Public Record Tracking Software

The City of Santa Monica is requesting proposals for a cloud-based Software as a Service (SaaS) solution to manage public records requests, with proposals due August 17, 2026 at 3:00 p.m. and a question deadline of August 3, 2026. The contract term is five years, with full system implementation required by November 1, 2026.

The scope requires a commercially available public record tracking system proven in use by similar-sized jurisdictions and capable of handling over 6,000 annual requests. Key functional capabilities include unique request tracking, departmental collaboration, large file uploads, templated messaging, and compliance with California Public Records Act protocols. The system must integrate with identity management providers such as Microsoft Entra ID and deliver comprehensive API capabilities with bi-directional data transfer options. Vendors must demonstrate compliance with NIST 800-53, CIS controls, ISO/IEC 27001:2013, SOC 1 and SOC 2 standards; 99.5% uptime guarantees with defined service level response times (Level A system outages require resource assignment within one hour and resolution under eight hours); and comprehensive business continuity and disaster recovery plans. All data must remain within the United States without authorization for transborder transfer.

No fixed contract price is specified; the City requests total fee proposals with applicable hourly rate schedules. The Living Wage Ordinance applies to contracts exceeding $54,200, establishing a minimum wage of $25.00 per hour.

Evaluation employs a two-phase process: initial technical qualification screening followed by detailed evaluation of the three highest-ranking proposals weighted as stability and references (20%), cost (10%), ability to meet work plan timelines (30%), experience and technical competence (20%), and functional business requirements (20%). Vendors must complete comprehensive questionnaires addressing system architecture, technology stack, user experience including WCAG 2.1 ADA compliance, data migration strategies, integration capabilities, user and access management, maintenance and support, and operational reporting functionality. If the proposal includes artificial intelligence capabilities, vendors must complete a detailed AI FactSheet with algorithmic impact assessment. All vendors providing cloud services must submit a Vendor Information Security Assessment (VISA) questionnaire with supporting SOC Type 2 audit reports or equivalent third-party cybersecurity assessments. Insurance requirements mandate Commercial General Liability ($1,000,000 per occurrence), Workers' Compensation per California law, and Technology Professional Errors and Omissions/Cyber Liability ($1,000,000 per occurrence / $2,000,000 annual aggregate). The City reserves the right to reject all proposals and negotiate final contract terms with the successful vendor.