Self-hosted LLM inference RFP questions to ask before you choose a partner
Your team has been asked to put open-weight models behind an internal endpoint, and you now have to compare implementation partners who all claim they can do it. This page gives you a neutral question set organized by area, what a credible answer sounds like, and the red flags that should slow a decision. Use it to write your request for proposal, not as a checklist to pass on a call. The questions apply equally whether the engine underneath is vLLM, Ollama or llama.cpp, because the failure points that matter (exposed endpoints, GPU sizing, release cadence, handover) exist in every case.
Run the evaluation in three steps. First, send the questions in writing and ask for written answers. A partner who answers verbally, or who replies with a generic capabilities deck, has told you how the engagement will be run. Second, require that every answer map to a written scope with named deliverables, so that a promise about monitoring or upgrades becomes a line item rather than a sales claim. Third, test the most important claims with a short proof of concept on your own hardware or a representative environment. Ask the partner to show the engine's /metrics output being scraped, and to demonstrate that an unauthenticated request to a management route is blocked at the reverse proxy.
Score the answers against the red flags in each area. Be wary of any partner who treats --api-key as sufficient protection, since the vLLM security documentation warns against relying on it alone. Be wary of GPU sizing offered without your concurrency, context length and latency targets, and of upgrade plans that ignore the engine's release cadence. vLLM published new minor releases roughly every two weeks in the period covered by its release history, so a partner who has no process for regular patching of the inference stack, and no plan for testing each release against your models, is planning for a platform you will not be running. Finally, ask who on the partner side will hold the operational runbooks after go-live and what you receive if the engagement ends. Confirm each of these in writing before you sign, and ask for a quote that separates one-time build costs from recurring support.
Which engine each question set is for
vLLM is the engine most likely to appear when the goal is a shared service for many users on GPU hardware. It is licensed under Apache-2.0 and has no paid edition, so the cost you pay a partner is for implementation and operation, plus the GPUs and surrounding infrastructure, not for the software itself. It exposes OpenAI-compatible endpoints, which means your applications can point at it, but the server exposes more than the chat routes you intend to publish. Ask the partner to explain how each route is exposed and who can reach it.
- Endpoint exposure: The
--api-keyoption protects only some routes. The vLLM security documentation says it does not cover/metrics,/health,/pauseor/invocations, and recommends a reverse proxy that allowlists only the user-facing endpoints. Ask for the proxy configuration and the test evidence that blocked routes stay blocked. - Multi-node networking: The vLLM security documentation states that communication between nodes is insecure by default. Ask how the partner isolates the cluster network and encrypts or authorizes node traffic.
- Release cadence: New minor releases have arrived about every two weeks, so ask who patches, how they test each release against your models, and how long a rollback takes.
- Scaling model: Ask how tensor and pipeline parallelism are sized for your models and whether the design depends on Ray or the built-in multiprocessing backend.
- Metrics: The Prometheus endpoint at
/metricsis useful for capacity planning, so ask where it is scraped and who can read it.
Confirm the hardware support matrix, Kubernetes deployment method and any third-party plugins with the vLLM project and the partner before accepting any design.
Ollama is a simple runtime for running models locally, written in Go with a llama.cpp backend and licensed under MIT. It suits small teams, developer workstations and departmental pilots, where setup speed matters more than high concurrency. Its local API on port 11434 requires no authentication by default and binds to 127.0.0.1, so the security questions shift from the engine to the exposure you add around it. The partner must explain that exposure in writing.
- Default authentication: The local API does not require authentication. Ask how the partner places a proxy or identity layer in front of
OLLAMA_HOSTand whether direct access to port 11434 is blocked at the network level. - Concurrency limits: Defaults include one parallel request per model (
OLLAMA_NUM_PARALLEL), three loaded models per GPU (OLLAMA_MAX_LOADED_MODELS) and 512 queued requests (OLLAMA_MAX_QUEUE). Ask what settings the partner will use and how they were load tested. - Cloud features: Ollama states that local runs do not expose your prompts, and cloud features can be turned off with
OLLAMA_NO_CLOUD=1. Ask for the configuration that proves cloud inference is disabled, and for how that setting is enforced across all hosts. - Model storage: Models are stored in a default directory that
OLLAMA_MODELScan move. Ask where weights are stored, who can write to them and how they are backed up. - Release cadence: Releases are frequent, with v0.40.5 released on 14 October 2026. Ask how the partner pins versions and tests upgrades.
Ask the partner to confirm whether any paid Ollama plan is part of the design and which features the design depends on.
llama.cpp is MIT licensed and runs models in GGUF format on a wide range of hardware, including CPUs, Apple silicon, AMD GPUs through HIP and Vulkan or SYCL backends. It fits branch offices, plants, laptops and mixed hardware, where GPUs are absent or limited. The llama-server component offers OpenAI-compatible routes and its own built-in security options, but those options are opt-in, so the partner's answers should describe the exact server flags they set.
- Built-in controls: llama-server supports API key authentication through
--api-keyor a key file, TLS through PEM files, and an optional Prometheus-compatible metrics endpoint enabled with--metrics. Ask which of these are enabled in your design and how keys are rotated. - Quantization trade-offs: The project lists quantization from 1.5-bit to 8-bit integers. Ask the partner to show quality and response-time tests for each quantization level on your own tasks, rather than quoting general claims.
- Fleet management: Many small nodes multiply the update work. Ask how builds are pinned, how new numbered builds are tested and how a failed node is replaced.
- Build sources: Builds are published continuously, with b11717 on October 18, 2026. Ask how the partner selects a build, verifies its integrity and records what runs on each node.
- Model provenance: Ask where GGUF files come from, how checksums are verified and how license terms for each model are recorded.
Confirm the supported hardware, the server options that will be enabled and the metrics pipeline with the llama.cpp project and the partner.
How do partners size GPUs for our model and concurrency?
Should a partner quote GPU hardware before reviewing our workload?
No. A credible partner asks for workload data first and quotes hardware only after the numbers are agreed in writing. Hardware follows from the model size, context length, concurrency and latency targets, so a quote issued before those are known is a guess. Ask the partner to name the inputs they need: the models you intend to run, the longest prompt plus response you expect, peak and average concurrent users, the response time staff or applications will accept, and the hours the service must be available. Ask for a written sizing worksheet that lists each assumption, so you can change one input and see how the GPU count moves. Ask whether the quote covers only hardware or also the engine configuration, load testing and capacity monitoring that keep the sizing honest after go-live.
How do model size and quantization change the GPU memory we need?
Model weight size and numeric precision set the baseline memory a GPU must hold before any user request arrives. Lower precision reduces that footprint, which is why quantized formats matter. The llama.cpp project supports integer quantization from 1.5-bit to 8-bit to reduce memory use and speed inference, and vLLM and other engines support their own quantized formats. The trade-off is output quality, which varies by model and task, so the partner should test the quantized model against your own evaluation set before accepting it. Ask which precision they propose for each model, what quality test they will run, who approves the result, and whether the sizing changes if you later switch to a different model family or a larger one.
Why does context length and the KV cache matter for capacity?
The KV cache stores the attention state for every token in every active request, so memory use grows with both context length and the number of requests served at once. A model that fits comfortably for one short chat can run out of memory when many users send long documents at the same time. vLLM reports KV cache use through its Prometheus-format metrics, which makes it a good signal for sizing and for alerting. Ask the partner how they will set the maximum context length per model, how many concurrent sequences the KV cache can hold on the proposed hardware, what happens to requests when the cache is full, and which metric will show that condition in production. A partner who cannot answer these questions has not sized the workload.
Which concurrency and latency targets should we set before sizing?
Set concurrency and latency targets as measurable numbers before any hardware discussion. Concurrency is the count of requests in flight at peak, and latency targets usually split into time to first token and total response time, both measured at the peak load you expect. Ask the partner to run a load test against a realistic prompt mix and report the results at your target concurrency, not at a single request. Ask how they will measure throughput, how queueing behaves when demand exceeds capacity, and what limits they will set per user or per application. Engine defaults matter here: Ollama, for example, documents a default of one parallel request per model, so a team that never changes that setting will see queueing long before the GPUs are busy.
Tensor parallelism or pipeline parallelism: which one do we need?
Tensor parallelism splits each layer of a model across several GPUs in the same server, so they work together on every token. Pipeline parallelism places different layers on different GPUs or nodes, so a request passes through them in sequence. In plain terms, tensor parallelism is the choice when the model is too large for one GPU and the GPUs share a fast link inside one machine, while pipeline parallelism is used to span nodes when one server cannot hold the model. vLLM supports tensor parallelism within a node and pipeline parallelism across nodes, and it uses Ray or its own multiprocessing backend for multi-node runs. The vLLM security documentation states that node-to-node communication is insecure by default, so any multi-node design needs an isolated network. Ask the partner which split they propose, why, and how they will test the interconnect.
How much headroom should we plan for peak periods and failures?
Headroom is the capacity held back for peak demand and for the loss of a GPU, server or node. The right amount depends on your peak pattern, your availability targets and how fast a replacement can be brought up, so no single percentage applies to every organization. Ask the partner to model your peak as a separate scenario, to state what capacity remains if one GPU server fails, and to explain whether a failed node degrades latency or stops the service. Ask how spare capacity is paid for, since idle GPUs are the largest recurring cost of a self-hosted service, and how utilization will be reported so you can judge whether the headroom is being used. Request the sizing for both normal and peak conditions, written down.
Why is a single benchmark number a poor basis for GPU sizing?
A single benchmark reports throughput for one model, one prompt length, one batch pattern and one engine version, so it rarely matches your traffic. Real load mixes short and long prompts, streaming and non-streaming calls, and uneven bursts across users. Engines also change between releases: vLLM ships new minor releases about every two weeks, so a number taken on one version may not hold after an upgrade. Ask the partner to show the test conditions behind any figure they cite, including prompt and output lengths, concurrency, engine version and hardware. Ask them to repeat the test on your own prompt traces and to rerun it after each engine upgrade. A sizing that cannot be reproduced on your data should be treated as an estimate, not a commitment.
What should a sizing worksheet include before we sign?
A sizing worksheet should list every input and every output so that your team can check the arithmetic. Inputs include the models and their precision, maximum context length, expected requests per minute at peak, prompt and output token distributions, latency targets, redundancy target and the engine and version to be used. Outputs include the GPU model and count per model, the parallelism layout, the KV cache budget, the expected queueing behavior at peak, and the monitoring signals that will show when capacity is running short. Ask the partner to state which values are measured and which are assumed, and to attach the load test results behind them. The worksheet should be part of the written scope so it can be revised when your workload changes, and it should be revisited whenever a new model or a major engine release is added.
What should capacity monitoring include?
Capacity monitoring is where an in-house model service either stays predictable or surprises its owners at peak load. The cards below cover what the engine exposes, what thresholds should trigger action, how queues behave under pressure, and who acts when something breaks.
Metrics exposure and scraping
The vLLM server exposes Prometheus-format metrics at /metrics, covering request counts, token throughput, latency histograms and KV cache use. Ask the partner which of these are scraped, how histogram buckets are configured for your latency targets, and whether the metrics endpoint sits behind the same access controls as user traffic. A partner who has not planned to protect `/metrics` has left internal load data open to anyone who can reach the port.
Alert thresholds tied to targets
Alerts should fire on the service levels you agreed in the requirements, such as time to first token and queue wait, not on raw CPU or GPU percentages alone. Ask the partner to show the proposed threshold for each alert, the reasoning behind it, and how thresholds are reviewed after the first month of real traffic. Any answer that lists default thresholds without tying them to your latency targets should be treated as a gap.
Queue behavior under load
Ollama limits concurrency through OLLAMA_NUM_PARALLEL, which defaults to 1 parallel request per model, and holds waiting requests in a queue controlled by OLLAMA_MAX_QUEUE, which defaults to 512. Ask how these values were set for your workload, what callers receive when the queue is full, and whether queue depth is monitored. A queue that silently grows until requests time out is the most common cause of user-visible failure.
GPU utilization and memory
Utilization alone does not show whether a model is short of capacity, because memory use and KV cache pressure can limit throughput while compute looks idle. Ask the partner to report GPU compute, GPU memory, and KV cache use together, and to explain how multi-GPU runs using tensor or pipeline parallelism are measured per node. A dashboard that shows only average GPU percentage will hide the moment a model starts evicting cache.
Forecasting and capacity planning
Forecasting turns request growth and token volume into a date when the current hardware will be full, which is what budget holders need. Ask how historical throughput is retained, which growth assumptions are used, and who signs off on hardware orders before a peak period. If the partner cannot name the retention period for capacity data, you cannot prove the forecast was based on real usage.
Dashboards and alert routing
Dashboards should show the same metrics the alerts use, so operators and service owners read one picture during an incident. Ask who receives each alert, how routing differs by severity, what happens outside business hours, and how escalation reaches the people who can add capacity or change model settings. Ask the partner to name the person or on-call rota that receives each alert before the build starts, because an alert with no owner is a log line.
How a good handover of operations works
A good handover moves a running model service from the partner's team to yours in a fixed sequence, with each stage closed by a written check. The end state is an in-house team that can restore, patch, scale and page through the service without the partner in the loop.
Agree handover criteria in writing
Before any work starts, the partner and your team agree in the statement of work what 'accepted' means: the runbooks that must exist, the tests that must pass, the access that must transfer and the support period that follows. Your procurement and security leads sign off on this list. The output is a dated acceptance checklist that names each deliverable and the person who confirms it, so acceptance is a decision you can point to later rather than a feeling that the system is running.
Deliver and review runbooks
The partner writes operating runbooks for the engine, the gateway in front of it, the GPU nodes and the model store. They should cover starting and stopping the server, adding or removing a model, rotating API keys, reading the Prometheus metrics exposed at /metrics, scaling out to another node and rolling back an engine release. Your operators follow each runbook on a non-production copy while the partner watches. The check is that an operator who did not write the runbook completes each procedure without asking the partner a question.
Transfer access and secrets to your team
Administrative accounts, cloud or data center access, container registry credentials, the model repository and the keys that protect endpoints move from the partner's accounts to named accounts in your identity system. Shared logins and partner-held secrets are removed, and the partner's access is revoked on a date you both record. Your security team confirms the access list against the design, and an access review shows that every privileged account has a named owner and an approval record.
Test backup and restore of artifacts
Model weights, engine container images, configuration files, the reverse proxy allowlist and the GPU driver baseline are backed up, then restored into an empty environment. Ask the partner to show which artifacts are covered, where copies are kept and who can read them. The test is a full restore followed by a request to the restored endpoint that returns the expected answer. Record the time the restore took and compare it with the recovery target in your contract. A backup that has never been restored is not evidence of recovery.
Run on-call and failover drills
Your on-call engineers take the pager for an agreed period while the partner stays on a shadow rota. Drills simulate common failures: a GPU node going offline, a bad engine release, a full KV cache under load and an expired API key. Ask the partner to name the alerts that page and the thresholds behind them, drawn from the metrics the engine exposes. The check is a drill log showing that your team detected each fault, followed the runbook and restored service, with the partner's involvement recorded.
Hold knowledge transfer sessions
Recorded working sessions cover the architecture, the reasons behind key configuration choices, the multi-node network design, how model and engine updates are evaluated, and the open risks. Each session produces a short note and a list of questions, and your team owns the answers. Ask the partner to show how the sessions map to the runbooks and the architecture diagram, so gaps are visible. Completion is a signed list of topics with the name of the in-house engineer who has taken ownership of each one.
Accept handover and set the support period
The partner and your team review the acceptance checklist line by line. Items that failed are either fixed and retested or moved to a written remediation list with an owner. Any ongoing support, upgrade or testing service is then set out in a separate written agreement, since those are usually retainers rather than part of the fixed-scope build. The output is a signed handover record, the final versions of the runbooks and a named contact for issues raised after acceptance.
What log retention the EU AI Act asks for
Ask every partner how request and event logs are recorded, where they are stored, who can read them and how long they are kept. The EU AI Act sets two relevant baselines. Article 12(1) requires high-risk AI systems to technically allow for the automatic recording of events (logs) over the lifetime of the system, so logging must be built into the serving stack rather than added later. Article 19(1) requires providers to keep those logs for at least six months unless other law provides otherwise. The EU AI Act Article 12 Record-keeping text and the EU AI Act Article 19 Automatically generated logs text are the primary reads for your legal team.
Translate those obligations into concrete design questions for the inference layer. vLLM's /metrics endpoint gives aggregate counts and latency, but it does not record who asked what, so a partner should explain which component writes per-request records, such as the gateway in front of the engine or application logging, and whether prompts and outputs are stored. Ask which fields are captured (caller identity, model and version, timestamp, token counts), how records are protected from alteration, where they live in your own storage, and how deletion of personal data is reconciled with the six-month minimum. Confirm with your counsel which retention period applies to your case, because other law may require longer or shorter periods.
Whether the regulation applies at all depends on your role (provider, deployer or neither) and on your use case, and DeployOpen does not make that determination. DeployOpen can design and document the logging controls, configure retention and prepare evidence for your assessment, but it does not issue audit reports, attestations or certifications, and independent auditors or the relevant authorities decide conformity. Ask partners to put log schemas, retention settings and access rights in writing before build starts.
Answers that should worry you
Partners rarely lie outright. They give short, confident answers that skip the parts of an inference service that fail in production: the endpoints the engine leaves open, the upgrade path, the artifacts nobody backed up and the person paged at 2 a.m. Each card below names one such answer and the follow-up question that exposes it.
Exposing metrics or admin routes directly
If a partner plans to publish the engine's port as-is, ask why. vLLM serves /metrics, /health and several control routes alongside the OpenAI-style API, and some of those routes are not covered by its API key option. Ask which routes sit behind a reverse proxy, which paths the proxy allowlists for users, and how requests to anything else are denied and logged.
The API key protects everything
A partner who says a single --api-key secures the service has not read the engine's security guidance. The key covers the /v1 family but not every operational endpoint, and the vendor advises against relying on it alone. Ask for a written endpoint inventory showing which paths are authenticated, which are blocked at the proxy, and who can reach the management interface from the user network.
Unpinned engine upgrades
Inference engines change quickly. vLLM shipped minor releases about every two weeks through 2026, and Ollama and llama.cpp publish even more often. A partner who says they will just keep current, or who cannot name the version in production, has no test gate. Ask how versions are pinned, which regression suite runs before promotion, how a rollback is executed, and who approves each change.
No backup of model artifacts
Weights, quantized GGUF files, tokenizer and chat template files, and container images are the inputs to the service, and they may be large and hard to reproduce if a source changes. Ask where the artifacts are stored, how their checksums are recorded, whether the serving configuration is version-controlled, and how long a restore takes in a test. A partner who answers only with the vendor's download URL has no recovery plan.
GPU quotes without workload questions
A hardware list with no questions about the workload is a sales estimate, not a sizing exercise. Sizing depends on the models, context lengths, concurrent users, latency targets and peak periods, and vLLM and Ollama each handle concurrency differently. Ask what workload profile produced the number, which parameters were measured in a load test, and what headroom is held for peaks and failover.
No named owner for on-call
Someone must be responsible when GPU memory fills, a model fails to load or the queue backs up. Ask who answers the page at night, what the escalation path to the engine maintainers or hardware vendor is, and whether the partner's support covers the inference layer, the proxy and the GPU nodes. If the answer is a shared mailbox or a best-effort response, the service is not yet operated.
Certification or audit claims
A partner who says the platform is certified, or that its audit report will cover your service, is making a claim DeployOpen does not make for itself. DeployOpen prepares systems, controls and evidence for assessments, but independent auditors and certification bodies issue the reports. Ask which evidence the partner will produce, which control owners they will name, and which assessor has reviewed the design.
Vague uptime commitments
Statements such as high availability or enterprise-grade uptime mean little without measurement. Ask for the numeric availability target in writing, how it is measured, what is excluded, what happens during engine upgrades and GPU failures, and what service credits or remedies apply. Confirm that these terms appear in the signed scope rather than in a slide.
How to score partner responses
This table compares partner answers across six areas that decide whether an in-house model service holds up in production. Set the weights to match your risk profile before reading any response, then score each answer as full, partial or missing. Any missing answer in endpoint security or handover should weigh heavily, whatever the total score.
| Criterion | Full answer | Partial answer | Missing answer |
|---|---|---|---|
| Sizing method | Partner ties GPU count and memory to named models, context lengths, concurrency and latency targets, and shows the calculation and assumptions | Partner quotes hardware from a rule of thumb or a single benchmark without your load profile | Partner names a GPU model without explaining how it was chosen |
| Endpoint security | Partner places a reverse proxy in front of the engine that allowlists only user-facing routes, adds authentication, and blocks /metrics, /health and control endpoints from users | Partner relies on the engine's --api-key option alone, or covers /v1 routes but not admin and metrics routes | Partner exposes the engine port directly or says the engine's built-in options are sufficient |
| Upgrade process | Partner describes a tested cadence for engine and model updates, a staging environment, pinned versions, rollback steps and how changes are recorded | Partner upgrades on request or on a fixed schedule without staging or rollback tests | Partner has no plan for engine releases that arrive every few weeks, or upgrades only after a failure |
| Monitoring | Partner collects engine metrics such as request counts, token throughput, latency and KV cache use, alerts on capacity thresholds and reviews them in a named runbook | Partner monitors host health and GPU status only, without engine-level request or latency signals | Partner offers no capacity monitoring, or proposes to add it after go-live |
| Handover | Partner delivers architecture, configuration, runbooks, access records, model and artifact inventory, and a tested transfer of operations to your team | Partner provides documentation after the build with limited shadowing of your staff | Partner's handover is a meeting at project close with no runbooks or named ownership |
| Compliance evidence | Partner maps each control to a named artifact such as access logs, change records, backups and model inventory, and states which evidence your auditor will need from you | Partner offers general statements about security and logging without naming the records produced | Partner says compliance is the buyer's responsibility and offers no evidence list |
How to turn answers into a fixed-scope agreement
Treat every answer a partner gives in this RFP as a candidate for the written scope, not as a verbal promise. Before work starts, convert the answers into three things: a scope statement that names the engine, the hardware, the models and the endpoints in the project, a deliverables list with an owner for each item, and acceptance tests that can be run on your own network. Examples of tests worth writing down include a check that /metrics and /health are unreachable from the user network, a check that the --api-key setting is paired with a reverse proxy allowlist, and a load test at the concurrency level you agreed. Most engagements are fixed-scope, so the agreement should say which of these tests counts as acceptance and who signs off on the results.
Ask for a quote that follows from that written scope and that lists its parts separately: hardware procurement or rental if it is in scope, installation and configuration, the security hardening and endpoint testing, the monitoring and alerting setup, the handover and documentation, and any post-handover support. Separate one-time work from recurring work. Engine upgrades, model swaps, capacity reviews and on-call coverage usually recur, and the quote should state whether they sit under a retainer, under a separate change request or outside the agreement. DeployOpen does not publish a price list, so the quote is the only reliable price source. Ask for the assumptions behind it, including who supplies GPUs, network segments and staff access, because a missing dependency is the most common reason a fixed scope changes.
Before signing, confirm the timelines are tied to named milestones and to the acceptance tests, not to calendar dates alone, and confirm the support terms in writing: response expectations, who receives vendor release notices for vLLM or Ollama, and what happens when a security fix ships during an active engagement. If a partner cannot name the acceptance tests or refuses to put the support terms in the agreement, treat that as a finding about the partner rather than a detail to negotiate later.
How DeployOpen scopes, delivers and supports inference platforms
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks. For an in-house model service, that means a written scope covering the engine, GPUs, endpoint security, monitoring and operating procedures before any hardware is configured.
How we scope
- Engagements are fixed-scope, with models, engines, GPU hardware and user groups agreed in writing before work starts.
- We record which endpoints users may reach and which engine routes stay private, such as /metrics and /health.
- The written scope names who owns model weight transfers, engine upgrades and capacity reviews after handover.
How we build
- We configure the chosen engine, such as vLLM, Ollama or llama.cpp, with an OpenAI-compatible endpoint behind a reverse proxy allowlist.
- We secure inter-node traffic in multi-node deployments by isolating nodes on a private network and testing the result.
- We wire Prometheus-format metrics into the client's monitoring stack and test alert thresholds against load.
How we hand over
- We document model storage paths, concurrency settings, upgrade steps and rollback procedures for the client's operators.
- We keep the build reproducible so the client can verify model and container images before they are loaded.
- We train the operations team on routine tasks such as engine version changes, capacity checks and log retention.
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers, scoped in writing.
- We review engine release notes and propose upgrades on a schedule agreed with the client's change process.
- We prepare the configuration, access and monitoring evidence that the client's auditors or assessors may request.

