20
Verified profiles
One normalized evidence model across the published directory.
Original directory research
RFP Software Benchmark 2026
Benchmark 20 verified RFP software tools across public pricing, trials, APIs, SCIM, SOC 2, ISO 27001, data residency, and questionnaire standards.
20 manually verified profiles208 checked sources166 official sourcesEvidence reviewed August 19, 2026
65%
Publish an entry price
13 products expose a current starting price.
90%
Publish SOC 2 evidence
18 profiles name a current SOC 2 certification or audit.
10
Confirm a public API
9 additional profiles remain publicly unconfirmed.
Commercial transparency
Public access remains uneven
These measures describe what a buyer can verify before contacting sales. They do not rank affordability or product quality.
Published starting price
A current entry figure tied to a plan or offer.
13 of 20 verified profiles
Quote-only model
No current dollar entry figure is published.
8 of 20 verified profiles
Free tier
A continuing free plan, not a time-limited pilot.
3 of 20 verified profiles
Public trial signal
Trial availability is public; terms may still be incomplete.
10 of 20 verified profiles
Enterprise evidence
Certifications are more visible than deployment controls
Certification, provisioning, API, and residency counts reflect explicit public evidence. Unconfirmed does not mean unsupported.
SOC 2
Any currently named SOC 2 audit or certification.
18 of 20 verified profiles
ISO 27001
Current ISO 27001 certification is named publicly.
9 of 20 verified profiles
SCIM
Automated user provisioning is explicitly confirmed.
7 of 20 verified profiles
Public API
A customer API or equivalent developer surface is confirmed.
10 of 20 verified profiles
Residency options
At least one hosting or data-residency region is named.
12 of 20 verified profiles
Evidence matrix
All 20 profiles at a glance
Open any product name for its full field history, pricing note, methodology, limitations, and checked source registry.
| Product | Public entry | Free access | API | SCIM | SOC 2 | ISO 27001 | Residency | Sources |
|---|---|---|---|---|---|---|---|---|
| $50/mo plus usage | Free tier | Not confirmed | Not confirmed | Confirmed | Confirmed | US, EU, AU | 9 | |
| Contact sales | Trial | Not confirmed | Not confirmed | Confirmed | Not confirmed | US | 13 | |
| Contact sales | No public free access | Public API | Not confirmed | Confirmed | Not confirmed | Not publicly confirmed | 13 | |
| $899/mo | No public free access | Public API | SCIM | Confirmed | Confirmed | US West (Oregon), EU Central (Frankfurt), Australia East (Sydney) | 9 | |
| Contact sales | No public free access | Public API | Not confirmed | Confirmed | Confirmed | Not publicly confirmed | 6 | |
| $9,600/yr | Free tier | Public API | SCIM | Confirmed | Not confirmed | US | 15 | |
| $89/user/mo | 7-day trial | Not confirmed | Not confirmed | Not confirmed | Not confirmed | US | 9 | |
| $36,000/year | Trial | Not confirmed | Not confirmed | Confirmed | Not confirmed | Not publicly confirmed | 10 | |
| $10,000/yr | No public free access | No public API | Not confirmed | Confirmed | Not confirmed | Not publicly confirmed | 8 | |
| Contact sales | No public free access | Public API | SCIM | Confirmed | Not confirmed | Not publicly confirmed | 8 | |
| Contact sales | No public free access | Public API | Not confirmed | Confirmed | Confirmed | Not publicly confirmed | 8 | |
| $0/mo | Free tier | Not confirmed | SCIM | Confirmed | Not confirmed | North America | 7 | |
| €600/mo | Trial | Public API | Not confirmed | Not confirmed | Confirmed | EU | 10 | |
| Contact sales | No public free access | Public API | SCIM | Confirmed | Confirmed | Not publicly confirmed | 12 | |
| $18,500/yr | No public free access | Public API | SCIM | Confirmed | Confirmed | US, EU | 13 | |
 Savix | $99/mo | 14-day trial | Not confirmed | Not confirmed | Confirmed | Not confirmed | United States (primary processing location) | 8 |
| €750/mo billed annually | Trial | Public API | Not confirmed | Confirmed | Confirmed | Customer-selected region with Enterprise Private Cloud | 8 | |
| $899/mo billed yearly | 14-day trial | Not confirmed | Not confirmed | Confirmed | Confirmed | India (Mumbai), United States (Virginia), Canada (Montreal / Central), European Union (Frankfurt), United Arab Emirates (Dubai), Australia (Sydney) | 12 | |
| Contact sales | Trial | Not confirmed | Not confirmed | Confirmed | Not confirmed | EU | 15 | |
| $30,000/yr | No public free access | Not confirmed | SCIM | Confirmed | Not confirmed | Not publicly confirmed | 15 |
Questionnaire evidence
Named standards are less common
Many vendors advertise security-questionnaire support without naming a standard. These counts include only formats explicitly recorded in the verified profile.
DDQ
Due-diligence questionnaire support is named.
12 of 20 verified profiles
SIG
Standardized Information Gathering is named.
6 of 20 verified profiles
CAIQ
Consensus Assessments Initiative Questionnaire is named.
5 of 20 verified profiles
What the 2026 Benchmark Suggests
Security assurance has become table stakes: 18 of 20 published profiles name SOC 2 evidence. Operational transparency is less consistent. Only 7 profiles publicly confirm SCIM and 12 name a hosting or residency region, leaving buyers to resolve important deployment questions during procurement.
Commercial models remain difficult to compare even when a starting price is public. A per-seat plan, project allowance, answer-usage model, and flat annual package measure different constraints. Use the verified pricing matrix to normalize the quote and the comparison hub for pair-specific trade-offs.
API and questionnaire claims also need precise language. A browser extension, MCP server, and general REST API are not interchangeable. Generic custom-questionnaire support does not prove SIG or CAIQ coverage. The benchmark preserves those distinctions so an unknown field becomes a concrete demo question instead of an invented negative score.
Methodology and reuse
Explore the RFP software guideBuilt from 208 checked source records
The benchmark uses the same manually reviewed records as the public product profiles. Vendors cannot pay for inclusion or placement. Cite RFP AI Hub and link to this page when reusing the aggregated figures; verify the live profile before relying on a vendor fact in procurement.
FAQ
RFP software benchmark questions
How was the RFP software benchmark created?
The benchmark aggregates normalized fields from every published RFP AI Hub product profile. Each profile is manually checked against a registered set of first-party and relevant third-party sources. The benchmark counts only explicit public evidence and does not infer missing capabilities.
Does an unconfirmed field mean a product lacks the capability?
No. Not confirmed means the current public evidence set does not establish the capability. It is different from a verified false value and should become a procurement or demo question rather than a negative product score.
What counts as published RFP software pricing?
A public starting price must be visible in current evidence and tied to a real plan or entry offer. Old directory estimates and unverified review-site numbers are not treated as current vendor pricing. Published entry prices still need normalization for users, projects, AI usage, modules, implementation, support, and renewal terms.
How often is the benchmark updated?
The benchmark changes when a published profile passes manual review or a material product fact changes. Its modification date is derived from the underlying evidence records rather than refreshed automatically on every site build.