Work / AI Agents / RFP Drafting
RFP Drafting First drafts with sources. A person signs off.
Drafts first answers to RFPs and security questionnaires from your past proposals and approved content, with a source for every answer. A person reviews each one before anything is exported. This page shows what it does and how it is built. Every real engagement is fitted to your documents, systems and rules.
| Question | Result | Why |
|---|---|---|
| Q-01 | Drafted | Cites an approved answer |
| Q-02 | Drafted | Cites two current sources |
| Q-03 | Needs a person | Two sources disagree |
| Q-04 | Needs a person | Best source is out of date |
How one questionnaire travels through it.
The library is audited before anything is drafted. Each question is routed by rules first, and the model only writes when the evidence is clean.
- Load the libraryPast proposals, policies, approved answers and certifications, each tagged with its source and date.
- Audit readinessFind stale, conflicting and duplicate entries and the topics with no coverage.
- Parse the requestAn RFP or questionnaire becomes a list of questions with their type and section.
- Retrieve evidenceKeyword and semantic search for each question, with source, date and approval status.
- Decide: draft or personPlain rules check for conflict, staleness and gaps. If any applies, no draft is written.
- Draft and checkThe model drafts with citations. A provenance check confirms every claim traces to an approved source.
- Review and exportAccept, edit or reject per question. Only reviewed answers are exported.
Where a question can be, and where it can go next.
Conflict, staleness or a gap sends a question to a person without calling the model. Only accepted or edited answers can be exported.
Rules decide. The model only writes.
The domain rules have no dependency on any model SDK, and a test keeps it that way. The database adds its own guards, so a screen bug cannot export an unreviewed answer.
The parts that do the work.
Content-readiness audit
Before drafting, it tells you whether your existing material is good enough to reuse, and where it is not.
Reuse of approved answers
A close match to an approved answer is reused word for word instead of rewritten.
Review workspace
A numbered question index, filters for what needs review, progress, and status shown by icon and word.
Export
Reviewed answers leave as a file your team already works with, such as CSV.
Written down first, then enforced in code.
- No answer is exported without an approved review. The database enforces it, not only the screen.
- It never invents policies, certifications, dates, prices or commitments. Missing or conflicting evidence goes to a person.
- Retired sources are excluded. Deprecated content is filtered out at retrieval and rejected by the provenance check.
- The model never decides routing or approval. Those are domain rules written as plain code.
- The RFP text is data, not instructions. A question that tells the system what to do is screened.
Plain parts, chosen to be swapped.
Next.js and TypeScript · PostgreSQL with pgvector · Drizzle · Zod · AI SDK behind a provider-neutral interface
Where your data lives, and which model ever sees it, is your decision. We design to it.
Your proposals, policies and certifications stay in your own PostgreSQL. Drafting calls one model through one interface, which can be hosted in a region you choose or run on hardware you control. Security questionnaires often name where data may go, and we build to that.
- In your own cloud account, in the region you name.
- On your own servers, with nothing in our hands.
- With a language model that runs on your hardware, so no data goes to an AI provider.
- With a hosted model in a region you approve, under the terms you choose.
Australia
The Privacy Act 1988 and the Australian Privacy Principles. Principle 8 covers sending personal information overseas: the sender stays accountable for how it is handled there. Some sectors and government work require data to stay onshore.
New Zealand
The Privacy Act 2020. Information privacy principle 12 limits disclosing personal information to a body outside New Zealand unless it is protected to a comparable standard or the person has agreed.
European Union
The GDPR. Moving personal data outside the EEA needs a legal basis for the transfer. Hosting and model endpoints inside the EU avoid the question.
United States
No single federal privacy law. State laws such as California’s CCPA, and sector rules such as HIPAA for health and GLBA for finance, decide what applies. Contracts often require US-only processing.
This is a summary to explain how we work, not legal advice. Your own counsel confirms what applies to you, and we build to what they decide. More on the privacy page.