Procurement Tool
The 30-Question LMS RFP Template
Most vendor RFP questionnaires focus on superficial checklist items like "has video support" that any LMS can answer yes to.
This specialized 30-question template exposes the real technical and commercial seams: hidden 41-user tier cliffs, predatory enterprise SSO taxes, multi-tenant database isolation models, and AI data privacy guarantees.
1. Commercial Transparency & Pricing Model
- Is your pricing published publicly on your website, or locked behind sales calls?
- Do you charge based on total registered user profiles, or strictly monthly active users (MAU)?
- What is the exact price difference if our active headcount increases from 40 to 41 learners?
- Are there mandatory implementation fees, onboarding packages, or professional service minimums?
- What are the exact contractual terms and financial penalties if we choose not to renew at year-end?
- Can we purchase additional AI generation credits à la carte, or must we upgrade our entire software plan?
- Is there a minimum seat commitment for customer/partner external training portals?
2. Identity, Access & Security Governance
- Is SAML 2.0 and OIDC Single Sign-On included in your entry tier, or restricted to an"Enterprise" plan?
- Do you support automated SCIM 2.0 user provisioning and instantaneous de-provisioning from Okta and Azure AD?
- How is organisation data isolated at the database layer (application WHERE filtering vs. PostgreSQL Row Level Security)?
- Can we export a complete, machine-readable JSON/CSV archive of all our organizational data on demand?
- Do you operate an append-only, append-only audit trail capturing administrative actions and diffs?
- What third-party sub-processors have access to customer data, and what is your notice window for additions?
- Can we enforce IP allow-listing (CIDR ranges) for administrative access?
- Are data subject rights (GDPR Art. 17 / India DPDP Act) supported via self-service automated erasure workflows?
3. Interoperability & Learning Standards
- Do you provide native in-browser execution of SCORM 1.2 and SCORM 2004 zip packages without third-party converters?
- Does your player accurately record suspend_data bookmarking, session time, and raw score telemetry?
- Can completed learning events be dispatched as xAPI (Tin Can) statements to an external Learning Record Store (LRS)?
- Can issued certificates be verified independently by third parties via permanent public URLs or QR codes?
- If we migrate away in the future, can we export our course packages and question banks without data degradation?
- Do you support automated recertification tracking with configurable expiration intervals and warning cadences?
- Can quizzes draw randomized question subsets from pooled banks with shuffled distractors?
4. Artificial Intelligence & Data Privacy
- Is customer prompt data, uploaded course text, or student interactions ever used to train public foundation models?
- Do you publish a transparent, per-action credit rate sheet for syllabus drafting and quiz generation?
- Can our organization bring our own OpenAI, Anthropic, or OpenRouter API key (BYOK) to avoid vendor markups?
- What guardrails prevent prompt injection from untrusted learner inputs reaching upstream LLMs?
- Is AI-generated text clearly disclosed and editable by instructional designers prior to publishing?
- Do you offer a legally binding Data Processing Agreement (DPA) incorporating standard contractual clauses?
- What downstream foundation models are utilized, and are their processing regions configurable?
- Can AI coaching and content generation features be completely disabled at the organisation level if desired?