RFP and DDQ software benchmark (2026)

Methodology

The benchmark covers every vendor published in this directory on the build date (70 vendors in this edition). Each vendor has a typed record and, for most, a facts file in which every claim carries its source URL and the month it was read. The pages, the CSV and the JSON are all generated from those files in the same build, so they cannot disagree.

Source records

A source record is one fact that carries its own attribution: a sourced facts entry, a security or collaboration fact, a subprocessor entry or a dated review-site rating. This edition counts 2,904 of them, pointing at 562 distinct URLs on 142 domains. Records were checked between July 2026 and October 2026.

How each field is read

• Public entry price: the record's starting price is an amount (including $0). "Custom" and this directory's own estimates count as quote only. The unit comes from the price string: per user per month, flat monthly, annual, or free tier.
• SOC 2 and ISO 27001: listed on the record's security facts or certifications. Anything else counts as not stated.
• Free trial, SSO, API, named formats and deployment: read from the record's own sourced text (pricing notes, features, limitations and facts) with fixed rules. A sentence that names the feature counts as yes. A sentence that negates it before the term ("no free trial", "lacks a public API") or rules it out after ("may not fit", "still in progress") counts as no. Plan gating ("SSO starts on Growth") counts as yes, flagged as plan-gated. Silence counts as not stated.
• Free trial: the trial has to be described as free or card-free. Paid pilots and trials of a vendor's unrelated products do not count.
• AI drafting with source citations: both AI drafting and source attribution rated capable or core in the directory's capability model.
• Integrations: distinct products named on the record and in its facts file, with spelling variants merged ("Microsoft SharePoint" and "SharePoint" count once). Entries that describe a delivery mode or an AI model supplier are not counted.

What this benchmark does not prove

• Not stated is not no. A vendor may hold SOC 2, offer SSO or ship an API that its public pages and this record do not mention. Shares of "yes" are a floor on public documentation, not a count of features.
• It is not the whole market. It covers the vendors published in this directory, which lean toward RFP, DDQ, security questionnaire and sales-proposal software. 70 vendors is a useful sample, not a census.
• It does not test quality. A listed certification does not make an answer correct, and a source link does not prove the passage supports the claim. The AI fields are editorial ratings of documented capability, not accuracy tests.
• Entry prices are not total cost. Seat minimums, annual terms, send caps, add-ons and services can multiply the first number.
• Counts of integrations are counts of names. A long list does not mean deep integrations, and a short one may reflect what the research captured rather than what exists.
• It is a snapshot. Pricing and packaging change often. Check the date on each vendor's row and confirm with the vendor before you buy.

How to cite and reuse

Reuse the charts, numbers or dataset under CC BY 4.0. Credit "RFP and DDQ software benchmark (2026)" and link this page. Corrections to any vendor row go through the contact page; a corrected record changes the benchmark on the next build.

Want a shortlist from the same data? The shortlist builder scores these vendors against your answers and shows the reasons.