PandaDoc
PandaDoc, Inc. ·www.pandadoc.com· As of: 2026-08-27
Work through this tool with an AI
Our verdict
Having documents signed electronically is basic equipment and a dozen vendors ship it. What this tool adds is the stretch before that. The price breakdown, the approval route and the send all sit inside the same document, and afterwards the sender can see how long someone spent on the pricing page. That shortens the time between offer and close, and it shortens it for anyone paying 49 dollars per seat per month. An advantage only arises once your own approval logic is mapped into it, because the function itself is bought in within a week. Two points decide the price and neither appears in the entry plan: EU data residency and SSO sign-in sit exclusively in the quoted tier.
Evidence:Data processing agreement dated May 2025, effective with the main agreement, data importer PandaDoc, Inc. in San Francisco, return or deletion at the customer choice in clause 2.3.5, carve-out for usage and billing data in clause 2.3.6, primary processing in the United States in clause 8.1, standard contractual clauses under Decision (EU) 2021/914 module 2, the UK addendum, the Swiss deviations, certification under the EU-US Data Privacy Framework, and a thirty business day objection period for new subprocessorsOpen sourceAI addendum dated February 2026: separation of AI output and derived improvement data, perpetual, irrevocable, worldwide and sublicensable licence in clause 3.1, no deletion duty after the contract ends, survival of the clause, opt-out available only by giving up the AI features in clause 3.2, and a disclaimer of responsibility for the prior training of third-party modelsOpen sourceSubprocessor list with forty entries, each with processing purpose, hosting location and address, among them OpenAI, LLC for large language model processing via APIs inside the application with hosting in the United States, and the statement that this page is the notification channel for changesOpen sourceTwo separate and isolated installations for the United States and the European Union with a server in Frankfurt, exclusion of any migration between them, a list of the data that stays in the chosen region, and of the three kinds of data that leave it towards the United States by design; page dated 1 September 2023Open sourcePlan prices of 0, 19 and 49 US dollars on annual billing plus 35 and 65 US dollars on monthly billing, 60 documents a year on the free plan, the audit trail on all four tiers, the allocation of EU data residency, SSO sign-in, API and webhooks to the quoted tier, and the tie of the qualified signature and recipient verification to annual billingOpen sourceThe vendor statement on the audit trail product page that it cannot be exported because it is built into the application, and that only the signature certificate for a signed document can be downloaded, together with the description of the events recordedOpen sourceSOC 2 Type II attestation under SSAE 18 for the vendor with the report provided on request, and the naming of ISO 27001, FedRAMP and PCI DSS certifications that are attributed to the infrastructure provider Amazon Web ServicesOpen sourceProvision of the SOC 2 Type 2 report through a form in which a confidentiality agreement is signed beforehandOpen sourceSelf-declarations on E-SIGN, UETA, eIDAS, HIPAA, CCPA, FERPA, PCI-DSS and 21 CFR Part 11 on the security page, and the statement that PandaDoc provides signatures at qualified electronic signature levelOpen sourcePress release of 6 January 2026 on the leadership change with Keith Rabkin as Chief Executive Officer and Mikita Mikado as Chief Product Officer, plus the figures of more than 700 employees, over 56,000 customers, the investors OMERS Growth Equity, M12, HubSpot and Altos Ventures, and the founding year 2013Open sourceMilestone strip on the company page with the founding year 2014, reaching 100 million US dollars of annual recurring revenue in 2024, and the launch of quote configuration for Salesforce and HubSpot in 2025Open sourceSeries C round of 22 September 2021 at a valuation of 1 billion US dollars, led by OMERS Growth Equity and G SquaredOpen sourceReport of 16 December 2025 on an investment of 5 million euros by Indico Capital Partners to expand AI development and the Lisbon siteOpen sourceSecurity practices as an annex to the data processing agreement with encryption in transit and at rest, multi-factor authentication for personnel with access to customer content, deletion procedures under NIST SP 800-88 Revision 1, and notification of confirmed security breaches to the billing email address on fileOpen source
Who it fits
Solo
suitable
The free plan covers 60 documents a year. Starter costs 19 dollars per seat per month on annual billing and 35 dollars on monthly billing. For one person writing offers and having them signed, that holds. Pricing tables, the content library and the CRM connection start one tier up.
Mid-market
suitable
Business costs 49 dollars per seat per month on annual billing and 65 dollars on monthly billing. That tier holds what the tool is actually taken for: pricing tables, approval routes, content library, product catalogue and the CRM connection. The limits are the number of closing rooms, three on this plan, and the missing API.
Enterprise
suitable with caveats
Four of the things a vendor review asks about sit in the same quoted tier: SSO sign-in, EU data residency, the API and the agreement for health data. Even there the API is listed as an add-on, and the price of that tier appears on no page. On top comes a point the vendor answers itself: the audit trail cannot be exported on any plan. Anyone carrying evidence obligations in their own systems settles that route before signing.
Buy, switch or build
Off-the-shelf
Docusign for the signature, the quote staying in the CRM
The established split separates the two jobs. Docusign produces the signature and in many organisations already sits inside the framework agreement, while the offer itself is built in the sales system, with Salesforce CPQ or quotes in HubSpot. Corporates stay with this for two reasons that have little to do with features. One is the chain of evidence: it hangs off whichever vendor produced the signature, and long-term contracts get challenged years later. The other is pricing authority. Anyone running discount limits and approval tiers wants them where the customer data sits rather than in a second tool alongside.
AI-native
Buying the deal room from an AI-native vendor
A younger class builds the same room from the other end. Qwilr generates the offer from a description and treats it as a page rather than a document, while Aligned and Dock put the weight on the shared room with the buyer and on what happens inside it. These vendors usually sit in the same list-price range as the Business plan, and the figures deserve checking first-hand before deciding, because they behave differently with the number of rooms than a per-seat price does. What you give up is the bundling towards the back end. The qualified signature, the management of contracts after signing and the depth of the CRM connection are weaker there or absent, and the regulatory shelf at younger houses is routinely thinner than the forty rows published here.
Build it yourself
Building the deal room yourself and buying the signature in
The room itself is manageable. One page per offer with Astro, delivered through Cloudflare Pages, catalogue and pricing logic in Supabase, access through Ory, payment through Stripe, built with Claude Code or Lovable. The signature is bought in, because the qualified level may only come from a qualified trust service provider. For the simple case five to eight person-days to the first offer sent is realistic; at a day rate of 1,000 euros that lands in the range of one year of the Business plan for ten seats. It fails in two places, and both show up late. The first is pricing governance: discount limits, approval tiers and the question of who approved which price when look like a spreadsheet while building and turn into an evidence problem the moment the first deal is audited. The second is keeping the content current after the builder leaves, because a deal room lives on text blocks that somebody has to maintain.
Our advice
- Solo: Start on the free plan and only move once the 60 documents a year get tight.
- Mid-market: Buy Business, pay annually, and check beforehand whether three closing rooms are enough.
- Enterprise: Settle what the quoted tier costs before asking for a proposal, and weigh the missing audit trail export against your own evidence obligations.
Who is behind it
Staying power: Established
The company has been in the market for more than ten years, although the vendor itself publishes two different founding years. By its own account it employs more than 700 people serving over 56,000 customers, and it names 100 million US dollars of annual recurring revenue for 2024. The last large financing round dates from September 2021; a regional investment for the Lisbon site followed in December 2025. Development visibly continues, most recently on quote configuration for Salesforce and HubSpot and on the AI layer, which according to the subprocessor list runs through an OpenAI API.
- Contracting party and registered office: The data processing agreement names as data importer PandaDoc, Inc., 548 Market St PMB 185308, San Francisco, CA 94104-5401; the vendor maintains no German entity and operates in the European Union from sites in Warsaw and LisbonData processing agreement dated May 2025, effective with the main agreement, data importer PandaDoc, Inc. in San Francisco, return or deletion at the customer choice in clause 2.3.5, carve-out for usage and billing data in clause 2.3.6, primary processing in the United States in clause 8.1, standard contractual clauses under Decision (EU) 2021/914 module 2, the UK addendum, the Swiss deviations, certification under the EU-US Data Privacy Framework, and a thirty business day objection period for new subprocessorsOpen source · As of 2026-08-27
- Financing round with valuation: On 22 September 2021 the vendor announced a Series C round at a valuation of 1 billion US dollars, led by OMERS Growth Equity and G Squared, with Altos Ventures, Rembrandt Venture Partners, One Peak and Microsoft M12; the size of the round was not disclosedSeries C round of 22 September 2021 at a valuation of 1 billion US dollars, led by OMERS Growth Equity and G SquaredOpen source · As of 2026-08-27
- Revenue milestone by the vendor own account: The milestone strip on the company page records reaching 100 million US dollars of annual recurring revenue in 2024 and the launch of native quote configuration for Salesforce and HubSpot in 2025; both are vendor figures with no stated method behind themMilestone strip on the company page with the founding year 2014, reaching 100 million US dollars of annual recurring revenue in 2024, and the launch of quote configuration for Salesforce and HubSpot in 2025Open source · As of 2026-08-27
- Regional investment for Lisbon: On 16 December 2025 tech.eu reported an investment of 5 million euros by Indico Capital Partners, with which the vendor intends to expand its AI development and its Lisbon siteReport of 16 December 2025 on an investment of 5 million euros by Indico Capital Partners to expand AI development and the Lisbon siteOpen source · As of 2026-08-27
- Leadership change and size figures: Press release of 6 January 2026: Keith Rabkin, previously President, became Chief Executive Officer, co-founder Mikita Mikado moved into the Chief Product Officer role and remains on the board, and co-founder Sergey Barysiuk stays Chief Technology Officer; the same release names more than 700 employees and over 56,000 customers and gives 2013 as the founding year, while the milestone strip on the company page gives 2014Press release of 6 January 2026 on the leadership change with Keith Rabkin as Chief Executive Officer and Mikita Mikado as Chief Product Officer, plus the figures of more than 700 employees, over 56,000 customers, the investors OMERS Growth Equity, M12, HubSpot and Altos Ventures, and the founding year 2013Open source · As of 2026-08-27
Cost of leaving: Moderate
The signed documents come out as PDFs, each with its signature certificate. Four things stay behind. Templates, content library and product catalogue are built inside the tool and have to be rebuilt elsewhere. So do the approval routes. The audit trail that records who opened, changed and approved which section and when cannot be exported at all according to the vendor, because it is built into the application. And a fourth tie affects European customers only: nothing can be moved between the American and the European edition, not even within the same vendor. Whoever leaves takes the contracts along and leaves the history of how they moved behind.
Regulation and data
| Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann. | documented, no condition attachedseparate document, publicly available, effective together with the main agreementData processing agreement dated May 2025, effective with the main agreement, data importer PandaDoc, Inc. in San Francisco, return or deletion at the customer choice in clause 2.3.5, carve-out for usage and billing data in clause 2.3.6, primary processing in the United States in clause 8.1, standard contractual clauses under Decision (EU) 2021/914 module 2, the UK addendum, the Swiss deviations, certification under the EU-US Data Privacy Framework, and a thirty business day objection period for new subprocessorsOpen sourceThe data processing agreement is freely available on the legal page, is dated May 2025 and is, by its own wording, effective as of the effective date of the main agreement. Neither a request nor a particular plan is needed. PandaDoc, Inc. with its San Francisco address is named as data importer, with two mailboxes given as contacts for privacy and security. An older version dated 8 August 2023 sits alongside for comparison, which makes checking two versions against each other possible without asking.As of 2026-08-27 |
|---|---|
| Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt. | documented, tied to a conditionEU edition with a server in Frankfurt, quoted tier only, with no way backTwo separate and isolated installations for the United States and the European Union with a server in Frankfurt, exclusion of any migration between them, a list of the data that stays in the chosen region, and of the three kinds of data that leave it towards the United States by design; page dated 1 September 2023Open sourceThe vendor runs two editions of the application, an American one and a European one with a server in Frankfurt. The plan comparison assigns the choice of storage location to the quoted tier alone; the three plans bookable through the website do not offer it. According to the vendor both editions are separate installations that know nothing of each other, and moving between them is ruled out. Anyone who started in the wrong edition opens a second account and maintains it separately. Three kinds of data leave the chosen region by design: all communication with support including video calls, account data and ticket contents, the usage analytics about the account, and anything flowing out through a third-party connection the customer has switched on. The page carrying this is dated 1 September 2023.As of 2026-08-27 |
| Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren. | documented, no condition attachedpublic list of forty entries, each with purpose and hosting locationSubprocessor list with forty entries, each with processing purpose, hosting location and address, among them OpenAI, LLC for large language model processing via APIs inside the application with hosting in the United States, and the statement that this page is the notification channel for changesOpen sourceThe list is freely available and names forty subprocessors, each with its processing purpose, hosting location and address. It is also the declared notification channel for changes, and the data processing agreement grants a thirty business day objection period. One row deserves particular attention: OpenAI, LLC appears there with the purpose of providing large language model processing via APIs inside the application, and the United States is given as its hosting location. Anyone choosing the European edition because the content is meant to sit in Frankfurt should have read that row before switching the AI features on.As of 2026-08-27 |
| Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt. | documented, no condition attachedstandard contractual clauses in all three versions, plus certification under the data privacy frameworkData processing agreement dated May 2025, effective with the main agreement, data importer PandaDoc, Inc. in San Francisco, return or deletion at the customer choice in clause 2.3.5, carve-out for usage and billing data in clause 2.3.6, primary processing in the United States in clause 8.1, standard contractual clauses under Decision (EU) 2021/914 module 2, the UK addendum, the Swiss deviations, certification under the EU-US Data Privacy Framework, and a thirty business day objection period for new subprocessorsOpen sourceClause 8.1 of the data processing agreement states expressly that the primary processing takes place in the United States. Beneath it the bases are named individually: the standard contractual clauses under Implementing Decision (EU) 2021/914 with module 2 for controller-to-processor transfers, the addendum of the UK supervisory authority, and the Swiss deviations each set out separately. The vendor is additionally certified under the EU-US Data Privacy Framework and its UK and Swiss extensions, and undertakes to notify customers should it no longer be able to hold that level of protection. For subprocessors the agreement requires either a country covered by an adequacy decision or the same clauses, so a basis can be assigned to every recipient.As of 2026-08-27 |
| Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt. | documented, but unfavourableon by default, perpetual licence, survives the end of the contract; the only opt-out is switching the AI offAI addendum dated February 2026: separation of AI output and derived improvement data, perpetual, irrevocable, worldwide and sublicensable licence in clause 3.1, no deletion duty after the contract ends, survival of the clause, opt-out available only by giving up the AI features in clause 3.2, and a disclaimer of responsibility for the prior training of third-party modelsOpen sourceThe AI addendum dated February 2026 is the most valuable find in the entire document set. It separates two things that appear on no feature list: the AI output, which belongs to the customer and counts as its confidential information, and the improvement data derived from it, which belongs to the vendor. For that derivation the customer grants a perpetual, irrevocable, worldwide and sublicensable licence in clause 3.1. In the same passage the addendum records that the vendor need not delete the improvement data after the contract ends and that the clause survives termination. An opt-out is available under clause 3.2, but in exactly one form: giving up the AI features altogether, effective going forward. A setting that keeps the features running and switches off only the training is not provided for. What the third-party models in use do with the content is expressly left unregulated, and responsibility for their prior training is disclaimed.As of 2026-08-27 |
| Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung. | documented, tied to a conditionreturn or deletion at the customer choice, without a deadline, with three carve-outsData processing agreement dated May 2025, effective with the main agreement, data importer PandaDoc, Inc. in San Francisco, return or deletion at the customer choice in clause 2.3.5, carve-out for usage and billing data in clause 2.3.6, primary processing in the United States in clause 8.1, standard contractual clauses under Decision (EU) 2021/914 module 2, the UK addendum, the Swiss deviations, certification under the EU-US Data Privacy Framework, and a thirty business day objection period for new subprocessorsOpen sourceClause 2.3.5 of the data processing agreement undertakes to return or delete customer content after the contract ends, at the customer choice. No deadline in days is given. For the execution the clause refers to section 4.4 of the main agreement, and that section governs the return of confidential information: it only bites on written request and expressly carves out backup copies and copies held under the vendor own record retention routine. Two further carve-outs sit alongside. Usage, billing and account data are not customer content under clause 2.3.6 and are processed by the vendor as a controller in its own right. And the derived improvement data from the AI addendum is exempt from any deletion duty.As of 2026-08-27 |
| Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden. | documented, tied to a conditionSOC 2 Type II for the vendor, report only against a signed confidentiality agreementSOC 2 Type II attestation under SSAE 18 for the vendor with the report provided on request, and the naming of ISO 27001, FedRAMP and PCI DSS certifications that are attributed to the infrastructure provider Amazon Web ServicesOpen sourceThe vendor holds a SOC 2 Type II attestation under SSAE 18 for itself and provides the report and an attestation of compliance on request. The route there runs through a form in which a confidentiality agreement is signed first, which is customary for reports of this kind. When reading the compliance page it is worth asking who owns an attestation: the certifications named there under ISO 27001, FedRAMP and PCI DSS belong to the infrastructure provider Amazon Web Services rather than to the vendor itself. It holds no ISO/IEC 27001 certification of its own, and none under ISO/IEC 42001 for artificial intelligence management systems. The statements on HIPAA, CCPA, FERPA and 21 CFR Part 11 on the security page are self-declarations with no named auditor.As of 2026-08-27 |
| EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen. | documented, but unfavourablea dedicated AI contract addendum dated February 2026 with no word on the regulationAI addendum dated February 2026: separation of AI output and derived improvement data, perpetual, irrevocable, worldwide and sublicensable licence in clause 3.1, no deletion duty after the contract ends, survival of the clause, opt-out available only by giving up the AI features in clause 3.2, and a disclaimer of responsibility for the prior training of third-party modelsOpen sourceThe vendor runs AI features on its customers content and published a dedicated contract addendum for them in February 2026. Neither that addendum nor the other legal and security documents reviewed mention Regulation (EU) 2024/1689 at any point, by number or by name. There is therefore no named commitment on the transparency duties under Article 50. What decides the rating is who the AI faces: it produces drafts and summaries for the customer own staff, who review them before sending. The labelling towards the recipient of an offer can therefore be set in house, and that is precisely why this stands at amber rather than red.As of 2026-08-27 |
| Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält. | documented, but unfavourableaudit trail on every plan, export expressly ruled out by the vendor, no retention periodThe vendor statement on the audit trail product page that it cannot be exported because it is built into the application, and that only the signature certificate for a signed document can be downloaded, together with the description of the events recordedOpen sourceThe plan comparison lists the audit trail as included on all four tiers, the free one included. Its scope is described: per document it records who opened, viewed, changed, approved and signed it, each with a timestamp. Two pieces are missing, and one of them the vendor answers on its own product page with a plain no. Asked whether the audit trail can be exported, the page says that it unfortunately cannot, because it is built into the application; the only thing that can be taken out is the signature certificate for a signed document. No retention period for the audit trail is stated anywhere. Anyone who has to keep evidence in a system of their own therefore plans that route without the vendor, and this is the kind of statement that is rarely this plain across the collection.As of 2026-08-27 |
What it really costs
Entry price
Four tiers. The free plan covers 60 documents a year and costs nothing. Starter costs 19 dollars per seat per month on annual billing and 35 dollars on monthly billing. Business costs 49 dollars per seat per month on annual billing and 65 dollars on monthly billing. The fourth tier is quoted by sales, either per seat or per document, and carries no figure on the pricing page. Taxes come on top in each case.Plan prices of 0, 19 and 49 US dollars on annual billing plus 35 and 65 US dollars on monthly billing, 60 documents a year on the free plan, the audit trail on all four tiers, the allocation of EU data residency, SSO sign-in, API and webhooks to the quoted tier, and the tie of the qualified signature and recipient verification to annual billingOpen source
As of 2026-08-27
What gets expensive
In three places, and none of them appears in the headline price. First, in everything a vendor review asks about: SSO sign-in, EU data residency and the API all sit in the quoted tier, and even there the API is still listed as an add-on. Second, in the billing cycle. Paying monthly rather than annually costs 84 per cent more on Starter and 33 per cent more on Business; the toggle on the same page advertises the identical gap as a saving of up to 46 per cent and therefore counts from the other end. Third, in two functions European buyers look for first: the qualified electronic signature and recipient verification are tied to the annual plan and cannot be had on monthly billing.
What it displaces
- The offer as a PDF attachment in an email, in its third version
- A price list in a spreadsheet that nobody maintains any more
- Chasing whether the offer arrived and was read
Interfaces
- API for documents, templates and recipients, only in the quoted tier and listed as an add-on even there
- Webhooks on send, view and signature, likewise only in the top tier
- Connections to Salesforce, HubSpot, Pipedrive and other sales systems from the Business plan up
- Payment collection inside the document through connected payment providers
- Embedded documents and forms on your own pages
- Quote configuration for Salesforce and HubSpot, according to the vendor since 2025
Matching methods
- Pricing Authority Grid (Delegating Price Discretion)The method sets per segment how much pricing latitude sales has without asking; the pricing table, the approval route and content locking inside the offer are where that decision turns into a rule that bites in the individual case instead of sitting in a policy.
- Good-Better-Best PricingThe method calls for three packages at three prices in which the customer places themselves; selectable and optional line items in a pricing table are the form in which those three packages actually reach the buyer and in which what they picked becomes visible.
- MEDDIC / MEDDPICCThe method carries the paper process as a checkpoint of its own alongside the decision process, because deals routinely stall there; a closing room with reading traces turns that checkpoint from a hunch into an observation.
- Bowtie Funnel / Revenue ArchitectureThe method places commitment as the measurable handover between acquisition and expansion; the offer sent and the signature under it are the two timestamps that evidence that handover without anyone having to estimate it.
Alternatives
Sources
- 1.Data processing agreement dated May 2025, effective with the main agreement, data importer PandaDoc, Inc. in San Francisco, return or deletion at the customer choice in clause 2.3.5, carve-out for usage and billing data in clause 2.3.6, primary processing in the United States in clause 8.1, standard contractual clauses under Decision (EU) 2021/914 module 2, the UK addendum, the Swiss deviations, certification under the EU-US Data Privacy Framework, and a thirty business day objection period for new subprocessors (opens in a new tab)pandadoc.com/legal/dpa · As of 2026-08-27
- 2.AI addendum dated February 2026: separation of AI output and derived improvement data, perpetual, irrevocable, worldwide and sublicensable licence in clause 3.1, no deletion duty after the contract ends, survival of the clause, opt-out available only by giving up the AI features in clause 3.2, and a disclaimer of responsibility for the prior training of third-party models (opens in a new tab)pandadoc.com/legal/ai-addendum · As of 2026-08-27
- 3.Subprocessor list with forty entries, each with processing purpose, hosting location and address, among them OpenAI, LLC for large language model processing via APIs inside the application with hosting in the United States, and the statement that this page is the notification channel for changes (opens in a new tab)pandadoc.com/legal/subprocessors · As of 2026-08-27
- 4.Two separate and isolated installations for the United States and the European Union with a server in Frankfurt, exclusion of any migration between them, a list of the data that stays in the chosen region, and of the three kinds of data that leave it towards the United States by design; page dated 1 September 2023 (opens in a new tab)pandadoc.com/legal/pandadoc-data-residency · As of 2026-08-27
- 5.Plan prices of 0, 19 and 49 US dollars on annual billing plus 35 and 65 US dollars on monthly billing, 60 documents a year on the free plan, the audit trail on all four tiers, the allocation of EU data residency, SSO sign-in, API and webhooks to the quoted tier, and the tie of the qualified signature and recipient verification to annual billing (opens in a new tab)pandadoc.com/pricing · As of 2026-08-27
- 6.The vendor statement on the audit trail product page that it cannot be exported because it is built into the application, and that only the signature certificate for a signed document can be downloaded, together with the description of the events recorded (opens in a new tab)pandadoc.com/features/report-and-track/audit-trail · As of 2026-08-27
- 7.SOC 2 Type II attestation under SSAE 18 for the vendor with the report provided on request, and the naming of ISO 27001, FedRAMP and PCI DSS certifications that are attributed to the infrastructure provider Amazon Web Services (opens in a new tab)pandadoc.com/security/compliance · As of 2026-08-27
- 8.Provision of the SOC 2 Type 2 report through a form in which a confidentiality agreement is signed beforehand (opens in a new tab)pandadoc.com/legal/pandadoc-soc2-type-2-report · As of 2026-08-27
- 9.Self-declarations on E-SIGN, UETA, eIDAS, HIPAA, CCPA, FERPA, PCI-DSS and 21 CFR Part 11 on the security page, and the statement that PandaDoc provides signatures at qualified electronic signature level (opens in a new tab)pandadoc.com/security · As of 2026-08-27
- 10.Press release of 6 January 2026 on the leadership change with Keith Rabkin as Chief Executive Officer and Mikita Mikado as Chief Product Officer, plus the figures of more than 700 employees, over 56,000 customers, the investors OMERS Growth Equity, M12, HubSpot and Altos Ventures, and the founding year 2013 (opens in a new tab)pandadoc.com/press/pandadoc-announces-leadership-transition · As of 2026-08-27
- 11.Milestone strip on the company page with the founding year 2014, reaching 100 million US dollars of annual recurring revenue in 2024, and the launch of quote configuration for Salesforce and HubSpot in 2025 (opens in a new tab)pandadoc.com/about · As of 2026-08-27
- 12.Series C round of 22 September 2021 at a valuation of 1 billion US dollars, led by OMERS Growth Equity and G Squared (opens in a new tab)techcrunch.com/… · As of 2026-08-27
- 13.Report of 16 December 2025 on an investment of 5 million euros by Indico Capital Partners to expand AI development and the Lisbon site (opens in a new tab)tech.eu/2025/12/16/ndico-capital-partners-invests-5m-in-pandadoc · As of 2026-08-27
- 14.Security practices as an annex to the data processing agreement with encryption in transit and at rest, multi-factor authentication for personnel with access to customer content, deletion procedures under NIST SP 800-88 Revision 1, and notification of confirmed security breaches to the billing email address on file (opens in a new tab)pandadoc.com/legal/security-practices · As of 2026-08-27
Last reviewed: 2026-08-27 by Dr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.