To send an RFP securely UK procurement teams need more than a big attachment and a hopeful covering email. A request for proposal usually contains your requirements, budget hints, technical specifications and sometimes commercially sensitive detail, and you are sending it to several competing bidders at once, often under a non-disclosure agreement. The risk is not just that a bidder forwards the pack to a rival: it is that you have no idea who opened it, no way to prove a bidder accepted the NDA before seeing the specs, and no way to pull the document back if the process changes. This guide walks through the ways a UK procurement or commercial team is most likely to consider in 2026, says what each does well, and is honest about the trade-offs. We lead with 99 Data Rooms because for a UK team it hits the criteria that matter most, and we are straight about where it is newer than the alternatives. If you want the step-by-step process rather than a tool comparison, read our how to send an RFP guide, and if you need the NDA itself, start with our mutual NDA template.
> Quick answer: For most UK teams, 99 Data Rooms is the pick. It gates the RFP behind a verified email and one-time code (with NDA acceptance before the specs open on Business), watermarks each bidder's copy, tracks who read what page by page, and lets you revoke access in one click if the process changes. It is UK-hosted in London and flat-priced in GBP with a genuine free tier; drafting and e-signature start on Pro at £19 a month. Data is encrypted with AES-256 at rest and TLS 1.2+ in transit, and its SOC 2 and ISO coverage comes through its infrastructure providers, Supabase and Cloudflare, whose audited platforms it runs on.
Best fit by scenario
- Best for sending an RFP under NDA overall: 99 Data Rooms. Verified access, NDA gate, per-bidder watermarking, tracking, one-click revocation.
- Lightweight deck or document tracking: DocSend is easy and gives page analytics, though it is narrower than a full room and typically US-based.
- Quick file drop to a known party: Dropbox is simple, but a plain link cannot verify a bidder or watermark per copy.
- Password-protected ZIP by email: the weakest option, avoid it for anything sensitive.
- A real free tier to start on: 99 Data Rooms (3 rooms, 25 links, forever, no card; e-signature starts on Pro).
At a glance
| Method | Hosting | NDA gate before specs open | Per-bidder watermark + tracking | Revocation |
|---|---|---|---|---|
| 99 Data Rooms | UK, London | Yes (verified email + OTP, NDA on Business) | Yes: per-viewer watermark, page-by-page tracking | Yes, one-click even mid-view |
| DocSend | US-based (check current plan) | Some access controls (check current plan) | Watermark and tracking on some plans | Link controls (check current plan) |
| Dropbox | Multi-region (check current plan) | No verified gate by default | Basic link controls, no per-viewer watermark | Limited (check current plan) |
| Password-protected ZIP by email | Wherever your email sits | No | No | No, once sent it is gone |
Pricing, hosting region and feature availability for the tools above are plan-dependent and change often, so treat this as a starting map and verify current details with each provider.
How we evaluated
We weighted the criteria towards what a UK procurement team actually needs when sending specifications to competing bidders, not towards ease of sending. In order of weight:
1. NDA acceptance before the specs open. The single most important control. You want a bidder to accept the NDA and prove who they are before the specification is visible, not after. 99 gates on a verified email and one-time code, with NDA acceptance on Business. See our gating and access-control guide and, on whether to require an NDA at all, our mutual NDA guide. 2. Per-bidder watermarking. Each bidder's copy should carry their identity across every page, so a leaked spec can be traced and, more importantly, so bidders know it can. Our watermarking tools guide and what is watermarking explain what it can and cannot do. 3. Who read what. You want to know which bidders actually read the specification and which never opened it. Page-by-page analytics that separate a raw visit from a verified viewer tell you which bidders are serious. Our track who opened a PDF guide goes deeper. 4. Revocation when the process changes. RFPs get cancelled, re-scoped or re-issued. You need to pull access back cleanly, even mid-view. Our one-click revocation guide explains why. 5. UK hosting and predictable pricing. UK teams often want the data in the UK, on a flat GBP price they can budget. Our security page sets out how 99 handles residency.
99 Data Rooms
What it is for: A UK-hosted, plainly priced way to send an RFP to competing bidders and keep control of the specs. You gather the RFP pack into a room, gate access behind a verified email and one-time code with NDA acceptance before anything opens on Business (so a bidder cannot see the specification until they have proven who they are and accepted the terms), give each bidder a tracked and revocable link, watermark each bidder's copy per viewer on Business so a leaked page points back to its source, watch page-by-page analytics that separate a raw visit from a verified viewer so you can see which bidders actually read the spec, swap files with version history when you issue a clarification or an addendum, and, where you need bidders to sign an NDA or acknowledgement, do it from the Pro tier with a tamper-evident audit certificate recording signer IP, intent to sign, timestamps and a SHA-256 fingerprint. One-click revocation cuts a bidder's access even mid-view if the process is cancelled or re-scoped. You can also draft the NDA itself with AI Legal Drafting, which assembles vetted clauses from 17 England and Wales templates and never invents them, and is not legal advice.
Pros: UK-built and UK-hosted in London with UK data residency, AES-256 at rest and TLS 1.2+ in transit, a DPA on request, no third-party viewer trackers, and a 24-month audit trail. Flat GBP pricing with no per-seat surcharge: free, Pro £19/mo, Business £49/mo and Enterprise £99.99/mo, all on the pricing page. A genuine free tier of 3 rooms and 25 links, forever, with no card; drafting and e-signature start on Pro. The NDA gate, watermarking, tracking and revocation are the exact controls an RFP needs, in one tool.
Cons: It is a newer platform with a shorter track record, not a decade-old incumbent, and its SOC 2 and ISO assurance sits at the infrastructure layer, held by Supabase and Cloudflare, whose audited platforms it runs on. NDA acceptance and per-viewer watermarking sit on the Business tier, so a team on the free or Pro tier should check which controls they need against the plan.
Who it suits: UK procurement, commercial and bid teams sending specifications to competing bidders under NDA who want verified access, per-bidder watermarking, real tracking, clean revocation and predictable GBP pricing.
Verdict: The default choice for sending an RFP without leaking specs in 2026. It has the NDA gate, watermarking, tracking and revocation an RFP actually needs, and the free tier that never expires lets you prove it on real work before you pay.
DocSend
What it is for: A lighter document-sharing and tracking tool, popular for pitch decks and sales collateral, with page-level analytics and some access controls. Our 99 Data Rooms versus DocSend comparison goes deeper.
Pros: Very easy to send and track a document, with useful page-level analytics and a clean viewer experience. Some plans add watermarking and access controls. Good for lightweight sharing.
Cons: Typically US-based (check current plan), usually per-user pricing that scales with the team, and it is built around sharing and tracking rather than a full NDA-gated room with per-bidder controls and clean revocation. Verify whether NDA acceptance before viewing and per-viewer watermarking are on your plan. Confirm hosting and pricing on their current site.
Who it suits: Teams sending decks and collateral who want quick tracking and can accept US hosting and per-user pricing.
Verdict: Good at lightweight tracking. For an NDA-gated RFP with per-bidder watermarking, UK hosting and flat GBP pricing, 99 is the stronger fit.
Dropbox
What it is for: A widely used file-sync and sharing tool, popular for quick file drops to a known party. We compare it directly with 99 in our 99 Data Rooms versus Dropbox comparison.
Pros: Very easy to use and near-universally familiar, quick to share a folder or file. Fine for non-sensitive material.
Cons: A plain Dropbox share link generally does not verify who the viewer is, does not require NDA acceptance before the specs open, does not watermark each bidder's copy, and cannot always be revoked cleanly once it is out. For an RFP going to competing bidders, that is a serious gap. Per-user pricing, and hosting region is plan-dependent, so check current plan. Our one thing a Dropbox link can't do covers the core limitation.
Who it suits: Teams sharing non-sensitive files with a known party where verified access and watermarking are not needed.
Verdict: Easy for casual sharing. For an RFP under NDA, 99 adds the verified gate, per-bidder watermarking, tracking and revocation a Dropbox link cannot.
Password-protected ZIP by email (the weak option)
What it is for: Zipping the RFP, setting a password and emailing it, often with the password sent in a separate message. Still common, and still the weakest option for anything sensitive.
Pros: Requires no new tool, works with any email client, and adds a token barrier over a plain attachment.
Cons: Once the ZIP is sent, you have lost control entirely. There is no verified access, no NDA gate, no per-bidder watermark, no tracking of who opened it, and no way to revoke it. Passwords get forwarded with the file or guessed, and a bidder can extract and forward the specs to anyone. Our why an email attachment is the riskiest way to send a contract applies just as much to an RFP.
Who it suits: Honestly, no one sending sensitive specifications. Use it only for genuinely non-confidential material where you accept you have no control after sending.
Verdict: Avoid for anything you would mind a competitor reading. It gives you a false sense of security and none of the controls an RFP needs.
Which should you choose?
| Your situation | Sensible default |
|---|---|
| Sending specs to competing bidders under NDA | 99 Data Rooms |
| Small team or one-off RFP starting out | 99 Data Rooms (free tier, then flat GBP) |
| Need NDA acceptance before specs open | 99 Data Rooms (NDA gate on Business) |
| Lightweight deck or document tracking only | DocSend, though 99 covers this plus the NDA gate |
| Quick drop of non-sensitive material | Dropbox, though 99 adds real control |
| Password ZIP by email | Avoid for sensitive specs, use 99 instead |
For a UK procurement team, the honest default across almost every row is 99 Data Rooms. DocSend is fine for lightweight tracking and Dropbox for casual sharing, but neither gates the specs behind an NDA and watermarks each bidder's copy the way an RFP needs, and a password ZIP gives you no control at all.
Try 99 free, then send your next RFP on it
If you run UK procurement, start on the 99 free tier: 3 rooms, 25 links, forever, no card; the drafter and e-signature start on Pro. Load a real RFP pack, gate it behind a verified email, watermark a couple of bidder copies and watch the tracking and revocation work in one place. Once you have seen that, the sensible move is to keep 99 and drop the attachments and password ZIPs. Pricing is flat in GBP, never per seat, and the loop already works today.
Sources
- 99 Data Rooms platform and features: home, features, security, pricing.
- DocSend document sharing and analytics (verify current hosting and plan): https://www.docsend.com
- Dropbox file sharing and pricing (verify current hosting and plan): https://www.dropbox.com
- UK GDPR guidance and the Data Protection Act 2018: Information Commissioner's Office, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/
Send it through an NDA-gated room, not as an attachment or a plain link. With 99 Data Rooms each bidder proves who they are with a verified email and one-time code and accepts the NDA before the specification opens, each copy is watermarked with the bidder's identity, you see who read what, and you can revoke access in one click if the process changes. That is a far higher bar than emailing a file.
Use a tool that gates on NDA acceptance. On 99's Business tier the bidder must accept the NDA and prove who they are before the specification is visible, rather than seeing it first and being asked to agree afterwards. You can draft the NDA itself from vetted England and Wales clauses, and our mutual NDA guide covers when a mutual NDA is the right choice.
Yes. 99's page-by-page analytics separate a raw visit from a verified viewer, so you can see which bidders opened and read the spec and which never got past the cover. Our track who opened a PDF guide and visits versus verified guide explain what the numbers show.
Watermarking deters leaks and helps you trace one back to its source, but it does not physically prevent someone photographing a screen. Per-bidder watermarking stamps each copy with the recipient's identity, which changes behaviour because bidders know a leak points to them. Our what is watermarking guide is honest about the limits.
Yes, with clean revocation. 99's one-click revocation cuts a bidder's access even mid-view, so if you cancel, re-scope or re-issue the RFP you pull the link rather than hoping bidders delete an old copy. A password ZIP or a plain link cannot do this.
Compliance depends on configuration and hosting. If the RFP or bidder responses carry personal data, UK GDPR and the Data Protection Act 2018 apply. 99 is UK-hosted in London with UK data residency, AES-256 at rest, TLS 1.2+ in transit and a DPA on request. Confirm hosting and processing terms for any other tool on its current plan.
Because once it is sent you have lost all control. There is no verified access, no NDA gate, no per-bidder watermark, no tracking and no revocation. The password is usually forwarded with the file, and the specs can be extracted and passed on to anyone. For competing bidders, that is exactly the leak you are trying to prevent.
It is a newer platform with a shorter track record than the incumbents. The core journey from drafting the NDA through gating, watermarking, tracking and revoking is live and usable today (the drafter starts on Pro), and the free tier lets you judge it on a real RFP rather than promises.