File sharing RFP questions

A good partner sizes from inputs you can verify: named user counts, average and peak file sizes, expected growth, version retention, trash bin retention and the number of concurrent sync clients. Ask them to show how they convert those inputs into object or block storage capacity, with headroom for versions and backups kept outside the sync path. For the database, ask which engine they recommend for Nextcloud 35 and why. The system requirements recommend MariaDB 11.8 or PostgreSQL 18, support MariaDB 10.11 to 12.3, PostgreSQL 14 to 18 and MySQL 8.4 or 9.7, and list PHP 8.5 with 8.3 and 8.4 also supported. Confirm that they will not use Oracle Database unless you hold an enterprise subscription, and ask how they plan database connection limits, backups and performance testing before cutover.

Ask the partner to describe each tier separately: the load balancer, the Nextcloud application nodes, shared file storage, the database, the cache and the background job handling. Expect them to name the components explicitly, including how sessions and file locking are shared between nodes and where the data directory lives. Ask whether clustered instance support is included in the support tier you are buying, because the Nextcloud pricing page ties clustered instance support to the Premium tier and above. Request a written failover test plan, the recovery time and recovery point they will test against, and evidence from a previous clustered build. If they propose Nextcloud All-in-One, ask how it fits a clustered design, since it is documented as a single-instance installation method with a Helm chart for Kubernetes.

A good answer starts with an inventory of sources (Google Drive, OneDrive, SMB shares), a permissions map, and a decision on what to migrate, what to mount as external storage and what to archive. Ask how they preserve group membership and folder rights, how they handle shared links and file owners who have left, and how they validate counts, sizes and checksums after each batch. Ask whether they phase users onto sync clients, how they run a pilot group first, and how they handle files that exceed the size limits of the migration tool. Request a rollback plan for each wave. For Windows shares, ask whether they will use Nextcloud external storage or the Enterprise Windows Network Drive feature, and what they will confirm in writing about permissions that do not map cleanly.

Ask the partner to list every external sharing control they will configure and where each one lives: whether guest accounts are allowed, whether link shares require passwords, whether links can expire, whether resharing is blocked and which domains or groups may share outside the company. Ask how access rules restrict downloads from untrusted networks and how files are scanned for malware on upload, with ClamAV named if they plan to use it. Request the audit log settings and retention they will apply, and ask how logs are exported to your SIEM. Compliance teams often ask for this evidence, and the HIPAA Security Rule at 45 CFR 164.312(b) requires audit controls that record and examine activity in systems containing ePHI, so ask how the partner will document that requirement for your scope.

Nextcloud does not allow skipping major releases, so a partner must plan a sequence of single-major-version upgrades, each preceded by a verified backup. Ask for the upgrade calendar they will use against the published schedule, which lists Nextcloud 35 with end of life in September 2027, Nextcloud 34 supported until June 2027, Nextcloud 33 until February 2027 and Nextcloud 36 scheduled for 17 February 2027. Ask how they disable third-party apps before each upgrade, test them in a staging copy, and re-enable only confirmed-compatible apps. Ask who performs each upgrade, how long each one blocks users, and what rollback looks like if a step fails. Request these steps as a written runbook you keep.

Ask the partner to separate three things: the software subscription, the vendor support, and the partner's own support for your environment. For Nextcloud Enterprise, the pricing page lists Standard, Premium and Ultimate tiers with a 100-user minimum. Standard includes 1-year maintenance, Premium adds a maintenance lifecycle of 5 or more years, extended support hours and clustered instance support, and Ultimate adds support up to 24/7 with response times down to 1 hour. Ask which tier they recommend for your user count and clustering needs, who answers the phone, what the escalation path is, and whether the partner will commit in writing to response targets. Request the published lifecycle dates for the version you will run, and confirm which costs recur each year and which are one-time.

The answer depends on how much of the platform your team already runs and how much the partner transfers during the engagement. Ask for a list of deliverables that a fixed-scope engagement would include, such as installation, configuration, hardening, backup and restore testing, documentation and handover sessions, and confirm each one in writing before work starts. Ask whether the partner offers ongoing support, upgrades and testing as a retainer, and what that retainer covers during a major version change. Ask what skills your staff need for database administration, Linux, object storage and identity integration, and whether the partner will train them against your own environment rather than a demo system.