Enterprise RFP Criteria for Proxy Services: A Buyer's Checklist

An enterprise Request for Proposal for proxy services is a different document from a typical SaaS RFP. The workloads are unusual (high bandwidth, variable, often adversarial), the compliance posture matters more than feature checklists, and legal indemnification is frequently the deciding factor rather than price. This article is a checklist of the criteria that appear in well-written proxy RFPs and the reasoning behind each one. It is written from the buyer's perspective; vendors can use it in reverse as a readiness list.

Section 1: Service Level Agreements

Uptime commitment

The difference between 99.9% and 99.99% annual uptime is 43 minutes versus 4.3 minutes of acceptable downtime per month. For most scraping workloads, 99.9% is sufficient; for any workload feeding real-time pricing or fraud decisions, 99.99% is the minimum. The RFP should ask:

• What is the uptime commitment and what is the measurement window?
• What is the definition of "up"? (API reachability vs successful request delivery vs specific target reachability.)
• How are downtime minutes measured and reported?
• What are the service credits for missed SLA?

Success rate commitment

Uptime is distinct from success rate. A proxy network can be 100% available and still fail 40% of requests because the target blocked the IPs. A serious RFP asks for a success rate commitment against specific targets or categories of targets, not a generic availability number. Common formats:

• "≥ 95% success rate against the Alexa top 500 e-commerce domains, measured hourly, excluding targets that explicitly block the vendor by ASN."
• "≥ 98% 200-response rate against customer-specified target list, measured by the customer and disputed within 5 business days."

Support response times

Tiered by severity. Severity 1 (full outage) should be a 15-30 minute first-response commitment with continuous updates until resolved. Severity 2 (degraded service) 1-2 hours. Severity 3 (configuration or feature question) 4-8 business hours. The RFP should ask for mean time to first response and mean time to resolution, measured separately.

Section 2: Compliance and Security Certifications

The minimum certification bar for an enterprise proxy vendor in 2026:

• SOC 2 Type II covering Security, Availability, and Confidentiality criteria, with a report period ending within the past 12 months.
• ISO/IEC 27001:2022 certification from an accredited body. ISO 27017 and 27018 are bonuses for cloud-intensive buyers.
• GDPR readiness with a published DPA referencing SCCs (2021/914) for EU-scope data.
• HIPAA BAA availability if the buyer is in healthcare, even if the data being scraped is not PHI; the BAA covers the edge case where PHI appears incidentally.
• PCI DSS scope consideration if payment-adjacent data is involved.

The RFP should request the actual reports under NDA, not summary letters. Summary letters are worth nothing; the full report shows scope, exceptions, and subservice organization disclosures.

Section 3: Legal Indemnification

This is where proxy RFPs diverge most sharply from generic SaaS RFPs. Enterprise buyers want indemnification against:

1. IP infringement claims: Standard SaaS indemnification language covering claims that the vendor's service infringes third-party IP rights.
2. Breach of vendor representations: Including representations about IP sourcing, network provenance, and compliance with acceptable use policies by the vendor's own operations.
3. Data protection claims: Indemnification against regulatory claims arising from the vendor's handling of customer data under the DPA.

Proxy vendors typically exclude indemnification for claims arising from the customer's specific use of the service, which is reasonable because the vendor cannot control what the customer scrapes. A good RFP distinguishes between vendor-side indemnification (mandatory) and customer-side indemnification (mutual, carefully scoped).

Liability caps should be negotiated. The default for SaaS is 12 months of fees; enterprise buyers with significant scraping operations often push to 24 months or uncapped for specific categories (data protection breaches, willful misconduct). Insurance certificates with the customer named as additional insured are common.

Section 4: Data Residency

For EU-scope and financial services buyers, the question of where traffic is processed and where metadata is stored is increasingly material. The RFP should ask:

• Where are the control-plane systems (API gateways, billing, authentication) hosted?
• Where are logs and traffic metadata retained?
• What transfer mechanisms apply to international data flows? (SCCs, adequacy decisions, derogations.)
• Can the vendor commit to EU-only processing for EU customers?
• Can the vendor support US-only processing for US federal customers subject to ITAR or CJIS?

The answers should be specific. "We operate globally" is not an acceptable answer. A vendor with multi-region control plane isolation will have documented architecture; a vendor without it will deflect.

Section 5: Network and Infrastructure Transparency

Proxy-specific questions that most generic RFPs miss:

• IP ownership and provenance: Are the IPs owned outright (with LOAs on file), sublicensed from ISPs, sourced from consent-based SDK networks, or resold from another wholesale network?
• ASN diversity: Across how many distinct ASNs does the network span? What is the distribution of IPs per ASN?
• Geographic coverage: Not just a list of countries, but a count of usable IPs in each country, updated quarterly.
• Pool refresh rate: How often does the usable IP pool turn over? A network that replaces IPs rapidly has better long-term health; a static pool burns out faster.
• Abuse handling: What is the vendor's documented process and SLA for responding to abuse reports from IP space owners? A vendor that cannot describe this process is hiding something.
• Transparency on reselling: If the vendor resells another network's capacity, that should be disclosed up front, not discovered during a support incident.

Section 6: Financial Viability

Enterprise buyers want to know they are not signing with a company that will run out of runway. The RFP should request:

• Years in business and corporate history.
• Number of employees.
• Customer count and revenue range (NDA-protected).
• Banking and reference letters.
• Proof of insurance (cyber liability $5-25M depending on deal size; general liability $1-5M; E&O coverage).

Section 7: Commercial Terms

• Pricing model transparency: Per GB, per IP per month, per successful request, or hybrid. Each has different risk profiles for the buyer.
• Commit and overage: Monthly commit with published overage rates, or pure consumption pricing. Commit discounts typically run 15-35% for 12-month commitments.
• Payment terms: Net 30 is standard for enterprise; smaller vendors sometimes demand Net 15 or prepay, which is a friction point.
• Termination rights: For convenience, for material breach, for extended SLA miss. Enterprise buyers want termination for convenience with 30-60 day notice.
• Price escalation: Capped annual increases (typically CPI or 5%, whichever is lower).

Section 8: Testing and Proof of Concept

Never sign an enterprise proxy contract without a proof of concept. The POC should:

• Run for at least 14 days, ideally 30.
• Use customer-defined targets, not vendor-selected benchmarks.
• Measure success rate, latency, cost per successful request, and support responsiveness on a real incident.
• Run at a meaningful fraction of expected production volume, not a demo-scale load.

Section 9: Exit and Portability

What happens when the contract ends? The RFP should address:

• Data return or destruction of any customer metadata held by the vendor.
• Transition assistance during the termination notice period.
• API compatibility with industry-standard interfaces so that migration does not require rewriting integration code. Most proxy APIs follow a common HTTP proxy interface, but control-plane APIs are vendor-specific.

Ready-to-Use Evaluation Matrix

A scoring matrix with weights that have worked for us in real enterprise evaluations:

Category	Weight
SLA and support	15%
Compliance certifications	15%
Legal and indemnification terms	15%
POC measured performance	20%
Network quality and transparency	15%
Total cost (3-year TCO)	10%
Financial viability	5%
Commercial flexibility	5%

Note that price is 10%, not 50%. Enterprise buyers who weight price above 25% usually end up re-running the procurement within 18 months.

How Hex Proxies Responds

Hex Proxies maintains an RFP response library covering the sections above. Customers can request the current response packet plus audited compliance artifacts from the enterprise sales contact form. The packet includes the SOC 2 Type II report under NDA, the ISO 27001 certificate, the DPA template, and a redacted customer reference list.