Who Can See the Job Applications on Your Website?
Adding a careers page is one of the most useful things a small business website can do. It also means the website is now holding people's names, phone numbers, work history and resumes. That deserves some care.
September 11, 2026
The site is holding personal information
Job applications, quote requests and reservation details all contain information people trusted the business with. Once it's in the website's admin, the business is responsible for who can see it.
Give people only what they need
Not everyone with an admin login needs to see everything. Someone who updates the menu doesn't need to read applications. Someone who handles reservations doesn't need to manage accounts. Separate roles keep sensitive information with the people who actually use it.
Check that limits really hold
Hiding a button is not the same as blocking access. A permission has to be enforced on the server, where the data lives, not just in what the screen shows. This is an easy mistake to make and an easy one to test for: sign in with a limited account and try to reach what it shouldn't.
Clean up old accounts
When someone leaves, their access should end immediately and completely. An account that is deleted but still has a working login session is not really closed.
Keep less
Applications and requests don't need to be kept forever. Deciding how long to keep them, and clearing out the old ones, reduces what could ever be exposed.
Review it once in a while
A quick look at who has admin access, and what each account can do, is worth doing a couple of times a year. Businesses change. Access lists should change with them.