What he meant is that you are putting the private data of the applicants on the internet, on the servers of another company. I too find this highly dubious.
That's how every candidate tracking system works. Paid or otherwise.
Not everything has to be a web application, and not all web applications have to be hosted by a third party.