The RFP Arrived. You Are Still the Whole Sales Team.

A founder Slack-reacted my message with a skull emoji and a PDF.

Forty-two pages. Mandatory Excel attachment. Due in nine business days. The subject line said "RFP: please complete all tabs."

She had four hundred customers on a $79 team plan. One enterprise logo in the pipeline. No sales hire. No proposal writer. She asked whether this was "finally real enterprise interest."

Maybe. Or maybe procurement needed two bids on file and her champion was too polite to say the incumbent already won.

I am Derek. I have watched solo founders treat an RFP like a product launch and burn three weeks building a deck nobody reads past row fourteen. I have also watched a twelve-page response beat a legacy vendor because the founder mapped every requirement to a screenshot and a named customer reference.

This post is the rfp response micro saas solo founder playbook: how to read the packet like procurement reads it, how to answer without faking your roadmap, how to price so finance can compare you on a spreadsheet, and how to know when the right move is to close the laptop and no-bid.

If you have not survived a vendor security form yet, start with the security questionnaire guide. If the RFP hides pilot language inside "evaluation period," read paid pilot proposals before you agree to a free year. When you get to commercial terms, annual contracts are the exit you want from a formal RFP, not an eternal evaluation.

An RFP is not a compliment. It is homework with a clock. Treat it like a deal motion, not a writing contest.

An RFP in your inbox is not a win. It is a deadline.

The thesis graphic on this page is the whole argument in one glance. Left side: the feature dump trap, forty pages, every checkbox yes, pricing buried in a footnote. Right side: the operator packet, one-page executive summary, requirement matrix, honest nos, priced tiers procurement can score.

Buyers send RFPs when they need comparability. Same sections, same scoring weights, same pricing rows. That is rational for them. For you, it is a tax on time unless someone inside is fighting for you.

Solo founders lose RFPs in two boring ways. They submit late because they rewrote the product marketing site into Word. Or they submit on time with vague pricing and get dropped before a finalist call.

Winning as a micro-SaaS vendor usually means shortlist, not "lowest price." Shortlist gets you the conversation where your champion explains why the big suite is overkill. Miss the shortlist and your champion sends apologetic emails about "process."

Before you open tab one, answer four questions on paper:

Who requested this RFP, and did they talk to you live in the last thirty days? If the answer is "I found you on G2," slow down.

Is there a published scoring rubric or weighting? If yes, that is your outline. If no, ask. Silence often means informal process; you still mirror their section headers.

What is the decision date after submission, and who is in the room? No date means drifting evaluation.

Are mandatory requirements actually mandatory, or boilerplate from 2019? Highlight lines that mention technologies you do not ship. Those are no-bid signals or negotiation hooks, not surprises for week eight.

I keep a one-page deal brief at the top of every response folder: champion name, economic buyer role, incumbent if known, deadline, hours budget, and win condition ("finalist call" vs "signed PO by Q4"). The RFP does not include that page. You need it anyway.

Enterprise theater treats RFPs like merit badges. "We made the shortlist" sounds good at founder dinner. Revenue is validation. Shortlist without a champion who can spend is pipeline perfume.

Your job is not to impress every stakeholder with prose. Your job is to make the grader's spreadsheet easy to fill in your favor without lying.

If the packet arrived cold with no discovery, schedule thirty minutes with whoever's email is on the cover letter. Not a demo. A clarification call: "Which sections matter most this cycle? What did the last vendor miss?" That call saves days of guessing.

Some founders ask whether AI can "just answer the RFP." AI can draft first passes on repetitive security questions if you already have a vetted library. It cannot tell you whether question 14.3 is a hard gate or copy-paste fluff. You still read every line.

When the deadline is real and the champion is real, block calendar like a launch. When either is fake, cap hours and treat the response as practice. Both are valid. What kills you is pretending a fake RFP is a fake deadline while spending real weeks.

The rest of this article walks through how to build the operator packet: buckets for answers, library for reuse, pricing that survives comparison, compliance without fiction, and the no-bid line when the math stops working.

When procurement sends the template and you are still the whole GTM team

Procurement runs a calendar you did not choose. Release date, optional vendor conference call, questions due, answers posted, submission deadline, shortlist notification, finalist demos, best and final, legal redlines, signature. Your product roadmap does not pause because tab seven wants a SOC 2 bridge letter.

The first practical move is to reverse the timeline. Work backward from the due date and subtract your real life. If you are also on support rotation and shipping a billing fix, nine business days might be six working evenings. That is not cowardice. That is capacity math.

Mark three internal milestones before you write prose: outline approved by you, pricing locked, security appendix attached. If milestone three slips, you are not late on typing. You are late on truth. Better to submit honest partials on optional sections than fake yes on SAML.

Enterprise RFPs love attachments: Excel pricing grids, PDF certification uploads, reference forms with customer contact fields. Make a checklist from the table of contents and tick compliance items. Missing one mandatory attachment can disqualify you without anyone reading sentence one.

Ask for the Q&A window even if you think your questions are dumb. "Is single sign-on required for phase one or phase two?" is not dumb. "Can we propose an annual term instead of three-year prepay?" is not dumb. Posted answers apply to every bidder. That is free intelligence.

Founders sometimes skip the call because they hate groups. Join muted, take notes, listen for incumbent names and pain the template never mentions. Someone will say "we failed last time on adoption" or "reporting was the issue." That sentence belongs at the top of your executive summary.

If the RFP says "vendor must have been in business ten years," you already know the game. Formal requirements can be written for someone else. You can still respond if your champion pushes a waiver, but go in eyes open. Waivers happen. They are also often fiction told to keep you writing.

Micro-SaaS vendors win attention by being legible. Large suites win by checking boxes you never heard of. Your counter is speed and specificity: shorter answers, screenshots from their use case, named implementation steps with dates you can hit.

Keep a single folder per RFP: original PDF, your working doc, pricing spreadsheet exported to their template, security PDFs, signed reference permissions. Version filenames with dates. Procurement emails "please resubmit with attachment 3" at 4:58 p.m. on due day. You will thank yourself.

When you are the whole GTM team, the RFP cannot become your only job unless the deal size justifies it. Write down a hour cap. Tell your champion: "I can deliver a complete response by X if we keep scope to Y users and Z modules." Transparency builds trust. Silent heroics build resentment.

This section is not glamorous. It is the difference between a panic upload and a packet that lands while you still sleep.

Three buckets every requirement lands in

Open the spreadsheet. Read every line once without typing. Sort mentally into three buckets: yes today, no or workaround, not yet.

Yes today gets a short proof: feature name, screenshot, doc link, or one sentence of behavior. "Yes: role-based access control with admin audit log (see appendix B, screenshot 2)." Grader checks the box and moves on.

No or workaround is where solo founders either win trust or torch the deal. "No native Oracle connector; we export CSV nightly and ingest via SFTP (customer X uses this workflow)." That is a valid answer if their pain allows it. "No: we do not store card data; Stripe handles PCI scope" is a valid answer when the question assumes the wrong architecture.

Not yet is for roadmap items you will ship but cannot fake today. "Q2 2027: SAML SSO on Team plan; password SSO and Google OAuth available today." Procurement remembers dates. Champions remember dates. Do not say Q2 if you mean "whenever."

The failure mode is bucket collapse: everything becomes yes because you fear elimination. Then security calls your bluff, or implementation discovers the gap, and the champion who vouched for you looks foolish. One visible lie erases ten honest strengths.

Some lines are parent requirements with ten children. Answer the parent in summary and children in sub-rows. Mirror their numbering exactly. Graders search for "4.2.1" with Ctrl+F. Creative reorganization feels helpful. It is not.

Weight the buckets by scoring if weights exist. A yes on a five-point integration row beats a paragraph on your company history. If weights are hidden, overweight security, data handling, uptime, support response, and pricing clarity. That is what sinks micro vendors or saves them.

When a requirement is nonsense for your category, say so calmly. "Question assumes on-prem deployment; we are cloud-only multi-tenant with data residency in US-East." Offer the control that achieves their outcome. Buyers sometimes paste RFPs from unrelated categories. Pointing that out politely saves everyone time.

Use consistent verbs: Supported, Not supported, Planned, Alternative available. Color-code your internal sheet if you want. Export to their format without colors. Procurement lives in grayscale.

Re-read bucket two before submit. Workarounds you cannot stand behind become support tickets. If the workaround needs professional services you cannot staff, bucket two is actually bucket three with a services quote attached.

Founders ask me how many nos kill a deal. There is no universal number. One hard no on a gate requirement kills you. Three soft nos on edge integrations might not. Ask your champion which rows are gates. That conversation is worth more than another page of marketing.

Bucket discipline also speeds the next RFP. Your library stores proof snippets tagged by bucket. Second response is assembly, not reinvention.

Your champion forwards PDFs. Someone else scores them.

Your champion is not the grader. Champions love you. Graders love checkboxes. Sometimes they are the same person at a tiny company. At any firm big enough to send a forty-page RFP, scoring is usually distributed.

Procurement often owns the template and timeline. IT security owns attachment six. Finance owns tab four pricing. Legal owns insurance and liability exhibits. The executive sponsor may never open your PDF until finalists.

Write so each role finds their section fast. Executive summary for the sponsor. Requirement matrix for procurement. Security appendix for IT. Pricing for finance. Implementation timeline for the champion's boss who fears disruption.

Champions forward emails. They rarely rewrite your answers into internal politics. Give them forwardable ammunition: three bullets on risk reduction, one paragraph on migration, a sentence on exit (data export, notice period). They paste into Slack. That is internal selling for you.

If you only write for your champion's enthusiasm, the grader marks "partial" on half the rows because you never mentioned backup retention days. Champions cannot fix a spreadsheet after submit.

Ask your champion who scores what. "Does IT grade security before procurement sees price?" changes whether you lead with compliance or value. Some orgs drop vendors on price before IT reads anything. Some do the opposite. Process varies. Assumptions hurt.

Reference calls happen late. Names you put on the form will get called. Ask those customers before you list them. Send them the two questions this buyer cares about. References who say "great founder, small team, responsive" help. References who say "we use feature X for Y outcome" help more.

Incumbents have reference machines. You have three happy logos and one founder on the phone. That is enough if the reference matches the buyer's industry and size. Mismatch reads as desperation.

Graders also notice consistency. Pricing tab total must match executive summary. Seat counts must match implementation plan. Security answers must match your public trust page. Copy-paste errors between versions are amateur signals. Sleep, then re-read with fresh eyes.

When finalists present, the room is humans again. The RFP got you there. Do not re-read the PDF slide by slide. Tell the story of their problem, show the product for their workflow, name the rollout week by week, restate commercial terms plainly.

If you never get the finalist call, debrief politely. "What would have made our response stronger?" One answer improves the library for the next cycle. Ghosting after submit is common. Persist once, then move on.

Champion care matters during scoring. They are juggling internal critics. Send a short note when you submit: "Attached complete response, executive summary on page one, pricing on tab four, security in appendix. Happy to clarify any row." No guilt trip. Professional calm.

Remember: interest is not budget. A champion who cannot get scoring weights or a clarification call is a weak champion for an RFP motion. That does not mean abandon them. It means size your effort accordingly.

Build the answer library before the panic week

The second RFP should take half the time of the first. If it does not, you did not build a library.

Start a Notion or Google Doc master with sections: Company facts, Product capabilities, Security and privacy, Support and SLA, Implementation, Pricing logic, Legal limits. Under each, store vetted paragraphs you already cleared with your lawyer or your own honesty policy.

Security questions repeat. "Where is data stored?" "Do you encrypt at rest?" "Describe your access control model." Answer once, link to your trust page, reuse. When the answer changes because you shipped SSO, update the master once and every future RFP inherits truth.

Tag snippets with product areas: auth, billing, exports, admin, API. When a new RFP asks about API rate limits, you search "API" instead of rewriting from memory at midnight.

Keep evidence links stable. Screenshot URLs rot if you rename files. Use dated folders in a public trust center or appendix PDFs you control.

Founders without SOC 2 still need a coherent story: policies you do have, pen test timeline if planned, subprocessors list, incident process. Your security questionnaire process is the same content RFP attachment six wants, formatted differently.

Assign a single owner for the library even if the company is one person. Future you is another person during a deadline crunch. "Last updated" dates on sections prevent stale answers about retention or datacenter region.

AI assists here if you feed it the library, not the open web. Prompt: "Rewrite this approved paragraph to fit question wording, do not add certifications." Human reviews every line. AI hallucinates compliance faster than it hallucinates poetry.

Version control matters when two deals run parallel. Deal A negotiates a custom DPA. Deal B must not inherit Deal A's terms in a copied paragraph. Use deal-specific docs layered on top of the master, never fork the master per deal without merging learnings back.

Include boilerplate nos you are proud of. "We do not offer on-prem installation." "We do not sign unlimited liability caps." Clarity reduces legal ping-pong later.

Add a one-page change log when product ships enterprise features. Champions forward RFPs quarterly. Your library should reflect this quarter's truth.

Time saved goes to executive summary customization, the part that must be bespoke per account. Library handles the repetitive eighty percent.

When you lose on an RFP, harvest the grader's feedback into the library. Missing backup geo-redundancy detail? Add a paragraph and a diagram to appendix standards for next time.

Library discipline is boring until deal three arrives the same week as a launch. Then it is survival.

Pricing tables that survive line-item comparison

Finance scores what they can subtract. Vague pricing loses to a worse product with a filled spreadsheet.

Give named tiers even if your marketing site shows one price. Team, Business, Enterprise-lite with seat bands and annual totals. Match their requested term: one-year, three-year TCO, or month-to-month with annual default noted.

Show what moves the number: seats, usage metric, support tier, implementation package. Hide nothing that becomes an invoice surprise. Surprises kill renewals and references.

If the RFP asks for itemized discounts, pick one recommended bundle and label alternatives optional. "Recommended: Business 50 seats, $18k year one, includes onboarding week." Optional rows can exist without steering the buyer toward chaos.

Implementation fees deserve their own line. Solo founders sometimes absorb setup to win logo. Fine if deliberate. Disastrous if accidental and repeated every RFP. Name a standard package: data import, admin training, go-live check-in. Custom scope gets custom SOW later.

Price alignment across tabs is non-negotiable. Executive summary says $18k, spreadsheet says $21k, champion remembers $15k from a call. You lose trust before legal opens the doc.

When buyers demand "most favored customer" clauses you cannot give, note it in pricing comments or redline early. Micro-SaaS vendors rarely win MFN games against enterprises with hundred-seat Salesforce contracts.

Annual vs multi-year: if they ask three-year TCO, show annual renewal uplift policy plainly. No teaser year one with hidden year two jump. Finance models forward. Annual contract thinking helps you present multi-year without giving away the farm.

Some RFPs include price ceiling fields. If the ceiling is below your floor, that is a no-bid signal unless champion confirms flexibility. Submitting anyway trains you to accept bad math.

Currency and tax: answer in their requested currency or state USD with conversion note. Invoicing via Stripe or wire should match what you quote.

Founders underprice because RFPs feel like exams. You are not graded on cheap. You are graded on value within budget they often do not publish. Ask your champion for budget band before you fill tab four. Silence means guess from prior similar deals, not from fear.

Include renewal and exit one-liners near pricing: auto-renew terms, export path, notice days. Procurement cares about exit more than your homepage hero.

When you are incumbents' price beat, say where you save money: fewer seats needed, faster rollout, no separate module fees. Numbers beat adjectives.

Pricing section done well lets a champion defend you in an internal meeting you are not invited to. That is the whole point.

Security, compliance, and the appendix that actually matters

IT reads your security appendix before they trust your pricing. Treat attachment six like product.

Attach real documents: subprocessor list, data flow diagram, policy PDFs you actually follow, pen test summary if you have one, SOC 2 letter if you have one. Link to detailed answers you maintain for security questionnaires. Same facts, RFP formatting.

Do not claim certifications in prose if the certificate is not attached. Graders check. Champions get embarrassed.

Answer control questions with specificity: retention period, backup frequency, encryption standards, employee access policy, incident notification window. "Industry best practices" is a non-answer. "AES-256 at rest, TLS 1.2+ in transit, 30-day backup retention, 72-hour breach notification" is an answer.

Data residency gets explicit. US-only, EU option, customer choice if true. If you run on a major cloud provider, name the region strategy without drowning in jargon.

For GDPR, CCPA, and HIPAA requests, know your lane. Many micro-SaaS tools are not HIPAA-ready. Say so and describe what customers in regulated spaces typically do (BAA unavailable, customer de-identifies data, etc.). Legal nuance belongs to lawyers; honesty belongs to you.

Insurance exhibits ask for general liability and cyber limits. If you have policies, attach certificates. If limits are lower than requested, note it and offer to discuss a rider at signature. Some requirements are negotiable after shortlist.

Pen tests and vulnerability management: describe cadence truthfully. "Annual third-party pen test" beats "continuous security culture." If you run automated scanning weekly, say that.

Access to customer data by your team: who, when, why, logged. Founders who "just hop into prod to debug" need a policy story before RFP season.

Subprocessors change. Update the list when you add analytics or email providers. Stale lists fail diligence.

When a requirement exceeds your stage, propose compensating controls you can do: MFA for all admin accounts, IP allowlisting, audit logs export. Buyers sometimes accept path plus date for full SSO.

Security appendix length can be long. That is fine if structured. Table of contents, section numbers, cross-links. Graders search keywords: "SOC", "encryption", "retention."

After submit, IT may send a follow-up questionnaire anyway. Your library makes round two faster. Same truth, more rows.

Never outsource the appendix to someone who does not know your architecture. One wrong data flow diagram kills the deal faster than high price.

References, proof, and the logo slide trap

References are not decoration. They are risk transfer. Procurement wants someone who looks like them to say you showed up.

Pick references matchable to the buyer: similar industry, similar size, similar use case. A fifty-person agency reference for a hospital system RFP feels off. One well-matched reference beats five random logos.

Call every reference before listing them. Email the questions this buyer is likely to ask. "How long to go live?" "What broke?" "Would you buy again?" References who ramble hurt you. References who answer in outcomes help.

If you lack a perfect reference, explain honestly in the executive summary: "We are newer in healthcare; attached reference is fintech with similar workflow volume and SSO requirements." Buyers respect transparency when paired with a plan.

Logo slides without context are theater. One sentence per logo: problem, outcome, scale. "Reduced manual reporting from six hours to forty minutes weekly" beats a grid of SVG marks.

Case studies can be short. Half-page PDF: before, after, quote with title, metric. Link from matrix rows where relevant.

Testimonials from Twitter are not RFP references. Named signatories with company and role are.

When references are confidential, ask procurement if anonymized case studies suffice. Some public sector RFPs forbid anonymized. Know the rule before submit.

Video links rarely get watched in scoring phase. PDFs and phone calls win.

Keep a reference rotation so the same customer is not cold-called every month. Nurture referees; they are doing you a favor.

Proof also includes uptime history, support SLAs you actually meet, and roadmap realism. Overpromising in references section invites legal scrutiny.

If you are pre-revenue enterprise-wide but strong in a division, say so. Land-and-expand language is fine when the RFP scope matches the beachhead.

Founders sometimes attach investor names as credibility. Irrelevant to procurement unless the RFP asks for financial stability. Focus on customer proof and balance sheet facts if requested.

When you win, update references with permission from the new logo. Winning creates future proof.

Redlines, no-bid calls, and the deals that eat your quarter

Not every RFP deserves you. No-bid is a valid sales motion.

No-bid when: incumbent named and champion weak; mandatory features eighteen months out; timeline impossible; pricing ceiling below cost; unlimited services assumed; free pilot plus production load hidden in scope; you cannot get a single clarification answered.

No-bid politely: "We are passing this cycle due to timeline and fit; happy to engage on the next RFP or a direct evaluation if scope narrows." Professional tone preserves champion relationships.

Partial bid is rare and risky. If you skip sections, confirm procurement allows optional modules. Otherwise partial looks incomplete.

Redlines on their paper: liability caps, auto-renew, IP ownership, audit frequency, exclusivity, most-favored pricing. Micro-SaaS vendors cannot accept enterprise paper unchanged. Mark exceptions in the RFP comment column or cover letter. Some orgs forbid redlines until finalist. Know which.

Insurance and indemnity clauses kill deals at signature, not at shortlist. Flag early if your lawyer has hard limits. Surprises at best-and-final waste weeks.

Founders emotional about logos accept bad redlines. One bad contract teaches more than one lost RFP. Walk when the paper turns you into unpaid insurance.

Hour-cap yourself. Thirteen hours on a cold RFP with no champion is thirteen hours not spent on customers who pay. Track hours. Review win rate by source after three cycles. Data beats hope.

When you no-bid, tell your champion why in one paragraph. They may fight internally for waiver next cycle or narrow scope. Ghosting damages trust.

Competitive intel from no-bid: ask what vendor won and why if they share. Feed library.

Some RFPs are learning exercises. Cap them explicitly: "We will submit minimal response to learn scoring." Do not pretend it is a full push.

Redline battles after win are normal. Contract negotiation is not failure. RFP response got you to the table. Separate mental mode for legal week.

If procurement extends deadline once, confirm whether scoring date moved too. Extensions without champion push sometimes mean stalled internal budget.

Deals that eat a quarter feel like progress because PDFs accumulate. Measure pipeline by signed PO, not by pages uploaded.

When the RFP smuggles in a free pilot

Read evaluation language like a lawyer reads fine print. "Ninety-day proof of concept at no charge" buried in section eight is not a footnote. It is your margin dying quietly.

Connect RFP pilot terms to your paid pilot proposal motion. Convert free POC language into time-boxed paid evaluation with success criteria, or no-bid. Champions can take your redline to procurement if they have internal capital.

RFPs sometimes assume unlimited users during evaluation. Counter with named seat cap and overage price. Unlimited evaluation becomes production without PO.

Weekly status meetings during "evaluation" are services. Line-item them or decline.

Data migration into your prod environment for a free pilot is work. Scope it or charge implementation.

If the RFP says "vendor shall provide all customization at no additional cost," that is a services company trap. You are not a body shop unless you priced like one.

Pilot-to-annual path should appear in executive summary: "Evaluation converts to annual Team agreement on criteria in appendix C." Tie to annual contract framing when they ask multi-year commitment.

Some buyers use RFP to benchmark incumbents. Your champion may not know. Clarification questions surface "is this binding or informational?" when politically safe.

When pilot language is reasonable, mirror it in implementation timeline. Show week-by-week tasks, customer responsibilities, exit if criteria fail.

Free tier users reading this: different motion. RFP implies procurement. Credit card self-serve skips forty-page packets.

If you already agreed verbally to free pilot before RFP arrived, paper is catching up to bad precedent. Use RFP response to tighten terms before signature.

Champions need language to push back: "Alternative compliance: paid pilot, 60 days, three metrics, converts to annual." Give them paste-ready text in cover letter.

Pilot smuggling is where solo founders donate the most time. Name it when you see it.

From shortlist to signature without reopening the packet

Shortlist means humans again. Do not reopen every row unless IT flagged a gap.

Prepare a finalist deck that mirrors executive summary, not the full PDF. Ten slides: their problem, your approach, workflow demo story, rollout, security one-pager, commercial terms, references, next steps with dates.

Bring the economic buyer into the room if possible. Champions alone cannot approve redlines.

Best-and-final pricing: know your floor before the call. Discount once with reason (multi-year, case study permission), not death by a thousand cuts.

Legal week: your lawyer or template MSA meets their paper. Prioritize data processing, liability cap, termination, export, SLA credits. Skip fighting immaterial terms if cap and data are clean.

Order form beats vague PO. Named SKUs, term, price, renewal, signatures. Annual contract mechanics you already understand from smaller deals scale here with more initials.

Implementation kickoff should start before signature paranoia finishes if champion agrees. Momentum matters. Stalled legal kills enthusiasm.

Post-signature, update library with every concession you gave. Next RFP inherits smarter defaults.

Win or lose, run a retrospective: hours spent, stage reached, reason given. Adjust no-bid rules next quarter.

Shortlist without signature is still progress if learning is captured. Signature without profit is not progress. Know which you got.

Questions founders ask when the RFP clock is ticking

Should a solo founder respond to an enterprise RFP at all?

Only when you have a real champion, a published deadline you can hit, and a path to someone who can sign. An RFP without a warm contact is often cover for a predetermined vendor. If nobody will take your call before you submit, treat it as a low-priority no-bid unless the logo is worth the learning exercise and you cap hours in writing.

How long should an RFP response be for a micro-SaaS vendor?

As short as the buyer allows while mirroring their section numbers. Lead with a one-page executive summary, then a requirement matrix with evidence links, then pricing on its own tab. Forty pages of marketing copy loses to twelve pages that map one-to-one to their spreadsheet. Procurement scores completeness and clarity, not adjectives.

Can I say no to RFP requirements I do not meet yet?

Yes, and you should. A honest no with a date beats a yes that collapses in security review. Use not yet with a quarter or a workaround. Buyers who need full SAML today will fail you in week six if you pretended. Incumbents lie more gracefully; you win on trust and speed when the gap is small.

How do I price an RFP when they ask for three-year TCO?

Give three named tiers with seat bands and annual totals, plus one optional line for implementation if you charge for it. Show year-one and year-three side by side without hiding uplift. If they want custom SKUs, pick one recommended bundle and mark alternatives as optional. Never leave the pricing section as contact us unless you enjoy losing on default.

What is the biggest mistake founders make on security sections?

Copy-pasting a SOC 2 marketing paragraph when the questionnaire asks for control IDs. Answer the exact question, attach your real security pack, and link to the deeper post on questionnaires if you need a process. If you do not have a document, say what you do have and when the next audit completes. Fabricated compliance language is a disqualifier when IT reads page nine.

When should I no-bid an RFP?

No-bid when the timeline is impossible, the incumbent is named in the intro, your champion will not go on record, mandatory requirements need features eighteen months out, or the fee structure assumes free pilot plus unlimited services. Also no-bid when responding would blow a quarter of founder time for a one-in-twenty shot. Politely decline and ask to stay in touch for the next cycle.

The RFP you should have declined

I still think about the founder who finished a fifty-tab response for a city RFP on custom reporting she did not ship. She missed a product deadline for customers who paid. The city picked an incumbent with a decade of references. She was not wrong to try once. She was wrong to try without a hour cap and a champion who could not answer scoring questions.

An RFP response micro saas solo founder can execute is shorter than the template suggests, honester than your fear suggests, and priced for comparison whether you feel ready or not. Build the library on quiet weeks. Spend executive summary love on deals with champions. No-bid the theater. Save the quarter for customers who already signed.

The signed annual in your Stripe dashboard beats the shortlist email in your inbox. Procure accordingly.