baselineRFIWhat encryption model is used for files at rest and in transit — is it true end-to-end encryption where the vendor cannot access plaintext, or does the vendor hold decryption keys — and can customers bring or host their own encryption keys (BYOK/HYOK)?weight 3
Answer key — what a strong answer shows
BYOK/HYOK or genuine end-to-end encryption is a materially stronger security posture than vendor-held keys with no customer control over decryption.
baselineRFPDetail granular access-control capability — per-file/per-folder permissions, time-limited or expiring links, watermarking, and view-only/download restrictions — and whether these controls persist if a file is forwarded outside the platform.weight 3
Answer key — what a strong answer shows
Controls that survive forwarding (e.g., revocable links, DRM-style protection) are materially stronger than permissions that only apply inside the platform's own interface.
baselineRFIHow does the platform prevent an external recipient from re-sharing or exfiltrating a received file — screenshot/print/copy prevention, IRM/DRM — and what audit trail exists for external-party access specifically?weight 3
Answer key — what a strong answer shows
Look for explicit IRM/DRM enforcement and a real external-access audit trail, not just logging of the sending organization's own internal users.
baselineRFPExplain data residency and sovereignty options — can storage be pinned to a specific geographic region, and what happens to those residency guarantees when a file is shared with an external recipient in a different jurisdiction?weight 3
Answer key — what a strong answer shows
Strong answers explicitly address the cross-border sharing edge case, not just at-rest residency for internally-stored files.
baselineRFIWhat DLP scanning is applied to files before or during sharing (sensitive-data classification, malware scanning), and can a share be automatically blocked or routed to an approval workflow when sensitive content is detected?weight 3
Answer key — what a strong answer shows
Pre-share enforcement (block or require approval) is materially stronger than post-hoc detection or alerting after a sensitive file has already left the organization.
baselineRFIHow are sharing permissions revoked when an employee leaves or a project ends — is revocation immediate and comprehensive across every previously shared link or copy, or does it require manual cleanup per file?weight 3
Answer key — what a strong answer shows
Automated, comprehensive revocation across all previously distributed links is materially stronger than a manual, error-prone per-file cleanup process.
baselineRFPDescribe integration with existing productivity suites (Microsoft 365, Google Workspace) — is this a native replacement, an overlay/wrapper, or a separate silo requiring users to leave their normal workflow — and quantify real user adoption with a customer reference.weight 3
Answer key — what a strong answer shows
A real, named-customer adoption figure matters — a security tool with low actual adoption doesn't reduce risk no matter how capable it is on paper.
baselineRFIWhat compliance certifications are held (SOC 2, ISO 27001) and how deep is audit logging — are file access/share/download events logged immutably, and can logs be exported to the customer's own SIEM in near-real time?weight 3
Answer key — what a strong answer shows
Immutable, near-real-time, exportable logs are materially stronger than logs only viewable inside the vendor's own console with meaningful export lag.
baselineRFIWhat is the pricing model — per user, per GB stored/transferred, or a flat enterprise tier — and what egress or large-file-transfer fees apply beyond the base subscription?weight 3
Answer key — what a strong answer shows
Look for transparent, predictable pricing with explicit disclosure of any per-GB or large-transfer fees — hidden egress costs are a common pricing trap in file-sharing/storage products.
baselineRFPDescribe incident-forensics capability for a confirmed leaked or mis-shared sensitive file — can the platform quickly reconstruct exactly who accessed the file, when, and from where, with a concrete turnaround-time example from a customer reference?weight 3
Answer key — what a strong answer shows
Strong answers describe a fast, specific forensic reconstruction capability with a real turnaround-time figure — this is the highest-stakes use case (a confirmed leak), not just preventive access control.
baselineRFIWhat is the performance and reliability characteristic for large-file or high-volume transfers (e.g., multi-gigabyte files, thousands of files in one share) versus the platform's handling of typical small document sharing?weight 3
Answer key — what a strong answer shows
Large-file/high-volume transfer is a distinct performance challenge from typical small-document sharing — ask for specific measured figures at realistic large-file scale, not just small-file benchmarks.
baselineRFPWhat friction does an external, non-customer recipient face to access a shared file — is an account/app installation required, or can they access securely via a simple browser link — and how does that friction affect measured external-recipient completion rates?weight 3
Answer key — what a strong answer shows
High friction for external recipients (mandatory account creation, app install) reduces real-world adoption — ask for a measured completion-rate figure from a customer reference, not just a feature description.
baselineRFIWhat is mobile coverage for both the sharing and receiving experience — can a sender share and a recipient securely access files from native iOS/Android apps with full feature parity to desktop, or is mobile a degraded experience?weight 3
Answer key — what a strong answer shows
Ask for an honest mobile-versus-desktop feature-parity comparison; a degraded mobile experience is a common real gap that should be disclosed rather than assumed away.
baselineRFPHow does the platform integrate with (versus duplicate) the customer's existing DLP/CASB stack — does sharing policy enforcement rely on the platform's own native DLP, or does it defer to/integrate with the customer's already-deployed DLP tooling?weight 3
Answer key — what a strong answer shows
Look for a clear answer on this integration boundary; redundant, disconnected DLP enforcement between the file-sharing platform and the customer's broader DLP stack creates real policy-management complexity.
baselineRFIWhat API/developer integration exists for embedding secure file sharing into custom internal workflows or customer-facing applications, beyond the standalone sharing UI?weight 3
Answer key — what a strong answer shows
A real, documented API is materially more useful for a team wanting to build secure sharing into their own applications than being limited to the standalone product UI.
baselineRFIHow does the platform protect previously-shared files from a ransomware event affecting the sharer's own environment — is there version history/immutable backup allowing recovery of shared files independent of the source environment being compromised?weight 3
Answer key — what a strong answer shows
A ransomware event in the sharer's environment could otherwise propagate to or destroy shared files — ask for a specific answer on version history/immutability that provides real ransomware resilience for shared content.
baselineRFPHow do we send our data to you? What methods do you use to transfer data from one place to another?weight 3
baselineRFPDo you use any 3rd party repository for file transfer, file storage or file sharing? (e.g., Dropbox, Office 365, Google Drive)weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
