Restricting Recruiting Document Visibility (Sharing Settings)

The Recruiting Document object (CVs and other candidate attachments) must be set to Private so that documents are only visible to users who have access to the candidate they belong to.

Previously, Recruiting Document shipped with a Public Read/Write org-wide default, meaning any internal user could see every candidate's documents — including in global search results, where filenames often contain the candidate's name. flair now restricts Recruiting Document to the same visibility already used for candidates, but on existing orgs the sharing setting must be switched to Private manually. All customers should apply this change, regardless of whether you use entity-based visibility scopes. New orgs already have this setting applied.

How to Set Recruiting Document Sharing to Private

1. Click the gear icon ⚙️ in the top right, then click Setup.

2. In the Quick Find box on the left, type Sharing Settings and select it.

3. On the Sharing Settings page, click Edit next to Organization-Wide Defaults.

4. Find the Recruiting Document row and set Default Internal Access to Private. Do the same for Default External Access in the column next to it, then click Save at the top or bottom of the page.

ℹ️ Because you are restricting access (not widening it), Salesforce does not need to run a sharing recalculation — the change takes effect on save.

What Happens Next

Once Recruiting Document is set to Private, users with a recruiting permission set that grants View All or Modify All on the object (e.g. Flair Manager, Flair Recruiter) keep seeing all documents as before — this change only affects users without such broad access.

If your org additionally uses entity-based Visibility Scopes to restrict candidate visibility, flair's sharing engine extends any scope that already grants access to candidates to their recruiting documents too. Newly uploaded documents are shared automatically as soon as the setting is Private. Existing documents are shared on your next flair update — no further configuration is needed on your side.

Apply to existing documents immediately (optional)

To share existing documents right away instead of waiting for the next flair update — for example after a large candidate import:

1. Open the HR Admin app (App Launcher → search HR Admin).

2. Go to the Doctor tab and open Re-run migrations.

3. Under Migration, select flair.RecruitingDocSharingBackfillMigration and run it.

You'll see a Migration run successfully confirmation.

This step only affects existing documents; newly uploaded documents are always shared automatically and never need it. It has no effect until Recruiting Document's org-wide default is set to Private, so complete the steps above first.