How to run a document management system RFP with open-source platforms
To run a fair evaluation, fix the requirements and the written scope first, then put the same question set to every bidder and judge the answers against worked examples rather than marketing claims. Because Paperless-ngx and Alfresco Community Edition are different products with different strengths, the requirements document must state which capture, permission, retention and audit outcomes you need before any partner is shortlisted. Without that baseline, bidders will quote against their preferred platform and the comparison becomes meaningless.
Ask every bidder for the same written scope: the systems in scope, the data volumes and back-file sources, the integrations, the handover documents and the acceptance tests. Include the same questions on migration of existing archives, OCR accuracy testing on a sample of your own scans, permission design for departments and roles, retention rules and disposal, encryption around stored files, and the upgrade path for the platform and its database. Ask each bidder to explain how it would handle a named sample, such as a folder of mixed-quality scans or a retention schedule with conflicting rules, and to show the test results, configuration exports or sample handover pack it would produce. Fixed-scope proposals are easier to compare than open-ended day rates, so ask for deliverables and timelines in writing.
DeployOpen is a Chainscore Labs company and is one of the parties you may ask to bid. Treat that the same as any other bidder: request a written scope, ask for worked examples, and check references and evidence yourself. Expect every partner to say it can meet your needs, so weigh the specific answers most heavily. Confirm version-specific details, such as supported database engines, container images and upgrade steps, with the platform vendor and in your own environment before you sign.
What to settle before you send the RFP
Four inputs decide which answers to expect from a partner. Document classes and volumes set the migration and OCR questions, regulatory drivers set retention and audit questions, hosting constraints set encryption and upgrade questions, and the records owner decides who signs off on permissions and disposal.
Document classes and volumes
List the document types you need to hold, such as scanned referrals, invoices, contracts, policies or case files, and estimate how many pages and files each class produces per year. Mixed born-digital and scanned content needs different OCR and ingestion answers than a bulk back-file archive. Ask partners how they would size storage, test OCR accuracy on a sample of your real documents, and handle handwriting, poor scans and multi-language content. Confirm whether any class needs PDF/A output.
Legal and regulatory drivers
Identify which laws, regulators and contracts set your retention periods, audit trail expectations and access rules. A broker-dealer, a hospital and a municipality will receive different answers on immutability, audit logging and disposal. Ask the partner which of these requirements the chosen platform can meet directly and which need an archive product, process control or legal review. A regulator-facing claim should be confirmed with counsel or your compliance team before it appears in a contract.
Hosting and storage constraints
Record where documents may be stored, which data centers or countries are allowed, whether the system must run air-gapped and which encryption keys you control. These limits change the deployment model, the backup target and how updates reach the system. Ask partners how they would handle encryption at rest, since Paperless-ngx does not provide it on its own, and how they would plan upgrades across major versions of the platform you select.
Named internal records owner
Name one accountable person who approves retention schedules, access reviews, legal holds and disposal. Without this owner, permission design and retention rules tend to be configured by the implementer and never validated by the business. Ask the partner how they will document decisions, who signs off on the permission model and how handover will transfer that ownership to your team after go-live.
Requirements checklist as next step
Once these four inputs are written down, work through the full set of requirements covering capture, metadata, permissions, retention, audit trail, editing, encryption, backup and support. Use that list to turn each answer into a scored RFP question so that partners respond against the same criteria. Keep the checklist short enough that vendors can answer every line in writing.
Which questions to ask about migration, OCR, permissions and retention
How should we test a partner's plan to migrate our existing document archive?
Ask for a written migration plan that covers source inventory, mapping of existing folders and metadata to the target system, a sample migration of a representative set, and reconciliation reports that show counts, checksums and exceptions. Ask which source systems the partner has moved before and how duplicates, broken file names, and documents with missing metadata are handled. Confirm whether original files are kept unchanged alongside any converted copies, and who signs off the reconciliation. Migration effort rises with the number of source systems, the state of existing metadata, and the volume of files that need manual review. Ask for a quote that separates discovery, pilot migration, full migration, and post-migration verification, since each is priced and staffed differently.
What OCR accuracy testing should a document management partner perform?
The partner should test OCR on a sample drawn from your own archive, not on clean vendor examples. Ask for a test plan that includes poor scans, skewed pages, handwriting, stamps, multilingual text, and low-resolution faxes, with a defined method for measuring character and word accuracy and a sign-off threshold agreed in writing. Paperless-ngx uses Tesseract for OCR, so ask which Tesseract version and language packs will be installed and confirm them with the vendor and partner before testing. Ask how the partner will handle documents that fail the threshold, such as manual review queues or rescanning. Expect the testing effort to scale with the number of document types and languages.
How should permissions be designed in a self-hosted document system?
Ask for a written permission matrix before configuration starts. It should list roles, document types or tags, the actions each role may take (view, edit, delete, share, export), and which group or directory identity grants each right. Confirm how the partner will map users to unique accounts, how group membership is synchronized from your identity provider, and how access reviews are scheduled and evidenced. Ask how the platform handles inherited permissions, owner changes when staff leave, and documents that must be restricted to a small set of people. Check whether the platform's permission model supports the separation you need, and confirm any Alfresco edition or feature details in writing before relying on them.
How does a partner enforce and evidence retention and disposal rules?
A good answer explains how each retention schedule is turned into a configured rule, who approves it, and how the system prevents early deletion or unapproved disposal. Ask how disposal is logged, whether legal holds can be applied, and how the partner produces evidence that a rule ran as designed. Ask which retention rules come from your legal or regulatory obligations and which are your internal policy. Ask the partner to state clearly that retention obligations sit with your organization and that a compliant archive may need a separate arrangement for some regulated records. Ask for a quote that covers rule configuration, testing of disposal, and documentation of the schedule.
Is encryption at rest available in Paperless-ngx, and how do partners handle it?
Paperless-ngx stores documents without built-in encryption at rest, so the stored files and database contents are clear text on disk unless the layer beneath the application provides encryption. Ask the partner which storage encryption they will use, such as full-disk or volume encryption on the host or encrypted storage in your cloud account, and how encryption keys are generated, stored, rotated and recovered. Confirm how backups are encrypted, who holds the keys, and how access to the host operating system is restricted. Also ask how data in transit between browsers, scanners and the application is protected, including certificate management. Require the partner to document where clear text exists and which controls cover it.
What should an upgrade path for a self-hosted document system include?
Ask for a written upgrade procedure that covers version pinning, staging environment testing, backup and restore verification before each change, and rollback steps. Ask how the partner tracks upstream releases and security advisories for the chosen platform, and how long a given release line is supported. Confirm whether the procedure covers plugins, custom scripts, database migrations and OCR language packs. For Alfresco, confirm which edition and release line you are on and what its support terms cover, in writing. Ask whether upgrades are included in a retainer or quoted separately, since recurring upgrade effort depends on how much customization the system carries.
Which handover documents should we expect from a document management implementation?
Ask for a handover package that you own and can use without the partner. It should include architecture diagrams, configuration exports, the permission matrix, retention schedules, backup and restore runbooks, OCR and ingestion settings, the upgrade procedure, and a list of administrator accounts and secrets locations, stored in your own systems. Ask for a tested restore demonstration and a list of open issues. Confirm who keeps the source code for any customization and under which license. Ask the partner to name which documents they produce and which you must maintain after go-live, and whether a support retainer covers updates to those documents.
How questions change between Paperless-ngx and Alfresco
Paperless-ngx is built around a single application that ingests documents, runs OCR, applies tags and correspondents, and makes everything searchable. Your questions should focus on how well that pipeline handles your real inputs, and on what the application does not do on its own, such as encryption at rest and fine-grained records controls. Ask the partner to show how each ingestion path behaves with your documents before you commit to the design.
- OCR accuracy: Ask for a test run on a sample of your scans, including skewed, low-contrast and handwritten-annotated pages, with the Tesseract language packs you need installed and recorded in the configuration.
- Ingestion paths: Confirm how folder watching and email ingestion handle duplicates, failed files and rejected attachments, and where the logs for each are kept.
- Tagging and classification: Ask how automatic matching rules are tested and who approves changes to them, since rule drift quietly changes search results.
- PDF/A output: Request evidence that archived files are produced as PDF/A and a check that originals are retained alongside the converted copies.
- Encryption and storage: Ask how the partner addresses storage that the application keeps in clear text, and request the architecture decision for disk or volume encryption.
Check that the partner's evidence covers your document mix, not a demo set, and that each answer names the configuration file or setting that enforces it.
Alfresco Community Edition is a content repository, so questions shift toward the data model, workflows, permissions inheritance and records management features. Because edition limits and supported capabilities differ across Alfresco offerings, confirm in writing which features the Community Edition provides and which require a commercial subscription. Ask the partner to map your retention and approval processes onto those features before designing anything around them.
- Edition and feature scope: Ask the partner to list every capability your requirements depend on and confirm, with the vendor documentation, whether each is in the Community Edition.
- Content model and metadata: Request the content model design, showing custom types, mandatory properties and how metadata is validated at upload.
- Workflow design: Ask for the approval workflows as built, with the owners of each step, escalation paths and how workflow history is retained.
- Permission design: Request the permission model, including inheritance breaks, group structure, and a test showing that a user without rights cannot see a document through search or preview.
- Upgrade and customization path: Ask how custom extensions are versioned, tested against new releases and documented so the next upgrade does not depend on one engineer.
Check that every requirement is traced to a named feature, a configuration item or a custom extension, and that the partner states the support route for each one.
Evidence separates a credible answer from a verbal assurance, and the evidence differs by platform. For Paperless-ngx, the most useful artifacts are OCR test results, configuration exports and ingestion logs. For Alfresco, they are the content model, workflow definitions and permission test results. Both platforms need the same operational evidence, including backup restore records and an upgrade rehearsal, so request those for each option you shortlist.
- Test results: OCR accuracy samples, search result checks and permission test scripts with dated outputs.
- Configuration exports: Settings, rules, content models or workflow definitions stored in version control.
- Restore evidence: A dated restore test that brings back documents, metadata, tags or workflow state.
- Upgrade records: A rehearsal on a copy of production, with the rollback steps and any custom components affected.
- Access records: Samples of audit or access logs showing who viewed, changed or deleted a document.
Before signing, confirm which evidence the partner will hand over at handover and whether the audit logs your compliance team needs are produced by the platform or by a separate component you must also build and operate.
Why a written answer is not enough: testing claims before you award
Ask each partner to prove its OCR, permission and restore claims on your own documents before you award the contract. A written answer that says Paperless-ngx or Alfresco Community Edition will handle your archive tells you what the vendor believes, not what your scans will produce. Build a short proof set from real material you are willing to share in a test environment, then run the same set against every shortlisted partner so the results can be compared directly. Agree in writing who prepares the environment, who runs the tests, and who keeps the sample files after the evaluation ends, since some of these documents may contain personal or regulated data.
Design the proof set to include the pages that will actually cause trouble in production. Include clean typed letters, multi-page scans with mixed orientation, faint photocopies, skewed or cropped pages, fax-style noise, stamps across text, and any handwritten annotations you rely on. Add a few files with the wrong language or unusual character sets if your archive contains them. For each file, record the expected metadata, the tags and correspondent a reviewer should see, and the search term that must return it. Score the OCR output against a reviewed transcript of each page, and note which failures are tolerable for search and which would break a downstream process such as a retention lookup. Ask the partner to state which OCR engine and language packs it used, since Paperless-ngx relies on Tesseract and the result depends on those settings.
Test permissions and restores with the same discipline. Create test users in each role you plan to use, then confirm that a user without access cannot see a document through search, previews, thumbnails, or the API, and that a retention or deletion action behaves as the schedule specifies. Then run a full restore from backup into a clean instance and check that documents, metadata, and users come back intact. Record every result in a simple log with the test ID, the expected outcome, the observed outcome, the person who checked it, and the date. Confirm with the partner which items they will fix before go-live and which they will document as known limitations, because a failed restore test that is only described in a report will surface again during an incident.
How to score partner responses
This table lists the scoring criteria for partner answers on a Paperless-ngx or Alfresco RFP, with qualitative weight guidance, what a full-marks answer looks like and the evidence to request. Set your own numeric weights, then score each response against the evidence column, not the sales narrative.
| Criterion | Weight guidance | Full marks look like | Evidence to request |
|---|---|---|---|
| Migration of existing archives | High for organizations with a back archive | A written method for inventory, deduplication, metadata mapping and reconciliation, with a sample-based validation plan and named rollback steps | A migration plan from a comparable scope, a sample mapping sheet, and the reconciliation report template the partner would use |
| OCR accuracy testing | High where scanned text drives search or classification | A test corpus drawn from your own documents, measured accuracy by document type and language, and a stated threshold for manual review | Test results on a sample you supply, the OCR engine and language packs used, and the QA sampling procedure |
| Permission design | High in every regulated setting | A role model mapped to your org chart, group-based access, documented inheritance rules, and an access review process that owners can run | Draft permission matrix, sample access review report, and how permissions are tested after each change |
| Retention and disposal rules | High where records have statutory periods | Retention schedules configured per document type, legal hold handling, and disposal logs that show what was removed, when and by whom | Retention schedule configuration export, a disposal test run, and the approval workflow for destruction |
| Encryption around storage | High, since Paperless-ngx does not encrypt stored files itself | A documented layer for encryption at rest, key custody, backup encryption and transport encryption, with the responsibility split stated | Architecture diagram of encryption layers, key management procedure, and the test showing encrypted backups restore |
| Upgrade path | High for supported platforms with frequent releases | A tested upgrade procedure with pre-upgrade backup, a staging environment, a plugin and integration compatibility check, and a rollback plan | Two past upgrade runbooks, the staging test report format, and the versions the partner will support over the contract term |
| Handover documentation | Medium to high, since it determines who can run the system later | Runbooks, configuration as code, admin and user guides, a list of customizations, and a knowledge transfer plan with named sessions | Sample handover pack, a table of contents for runbooks, and the handover acceptance criteria |
| Support model | Medium, weighted higher for systems used around the clock | Defined severity levels, response targets written into the contract, named escalation path, and clear split between partner and in-house duties | Written support terms, sample incident report, and confirmation of hours and coverage in the signed scope |
Answers that should worry you
A partner's answer to an RFP question tells you as much as the answer itself. The red flags below are the replies that suggest a partner has not built the part of the system you are buying, or will leave you to discover the gap after go-live. For each one, the follow-up question is designed to make the partner show a test, a document or a working procedure.
OCR accuracy claims without a test plan
A partner who says OCR is "highly accurate" without naming a test set has not measured it on your documents. Scan quality, skew, handwriting, stamps and mixed languages change results far more than the engine name does. Ask for a sample of your own scanned pages, the accuracy measure they will use, the pass threshold, and who signs off the result before bulk import begins. Paperless-ngx uses Tesseract for OCR, so ask how language packs and output settings are chosen and tested.
Promised certification or audit outcomes
DeployOpen and most reputable implementers prepare systems, controls and evidence for an assessment, but they do not issue audit reports, attestations or certifications. A partner who guarantees a passed audit, a certified archive or regulator acceptance is either overstating its role or planning to make claims it cannot support. Ask which controls the partner will configure, which evidence they will hand over, and who at your organization owns the assessment decision.
No written permission matrix
If a partner cannot produce a role-by-folder-and-tag permission matrix before build, access will be set by whoever is convenient at the time. Document management systems often inherit broad group access from ingestion folders or default owners, which exposes records to staff who should not see them. Ask for the matrix, who approves each role, how group membership maps to your directory, and how access reviews are run and recorded.
No retention enforcement method
Retention schedules that exist only in a policy document are not enforced by the software. A partner should explain how retention periods are attached to documents, what triggers disposal, whether deletion is blocked during a legal hold, and how disposal is logged. Ask them to demonstrate a test document moving through its full lifecycle, and to say which parts are handled by the platform and which need a manual step or a separate archive.
No plan for encryption and key management
Storage encryption is often treated as a checkbox, yet the answer depends on the layer: disk, volume, database, object storage or application. Paperless-ngx does not provide encryption at rest on its own, so the partner must explain how the storage layer is encrypted, where keys live, who can rotate them, and how backups stay protected. Ask for the key custody design, the rotation procedure, and the recovery steps if a key is lost.
Handover limited to a login
A partner that hands over only administrator credentials leaves you dependent on them for every change. Handover should include the deployment code and configuration under version control, runbooks for backup, restore and upgrade, a tested rollback path, and operator training. Ask for a written handover list, the upgrade and rollback procedure with its test record, and what the partner's support covers after acceptance. Upgrade paths matter here: Nextcloud, for example, requires one major version at a time, so ask how the partner will sequence any such upgrades.
What does a document management implementation cost and how much work does it need from us?
Cost for a self-hosted document management system is driven less by the software license and more by the work around it. Paperless-ngx and Alfresco Community Edition are open source, so the recurring spend you will see on a quote is usually infrastructure, storage growth, support and the people who run the system. The largest one-time items are normally the migration of the existing archive, back-file scanning or conversion, integration work and the permission and retention design. Before you ask for a number, fix the inputs that move it: the number of documents and pages, how messy the current folder structure and metadata are, how many source systems feed the archive, whether mail or scanners must be ingested automatically, and where the hosting will sit. Ask each bidder to price these components separately so you can see which ones your team could take on.
Ask every bidder to split the quote into one-time and recurring lines and to name who is paid for each. One-time work typically covers discovery, architecture, installation, configuration, OCR tuning, migration scripts, test cases, handover documentation and training. Recurring costs typically cover hosting, backups, monitoring, patching, platform upgrades and the support retainer, plus any commercial support subscription if you choose an edition that includes one. Ask whether the partner will hold the upgrade path for Alfresco Community Edition or Paperless-ngx, how many hours of support are included, and what happens to scope if the document volume is larger than the estimate. A quote that cannot separate these lines is not yet comparable with another quote.
How DeployOpen scopes, delivers and supports document management evaluations
DeployOpen plans, implements, customizes, integrates, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For document management RFPs, we turn your answers to these questions into a written scope before any build work starts.
How we scope
- Written scope covers which archives migrate, which sources feed capture, and which document classes are in the first phase.
- We test your permission model against real roles and groups before agreeing the access design in the scope.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work begins.
- Ask us to state which OCR accuracy tests, retention rules and encryption controls are included or excluded.
How we build
- Implementation covers Paperless-ngx or Alfresco Community Edition inside your infrastructure, including storage, database and backup configuration.
- OCR accuracy is tested on a sample set you provide, with results recorded against the agreed acceptance criteria.
- Migration runs in stages with reconciliation reports that compare record counts, metadata and file integrity against the source archive.
- Security testing of the application and its APIs can be included in the scope before go-live.
How we hand over
- Handover documentation covers architecture, permission design, retention configuration, backup and restore steps, and upgrade procedures.
- Runbooks describe how to add users, change retention classes and verify integrity checks without vendor help.
- We prepare configuration and evidence for compliance assessments, but independent auditors and certification bodies issue any opinion.
- Ask for a walkthrough of the handover pack and a restore test performed by your own staff before acceptance.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Upgrade planning follows the vendor's release notes and tested rollback steps in your staging environment first.
- Security testing of applications, APIs and infrastructure can be repeated on a schedule agreed in the retainer.
- Confirm response expectations, maintenance windows and escalation paths in the written support terms before signing.
