Backups & data

Where Vakanssi keeps your hiring data, what a complete backup has to include, and exactly what happens when you deactivate or uninstall the plugin.

Your hiring data (applications, candidates, CVs, interviews, notes) lives on your own server, not in someone else’s cloud. That is the point of a self-hosted hiring tool, but it also means backing it up is your job. This page explains where everything is stored, what to include in a backup, and what the “Delete all data on uninstall” option really does.

Where Vakanssi stores data

In your WordPress database, in its own tables. Alongside the tables that hold your posts and pages, Vakanssi creates its own set of tables. Their names start with vakanssi_ after your site’s usual table prefix, so on a typical site they read wp_vakanssi_applications, wp_vakanssi_candidates, and so on.

Applications, candidates, hiring stages, interviews, notes, and the activity log all live there. The free plugin creates 10 tables; Pro Pro feature, requires a Vakanssi Pro license adds four more, for scorecards, candidate tags, the webhook delivery log, and live presence. The table-by-table layout is documented in the database reference.

In WordPress options. Everything you configure on the Settings and Tools screens, such as email templates, feature toggles, and webhook endpoints, is stored as WordPress options in the same database. Job posts themselves are ordinary WordPress posts.

Uploaded CVs, in a protected private folder. CV files are not kept in the regular media library, where anyone with the link could download them.

Since v0.37.10, Vakanssi stores CVs in a vakanssi folder inside wp-content/uploads/, guarded by a deny rule, index files, and an HTTP check that confirms the folder cannot be fetched directly. WordPress.org does not allow a plugin to write files outside the WordPress install, so this is the folder every site uses unless you move it yourself.

On multisite, each site gets its own subfolder (site-<id>), so a Data Reset or an uninstall purge on one site can never remove another site’s CVs.

Recruiters always download a CV through a permission-checked link, never a direct file address.

You can check the storage at a glance: Hiring, then Tools, then the Status tab. The Protected storage tile shows whether the folder is protected, and the support report on the same tab has a “Stored outside web root” line that answers yes or no (no for the default folder).

Neither shows the folder’s full path; if you set your own with the VAKANSSI_STORAGE_DIR constant in wp-config.php, that is where your CVs are, and it can point outside the web root.

What a complete backup includes

Two things cover everything:

1. The database. Any backup that dumps the full WordPress database includes all Vakanssi tables and settings. You do not need to select them individually.
2. Your uploads/vakanssi folder. This holds the actual CV files.

Most WordPress backup plugins capture the database plus the site’s uploads, so both are usually covered. If you moved storage outside the web root with the VAKANSSI_STORAGE_DIR constant, a backup tool that only copies the WordPress folder will miss it, so check that your backup covers the custom path too.

Find your CV folder (see Where Vakanssi stores data above for exactly where it sits and how it is named) and confirm your backup includes it.

Deleting all applicant data

Separate from uninstalling the plugin, you can also wipe just your hiring data while keeping Vakanssi, your settings, and your job postings in place. It lives on Hiring, then Tools, then the Data tab, in the Danger zone card.

It deletes every application, candidate, CV file, note, interview, and email log entry (plus scorecards, tags, and the webhook delivery log on Pro), clears the activity log, and resets your pipeline back to the default stages. Job postings and every setting are kept. To run it, type DELETE into the confirmation field and click Reset data.

This is an all-or-nothing operation for the database: if a database error interrupts the wipe partway through, the whole thing rolls back and nothing is deleted, and the Data tab tells you to try again.

The CV files on disk are a separate step and can fail on their own, either because a file cannot be removed (usually a filesystem permissions problem) or because the storage folder itself fails a safety check before the wipe can even start (an unsafe path, a symlink, or a folder your site does not own).

Either way Vakanssi reports a partial result rather than claiming a clean wipe that did not fully happen. See Troubleshooting if either notice shows up.

Deactivating vs uninstalling

WordPress has two levels of “removing” a plugin, and they behave very differently.

The checkbox lives at Hiring, then Settings, then General, under Data & privacy: “Delete all data on uninstall”. It is off by default, so removing the plugin never silently deletes hiring records. See the Settings reference.

Uninstalling never deletes your job posts or your departments and locations: they are ordinary WordPress content and stay in place either way. With the purge on, though, a job post loses its Vakanssi job fields, so it stays published with its title and description only, and a location loses its stored country code.

The one page the purge touches is the careers page the setup wizard created for you, which goes to the Trash rather than being deleted. A careers page you picked from your own pages is left alone. And since disabling a feature is not the same as uninstalling, turning modules off on the Features tab never deletes anything at all.

On a WordPress network (multisite), each site decides for itself: deleting the plugin applies each site’s own Delete all data on uninstall choice to that site’s data only.