message is genuine.
- SPF lists the servers allowed to send for your domain. Include Google and any other platform that sends on your behalf, such as a CRM or bulk-mail tool, and keep the record within the lookup limit.
- DKIM signs outgoing messages with a key published in DNS. Turn it on in the admin console for every sending domain.
- DMARC tells receivers what to do when SPF or DKIM fails and sends you reports. Start with a monitoring policy, read the reports to find forgotten senders, then tighten gradually.
Good authentication does not guarantee inbox placement, because content, sending behaviour and list quality also count. But without it, even well-written messages are far more likely to be filtered. Many agencies also protect their main domain by sending bulk outreach from a separate, authenticated sibling domain, so a campaign problem cannot damage day-to-day client email. Review each domain's records whenever you add a new tool that sends mail.
Migrating from existing email
Agencies often arrive from another host, a legacy Exchange server, or a mix of personal accounts. A careful migration protects the thing you cannot afford to lose, which is conversation history with candidates and clients.
- Inventory: list every mailbox, shared address, alias, calendar and distribution list, including the forgotten ones.
- Plan the cutover: choose a window with the lowest candidate activity, and lower DNS time-to-live values in advance.
- Migrate in batches: move mail, contacts and calendars for pilot users first, then the rest.
- Switch mail routing: update MX records and publish the SPF, DKIM and DMARC records at the same time.
- Verify and support: check mail flow, resolve client and device issues, and keep the old system available briefly as a safety net.
If you currently run Outlook on desktops, plan for that too. Recruiters can often keep using a familiar client while the mail lives in Workspace, but profiles need to be reconfigured, and that is better done by a scripted rollout than person by person.
Onboarding and offboarding recruiters
Because turnover is part of the business model, joining and leaving should be routine procedures, not emergencies.
Onboarding
Create the user in the right organisational unit, add them to the correct groups, and they inherit the shared-drive access, mailbox permissions and security policies for their desk. A written checklist ensures new starters never receive more access than they need on day one.
Offboarding
Suspend sign-in at the agreed time, reset the password, sign the user out of all devices and revoke app tokens. Transfer ownership of any personal files to a manager, forward or delegate the mailbox for a defined period, and remove the person from every group. Because client files live in shared drives, the work stays put. This is also where agencies protect themselves against the risk of a departing recruiter exporting a candidate database on the way out.
2FA and data-sharing controls
- Enforce two-step verification for every user, and prefer security keys or passkeys for administrators and finance staff.
- Limit third-party apps: candidate-sourcing extensions and add-ons can read mail and files, so allow only approved apps.
- Manage mobile devices: require screen locks and the ability to wipe work data from a lost phone.
- Audit regularly: review admin roles, external sharing reports and login alerts on a schedule.
- Prepare for incidents: know who can suspend an account quickly and how you would notify clients.
Setup options and criteria compared
Not every agency needs the same depth. The table below compares common approaches so you can match effort to your size and risk.
| Option | Best suited to | Strengths | Limitations |
|---|---|---|---|
| Default self-setup | Very small teams with few clients | Lowest upfront effort and cost | Weak sharing controls, shared logins, and authentication often missing |
| Guided setup with a partner | Growing agencies of several desks | Groups, shared drives, DNS authentication and policies built once and documented | Needs a clear brief and a defined scope and quote |
| Full migration plus hardening | Agencies leaving another platform or handling sensitive data | History preserved, security baseline and offboarding procedure included | Longer project, with careful scheduling around candidate activity |
| Ongoing managed administration | Firms without in-house IT | Routine user changes, audits and support handled for you | Recurring cost, so agree response expectations in writing |
Costs depend on user count, edition, volume of mail to migrate and how much policy design you need. Ask for an itemised quote that separates licences, migration effort, configuration and support, so you can compare providers fairly.
Questions to ask any setup provider
- How will you preserve candidate and client email history during migration?
- Who owns the admin accounts and DNS records when the project ends?
- How do you structure shared drives so one client never sees another's files?
- Will you document the onboarding and offboarding procedure for our team?
- What support is available after go-live?
Why Companies Choose CloudHouse for Google Workspace Setup
Agencies work with CloudHouse because we plan delivery in clear stages, remain available for support after launch and give transparent, itemised quotes so you can see what each part costs. We hand over documentation and keep admin ownership with you. You can read more about the approach on our Google and Outlook setup service page.
Conclusion
A recruitment agency's email and files are its working capital. Shared mailboxes with named accountability, client-specific shared drives, authenticated outreach domains, a careful migration and repeatable onboarding and offboarding turn a fragile setup into one that survives staff turnover and client scrutiny. Add enforced two-step verification and sensible sharing limits, and you have a defensible baseline. To discuss your agency and receive an itemised proposal, visit our Google Workspace setup page and request a quote.
