Logistics Tower

An RFP for a control tower

What to ask a control-tower vendor when you put the platform out to bid. Forty questions, organized by section, that an enterprise shipper or 3PL should expect answered in writing.

  • rfp
  • buying-guide

If you are buying a control-tower platform, the RFP is your friend. A good RFP forces the vendor to be specific. A bad RFP lets them hide behind marketing copy. The questions below are the ones we would want to be asked, because the answers are the things that actually matter in production.

Coverage

  1. Which modes does the platform support natively (ocean, air, road, rail, intermodal)?
  2. How many carriers are pre-integrated, and what is the breakdown by mode?
  3. For carriers that are not pre-integrated, what is the integration model (carrier-built, vendor-built, paid add-on)?
  4. Does the platform support EDI X12 and EDIFACT? Which transaction sets?
  5. Does the platform support carrier APIs that use OAuth 2.0, API keys, and mTLS?
  6. What is the average implementation time for a customer with four TMS / WMS / ERP integrations?

Data model

  1. What is the milestone model? How many milestones are defined, and how are they mapped from carrier events?
  2. How does the platform handle milestone conflicts (two carriers report different statuses for the same shipment)?
  3. How is the ETA computed? What inputs does the model use?
  4. How often is the ETA recomputed?
  5. Can the customer override the ETA, and is the override logged?
  6. What is the data retention period by plan?
  7. Does the platform support a customer-defined shipment ID in addition to the carrier’s?

Operations

  1. How are exceptions detected and scored?
  2. Can the customer define custom exception rules?
  3. How are exceptions routed to dispatchers?
  4. Is there an SLA tracking feature, and can SLAs be defined per lane?
  5. Can the platform send notifications to customers (email, SMS, webhook)?
  6. Does the platform support a wall-display mode for operations centers?
  7. Is there a mobile experience for drivers and warehouse staff?

Integrations

  1. Which TMS platforms are supported natively?
  2. Which WMS platforms are supported natively?
  3. Which ERP systems are supported via API?
  4. Does the platform expose a REST API? What is the versioning policy?
  5. Does the platform fire webhooks on milestone events?
  6. Is there an SDK? In which languages?
  7. Can the platform write back to the customer’s TMS, or is the integration read-only?
  8. What is the rate limit on the API?

Security and compliance

  1. Is the platform SOC 2 Type II certified? When was the last audit?
  2. Is the platform GDPR-compliant? Is a DPA available?
  3. Where is customer data stored? Can it be pinned to a region?
  4. Does the platform support SSO (SAML 2.0, OIDC)?
  5. Does the platform support SCIM for user lifecycle management?
  6. Is the audit log exportable to a SIEM?
  7. What is the access control model? RBAC, ABAC, or both?
  8. What is the incident response process, and how are customers notified?

Performance and availability

  1. What is the uptime SLA by plan?
  2. What is the API’s p95 latency?
  3. How long does it take for a carrier event to appear in the timeline?
  4. What is the customer status page URL, and what is the historical uptime?

The takeaway

A vendor that cannot answer these questions in writing, with specifics, is not a vendor you can run a control tower on. The RFP is not a formality; it is the difference between a platform that runs your operation and a platform that runs your demos.