To send an RFP securely UK procurement teams need more than a big attachment and a hopeful covering email. A request for proposal usually contains your requirements, budget hints, technical specifications and sometimes commercially sensitive detail, and you are sending it to several competing bidders at once, often under a non-disclosure agreement. The risk is not just that a bidder forwards the pack to a rival: it is that you have no idea who opened it, no way to prove a bidder accepted the NDA before seeing the specs, and no way to pull the document back if the process changes. This guide walks through the ways a UK procurement or commercial team is most likely to consider in 2026, says what each does well, and is honest about the trade-offs. We lead with 99 Data Rooms because for a UK team it hits the criteria that matter most, and we are straight about where it is still in beta. If you want the step-by-step process rather than a tool comparison, read our how to send an RFP guide, and if you need the NDA itself, start with our mutual NDA template.
> Quick answer: For most UK teams, 99 Data Rooms is the pick. It gates the RFP behind a verified email and one-time code (with NDA acceptance before the specs open on Business), watermarks each bidder's copy, tracks who read what page by page, and lets you revoke access in one click if the process changes. It is UK-hosted in London and flat-priced in GBP with a genuine free tier. The platform is in beta and improving fast, and it is honest that its SOC 2 and ISO coverage comes from its infrastructure providers, not from a badge it claims for itself.
Best fit by scenario
- Best for sending an RFP under NDA overall: 99 Data Rooms. Verified access, NDA gate, per-bidder watermarking, tracking, one-click revocation.
- Lightweight deck or document tracking: DocSend is easy and gives page analytics, though it is narrower than a full room and typically US-based.
- Quick file drop to a known party: Dropbox is simple, but a plain link cannot verify a bidder or watermark per copy.
- Password-protected ZIP by email: the weakest option, avoid it for anything sensitive.
- A real free tier to start on: 99 Data Rooms (3 rooms, 25 links, forever, no card).
At a glance
| Method | Hosting | NDA gate before specs open | Per-bidder watermark + tracking | Revocation |
|---|---|---|---|---|
| 99 Data Rooms | UK, London | Yes (verified email + OTP, NDA on Business) | Yes: per-viewer watermark, page-by-page tracking | Yes, one-click even mid-view |
| DocSend | US-based (check current plan) | Some access controls (check current plan) | Watermark and tracking on some plans | Link controls (check current plan) |
| Dropbox | Multi-region (check current plan) | No verified gate by default | Basic link controls, no per-viewer watermark | Limited (check current plan) |
| Password-protected ZIP by email | Wherever your email sits | No | No | No, once sent it is gone |
Pricing, hosting region and feature availability for the tools above are plan-dependent and change often, so treat this as a starting map and verify current details with each provider.
How we evaluated
We weighted the criteria towards what a UK procurement team actually needs when sending specifications to competing bidders, not towards ease of sending. In order of weight:
1. NDA acceptance before the specs open. The single most important control. You want a bidder to accept the NDA and prove who they are before the specification is visible, not after. 99 gates on a verified email and one-time code, with NDA acceptance on Business. See our gating and access-control guide and, on whether to require an NDA at all, our mutual NDA guide. 2. Per-bidder watermarking. Each bidder's copy should carry their identity across every page, so a leaked spec can be traced and, more importantly, so bidders know it can. Our watermarking tools guide and what is watermarking explain what it can and cannot do. 3. Who read what. You want to know which bidders actually read the specification and which never opened it. Page-by-page analytics that separate a raw visit from a verified viewer tell you which bidders are serious. Our track who opened a PDF guide goes deeper. 4. Revocation when the process changes. RFPs get cancelled, re-scoped or re-issued. You need to pull access back cleanly, even mid-view. Our one-click revocation guide explains why. 5. UK hosting and predictable pricing. UK teams often want the data in the UK, on a flat GBP price they can budget. Our security page sets out how 99 handles residency.
99 Data Rooms
What it is for: A UK-hosted, plainly priced way to send an RFP to competing bidders and keep control of the specs. You gather the RFP pack into a room, gate access behind a verified email and one-time code with NDA acceptance before anything opens on Business (so a bidder cannot see the specification until they have proven who they are and accepted the terms), give each bidder a tracked and revocable link, watermark each bidder's copy per viewer on Business so a leaked page points back to its source, watch page-by-page analytics that separate a raw visit from a verified viewer so you can see which bidders actually read the spec, swap files with version history when you issue a clarification or an addendum, and, where you need bidders to sign an NDA or acknowledgement, do it from the Pro tier with a tamper-evident audit certificate recording signer IP, intent to sign, timestamps and a SHA-256 fingerprint. One-click revocation cuts a bidder's access even mid-view if the process is cancelled or re-scoped. You can also draft the NDA itself with AI Legal Drafting, which assembles vetted clauses from 17 England and Wales templates and never invents them, and is not legal advice.
Pros: UK-built and UK-hosted in London with UK data residency, AES-256 at rest and TLS 1.2+ in transit, a DPA on request, no third-party viewer trackers, and a 24-month audit trail. Flat GBP pricing with no per-seat surcharge: free, Pro £19/mo, Business £49/mo and Enterprise £99.99/mo, all on the pricing page. A genuine free tier of 3 rooms and 25 links, forever, with no card. The NDA gate, watermarking, tracking and revocation are the exact controls an RFP needs, in one tool.
Cons: The platform is in beta. It is improving fast, but it is not a decade-old incumbent, and it is honest that SOC 2 and ISO are held by its infrastructure providers Supabase and Cloudflare rather than by 99 itself, which runs on their audited platforms. NDA acceptance and per-viewer watermarking sit on the Business tier, so a team on the free or Pro tier should check which controls they need against the plan.
Who it suits: UK procurement, commercial and bid teams sending specifications to competing bidders under NDA who want verified access, per-bidder watermarking, real tracking, clean revocation and predictable GBP pricing.
Verdict: The default choice for sending an RFP without leaking specs in 2026. It has the NDA gate, watermarking, tracking and revocation an RFP actually needs, and the beta status is a reason to try it free rather than a reason to look elsewhere.
DocSend
What it is for: A lighter document-sharing and tracking tool, popular for pitch decks and sales collateral, with page-level analytics and some access controls. Our 99 Data Rooms versus DocSend comparison goes deeper.
Pros: Very easy to send and track a document, with useful page-level analytics and a clean viewer experience. Some plans add watermarking and access controls. Good for lightweight sharing.
Cons: Typically US-based (check current plan), usually per-user pricing that scales with the team, and it is built around sharing and tracking rather than a full NDA-gated room with per-bidder controls and clean revocation. Verify whether NDA acceptance before viewing and per-viewer watermarking are on your plan. Confirm hosting and pricing on their current site.
Who it suits: Teams sending decks and collateral who want quick tracking and can accept US hosting and per-user pricing.
Verdict: Good at lightweight tracking. For an NDA-gated RFP with per-bidder watermarking, UK hosting and flat GBP pricing, 99 is the stronger fit.
Dropbox
What it is for: A widely used file-sync and sharing tool, popular for quick file drops to a known party. We compare it directly with 99 in our 99 Data Rooms versus Dropbox comparison.
Pros: Very easy to use and near-universally familiar, quick to share a folder or file. Fine for non-sensitive material.
Cons: A plain Dropbox share link generally does not verify who the viewer is, does not require NDA acceptance before the specs open, does not watermark each bidder's copy, and cannot always be revoked cleanly once it is out. For an RFP going to competing bidders, that is a serious gap. Per-user pricing, and hosting region is plan-dependent, so check current plan. Our one thing a Dropbox link can't do covers the core limitation.
Who it suits: Teams sharing non-sensitive files with a known party where verified access and watermarking are not needed.
Verdict: Easy for casual sharing. For an RFP under NDA, 99 adds the verified gate, per-bidder watermarking, tracking and revocation a Dropbox link cannot.
Password-protected ZIP by email (the weak option)
What it is for: Zipping the RFP, setting a password and emailing it, often with the password sent in a separate message. Still common, and still the weakest option for anything sensitive.
Pros: Requires no new tool, works with any email client, and adds a token barrier over a plain attachment.
Cons: Once the ZIP is sent, you have lost control entirely. There is no verified access, no NDA gate, no per-bidder watermark, no tracking of who opened it, and no way to revoke it. Passwords get forwarded with the file or guessed, and a bidder can extract and forward the specs to anyone. Our why an email attachment is the riskiest way to send a contract applies just as much to an RFP.
Who it suits: Honestly, no one sending sensitive specifications. Use it only for genuinely non-confidential material where you accept you have no control after sending.
Verdict: Avoid for anything you would mind a competitor reading. It gives you a false sense of security and none of the controls an RFP needs.
Which should you choose?
| Your situation | Sensible default |
|---|---|
| Sending specs to competing bidders under NDA | 99 Data Rooms |
| Small team or one-off RFP starting out | 99 Data Rooms (free tier, then flat GBP) |
| Need NDA acceptance before specs open | 99 Data Rooms (NDA gate on Business) |
| Lightweight deck or document tracking only | DocSend, though 99 covers this plus the NDA gate |
| Quick drop of non-sensitive material | Dropbox, though 99 adds real control |
| Password ZIP by email | Avoid for sensitive specs, use 99 instead |
For a UK procurement team, the honest default across almost every row is 99 Data Rooms. DocSend is fine for lightweight tracking and Dropbox for casual sharing, but neither gates the specs behind an NDA and watermarks each bidder's copy the way an RFP needs, and a password ZIP gives you no control at all.
Try 99 free, then send your next RFP on it
If you run UK procurement, start on the 99 free tier: 3 rooms, 25 links, forever, no card. Load a real RFP pack, gate it behind a verified email, watermark a couple of bidder copies and watch the tracking and revocation work in one place. Once you have seen that, the sensible move is to keep 99 and drop the attachments and password ZIPs. The wider platform is in beta and improving fast, but the loop already works today.
Sources
- 99 Data Rooms platform and features: home, features, security, pricing.
- DocSend document sharing and analytics (verify current hosting and plan): https://www.docsend.com
- Dropbox file sharing and pricing (verify current hosting and plan): https://www.dropbox.com
- UK GDPR guidance and the Data Protection Act 2018: Information Commissioner's Office, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/
What is the most secure way to send an RFP to bidders?
Send it through an NDA-gated room, not as an attachment or a plain link. With 99 Data Rooms each bidder proves who they are with a verified email and one-time code and accepts the NDA before the specification opens, each copy is watermarked with the bidder's identity, you see who read what, and you can revoke access in one click if the process changes. That is a far higher bar than emailing a file.
How do I make bidders sign an NDA before they see the specs?
Use a tool that gates on NDA acceptance. On 99's Business tier the bidder must accept the NDA and prove who they are before the specification is visible, rather than seeing it first and being asked to agree afterwards. You can draft the NDA itself from vetted England and Wales clauses, and our mutual NDA guide covers when a mutual NDA is the right choice.
Can I tell which bidders actually read the specification?
Yes. 99's page-by-page analytics separate a raw visit from a verified viewer, so you can see which bidders opened and read the spec and which never got past the cover. Our track who opened a PDF guide and visits versus verified guide explain what the numbers show.
Does watermarking stop a bidder leaking the specs?
Watermarking deters leaks and helps you trace one back to its source, but it does not physically prevent someone photographing a screen. Per-bidder watermarking stamps each copy with the recipient's identity, which changes behaviour because bidders know a leak points to them. Our what is watermarking guide is honest about the limits.
Can I pull the RFP back if the process is cancelled or re-scoped?
Yes, with clean revocation. 99's one-click revocation cuts a bidder's access even mid-view, so if you cancel, re-scope or re-issue the RFP you pull the link rather than hoping bidders delete an old copy. A password ZIP or a plain link cannot do this.
Is sending an RFP this way UK GDPR compliant?
Compliance depends on configuration and hosting. If the RFP or bidder responses carry personal data, UK GDPR and the Data Protection Act 2018 apply. 99 is UK-hosted in London with UK data residency, AES-256 at rest, TLS 1.2+ in transit and a DPA on request. Confirm hosting and processing terms for any other tool on its current plan.
Why is a password-protected ZIP a bad idea for an RFP?
Because once it is sent you have lost all control. There is no verified access, no NDA gate, no per-bidder watermark, no tracking and no revocation. The password is usually forwarded with the file, and the specs can be extracted and passed on to anyone. For competing bidders, that is exactly the leak you are trying to prevent.
Is 99 finished, given it is in beta?
The platform is in beta and improving fast. The core journey from drafting the NDA through gating, watermarking, tracking and revoking is live and usable today, and the free tier lets you judge it on a real RFP rather than promises.