Configuring Other Career Site Elements

The data protection and privacy features include the ability to report on the personal data available within SAP SuccessFactors Recruiting, and any changes that have been made to subject data. Customers can also set the timeframe to systematically purge from inactive Talent Community members. If desired, a Content Security Policy can be enabled to prevent cross-site scripting attacks.

Remember that the Data Privacy Consent Statement is configured in Admin Center for customers using SAP SuccessFactors Recruiting.

It is the customer’s responsibility to adopt the features that they deem appropriate. More information can be found on the SAP Help Portal.

Use the settings from Settings→Data Privacy & Security Settings→Data Protection to control user data for Career Site Builder (CSB). This page is used for both CSB and non-CSB sites. For CSB customers, do not enable the Data Privacy Consent Statement here.

The setting Allow Manual Public User Creation allows customers to control how users can be added if there are concerns over data privacy and workflows for obtaining consent. Selecting OFF prevents the ability to manually add Talent Community members via the Talent Community Member API. In this case, Talent Community members can only be added through the public site workflows.

The Data Retention Management (DRM) configuration allows the customer to set the timeframe to systematically purge inactive candidates (Talent Community members) and Client Admins (Recruiting users who were added manually).

The CSB DRM setting only purges users who are not connected to an account in SAP SuccessFactors Recruiting. Users may be connected through the front-end workflows for Candidate Account Simplification.

Connected users will be purged from CSB when they are purged from the ATS via DRM settings and updates to the Recruiter Sync file (when the recruiter is no longer included).

Use the sliders to set the activity threshold in days for anonymization of candidate and client admin data.

Once the threshold is set, user data is anonymized if there hasn't been any user activity in the specified number of days.

Career Site Builder gives customers the ability to enable a Content Security Policy, an HTTP header that automatically disallows external domains and only allows the browser to render resources from the customer's domain.

To enable the Content Security Policy, proceed as follows:

• HTTP headers with a Content Security Policy are used in career site pages owned by the organization (such as jobs.company.com), but not in the candidate profile and other pages generated within SAP SuccessFactors Recruiting.
• Enabling the Content Security Policy prevents cross-site scripting attacks by automatically disallowing all external domains.
• We only recommend enabling the Content Security Policy for customers who have specific security needs, such as finance companies.
• If enabled, you can specify domains to include on an allowlist, which lets them be referenced in any custom scripts that are used on the career site. Add domains to the Allowed Domains list to avoid blocking any third-party JavaScript your career site uses.
• A default allowlist exists for all standard features that are part of Career Site Builder, so nothing will be broken in a standard CSB site. The default allowlist includes trusted domains that are most commonly used in public career sites built by Career Site Builder. Use the links provided on the page to view sites included on the default allowlist.
• Test thoroughly in the stage instance to ensure that any integrations don’t break.

Data Subject Reports

Generate Information Reports and Change Reports for both Talent Community members and Client Administrators from Settings→Data Privacy & Security Settings→Data Subject Reports. This page is used for both CSB and non-CSB sites.

Permission to generate Data Subject Reports is set under CSB and then Users→Roles.

The Functions Viewer in Career Site Builder lets you see existing functions that may be in your implementation.

Functions transform strings in SAP SuccessFactors Recruiting job posting data before they're forwarded to your career site. By transforming strings, functions address things such as misconfigurations or style changes.

Other considerations of the Functions Viewer include:

• You can access the Functions Viewer in the Career Site Builder by selecting Tools→Functions.
• If the Functions Viewer page is blank, this means that your implementation partner didn't create any functions for your career site in the legacy Command Center.
• If functions are listed on this page, the only action that can be taken is to delete any functions that are no longer needed. This allows you to refine your posting content in the system of record (SAP SuccessFactors Recruiting), so that consistent job posting content is available for all downstream publication processes, Career Site Builder, and Recruiting Posting.
• New functions cannot be created.
• If Career Site Builder's role-based permissions are enabled, set the Functions Viewer permission for any CSB users who should have access in the Career Site Builder from Users→Roles.

• SAP SuccessFactors Recruiting provides robust data protection and privacy features, including configurable data retention, anonymization thresholds, and the ability to generate data subject reports for both Talent Community members and Client Administrators.
• Career Site Builder allows customers to enable a Content Security Policy to enhance security by restricting external domains, with options to maintain a list for necessary integrations and thorough testing recommended before deployment.
• The Functions Viewer in Career Site Builder lets users review and delete legacy string transformation functions for job postings, ensuring consistent content across systems, though new functions cannot be created.