# PandaDoc

> Bundles the proposal, the price breakdown and the signature into a single document that the recipient opens in a browser, and reports back to the sender who read which section and for how long.

- Vendor: PandaDoc, Inc.
- Canonical URL: https://www.convios.com/en/toolbox/pandadoc
- Language version: https://www.convios.com/de/werkzeugkasten/pandadoc
- Area: Go-to-market & sales · Cluster: proposal and closing rooms
- Role: Off-the-shelf product · Origin: Established, AI retrofitted
- As of: 2026-08-27 · Reviewed: 2026-08-27 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Efficiency only: Having documents signed electronically is basic equipment and a dozen vendors ship it. What this tool adds is the stretch before that. The price breakdown, the approval route and the send all sit inside the same document, and afterwards the sender can see how long someone spent on the pricing page. That shortens the time between offer and close, and it shortens it for anyone paying 49 dollars per seat per month. An advantage only arises once your own approval logic is mapped into it, because the function itself is bought in within a week. Two points decide the price and neither appears in the entry plan: EU data residency and SSO sign-in sit exclusively in the quoted tier.

## Suitability by company size

- Solo: suitable — The free plan covers 60 documents a year. Starter costs 19 dollars per seat per month on annual billing and 35 dollars on monthly billing. For one person writing offers and having them signed, that holds. Pricing tables, the content library and the CRM connection start one tier up.
- Mid-market: suitable — Business costs 49 dollars per seat per month on annual billing and 65 dollars on monthly billing. That tier holds what the tool is actually taken for: pricing tables, approval routes, content library, product catalogue and the CRM connection. The limits are the number of closing rooms, three on this plan, and the missing API.
- Enterprise: suitable with caveats — Four of the things a vendor review asks about sit in the same quoted tier: SSO sign-in, EU data residency, the API and the agreement for health data. Even there the API is listed as an add-on, and the price of that tier appears on no page. On top comes a point the vendor answers itself: the audit trail cannot be exported on any plan. Anyone carrying evidence obligations in their own systems settles that route before signing.

## Vendor staying power

Established: The company has been in the market for more than ten years, although the vendor itself publishes two different founding years. By its own account it employs more than 700 people serving over 56,000 customers, and it names 100 million US dollars of annual recurring revenue for 2024. The last large financing round dates from September 2021; a regional investment for the Lisbon site followed in December 2025. Development visibly continues, most recently on quote configuration for Salesforce and HubSpot and on the AI layer, which according to the subprocessor list runs through an OpenAI API.

- Contracting party and registered office: The data processing agreement names as data importer PandaDoc, Inc., 548 Market St PMB 185308, San Francisco, CA 94104-5401; the vendor maintains no German entity and operates in the European Union from sites in Warsaw and Lisbon (source: https://www.pandadoc.com/legal/dpa/, as of 2026-08-27)
- Financing round with valuation: On 22 September 2021 the vendor announced a Series C round at a valuation of 1 billion US dollars, led by OMERS Growth Equity and G Squared, with Altos Ventures, Rembrandt Venture Partners, One Peak and Microsoft M12; the size of the round was not disclosed (source: https://techcrunch.com/2021/09/22/pandadoc-the-e-document-startup-now-valued-at-1b-as-it-closes-a-big-series-c/, as of 2026-08-27)
- Revenue milestone by the vendor own account: The milestone strip on the company page records reaching 100 million US dollars of annual recurring revenue in 2024 and the launch of native quote configuration for Salesforce and HubSpot in 2025; both are vendor figures with no stated method behind them (source: https://www.pandadoc.com/about/, as of 2026-08-27)
- Regional investment for Lisbon: On 16 December 2025 tech.eu reported an investment of 5 million euros by Indico Capital Partners, with which the vendor intends to expand its AI development and its Lisbon site (source: https://tech.eu/2025/12/16/ndico-capital-partners-invests-5m-in-pandadoc/, as of 2026-08-27)
- Leadership change and size figures: Press release of 6 January 2026: Keith Rabkin, previously President, became Chief Executive Officer, co-founder Mikita Mikado moved into the Chief Product Officer role and remains on the board, and co-founder Sergey Barysiuk stays Chief Technology Officer; the same release names more than 700 employees and over 56,000 customers and gives 2013 as the founding year, while the milestone strip on the company page gives 2014 (source: https://www.pandadoc.com/press/pandadoc-announces-leadership-transition/, as of 2026-08-27)

## Cost of leaving

Moderate: The signed documents come out as PDFs, each with its signature certificate. Four things stay behind. Templates, content library and product catalogue are built inside the tool and have to be rebuilt elsewhere. So do the approval routes. The audit trail that records who opened, changed and approved which section and when cannot be exported at all according to the vendor, because it is built into the application. And a fourth tie affects European customers only: nothing can be moved between the American and the European edition, not even within the same vendor. Whoever leaves takes the contracts along and leaves the history of how they moved behind.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | separate document, publicly available, effective together with the main agreement — The data processing agreement is freely available on the legal page, is dated May 2025 and is, by its own wording, effective as of the effective date of the main agreement. Neither a request nor a particular plan is needed. PandaDoc, Inc. with its San Francisco address is named as data importer, with two mailboxes given as contacts for privacy and security. An older version dated 8 August 2023 sits alongside for comparison, which makes checking two versions against each other possible without asking. | evidenced | 2026-08-27 |
| Storage location | EU edition with a server in Frankfurt, quoted tier only, with no way back — The vendor runs two editions of the application, an American one and a European one with a server in Frankfurt. The plan comparison assigns the choice of storage location to the quoted tier alone; the three plans bookable through the website do not offer it. According to the vendor both editions are separate installations that know nothing of each other, and moving between them is ruled out. Anyone who started in the wrong edition opens a second account and maintains it separately. Three kinds of data leave the chosen region by design: all communication with support including video calls, account data and ticket contents, the usage analytics about the account, and anything flowing out through a third-party connection the customer has switched on. The page carrying this is dated 1 September 2023. | partially evidenced | 2026-08-27 |
| Subprocessors | public list of forty entries, each with purpose and hosting location — The list is freely available and names forty subprocessors, each with its processing purpose, hosting location and address. It is also the declared notification channel for changes, and the data processing agreement grants a thirty business day objection period. One row deserves particular attention: OpenAI, LLC appears there with the purpose of providing large language model processing via APIs inside the application, and the United States is given as its hosting location. Anyone choosing the European edition because the content is meant to sit in Frankfurt should have read that row before switching the AI features on. | evidenced | 2026-08-27 |
| Third-country transfer | standard contractual clauses in all three versions, plus certification under the data privacy framework — Clause 8.1 of the data processing agreement states expressly that the primary processing takes place in the United States. Beneath it the bases are named individually: the standard contractual clauses under Implementing Decision (EU) 2021/914 with module 2 for controller-to-processor transfers, the addendum of the UK supervisory authority, and the Swiss deviations each set out separately. The vendor is additionally certified under the EU-US Data Privacy Framework and its UK and Swiss extensions, and undertakes to notify customers should it no longer be able to hold that level of protection. For subprocessors the agreement requires either a country covered by an adequacy decision or the same clauses, so a basis can be assigned to every recipient. | evidenced | 2026-08-27 |
| Training on customer data | on by default, perpetual licence, survives the end of the contract; the only opt-out is switching the AI off — The AI addendum dated February 2026 is the most valuable find in the entire document set. It separates two things that appear on no feature list: the AI output, which belongs to the customer and counts as its confidential information, and the improvement data derived from it, which belongs to the vendor. For that derivation the customer grants a perpetual, irrevocable, worldwide and sublicensable licence in clause 3.1. In the same passage the addendum records that the vendor need not delete the improvement data after the contract ends and that the clause survives termination. An opt-out is available under clause 3.2, but in exactly one form: giving up the AI features altogether, effective going forward. A setting that keeps the features running and switches off only the training is not provided for. What the third-party models in use do with the content is expressly left unregulated, and responsibility for their prior training is disclaimed. | partially evidenced | 2026-08-27 |
| Retention and deletion | return or deletion at the customer choice, without a deadline, with three carve-outs — Clause 2.3.5 of the data processing agreement undertakes to return or delete customer content after the contract ends, at the customer choice. No deadline in days is given. For the execution the clause refers to section 4.4 of the main agreement, and that section governs the return of confidential information: it only bites on written request and expressly carves out backup copies and copies held under the vendor own record retention routine. Two further carve-outs sit alongside. Usage, billing and account data are not customer content under clause 2.3.6 and are processed by the vendor as a controller in its own right. And the derived improvement data from the AI addendum is exempt from any deletion duty. | partially evidenced | 2026-08-27 |
| Certifications | SOC 2 Type II for the vendor, report only against a signed confidentiality agreement — The vendor holds a SOC 2 Type II attestation under SSAE 18 for itself and provides the report and an attestation of compliance on request. The route there runs through a form in which a confidentiality agreement is signed first, which is customary for reports of this kind. When reading the compliance page it is worth asking who owns an attestation: the certifications named there under ISO 27001, FedRAMP and PCI DSS belong to the infrastructure provider Amazon Web Services rather than to the vendor itself. It holds no ISO/IEC 27001 certification of its own, and none under ISO/IEC 42001 for artificial intelligence management systems. The statements on HIPAA, CCPA, FERPA and 21 CFR Part 11 on the security page are self-declarations with no named auditor. | partially evidenced | 2026-08-27 |
| EU AI Act, Article 50 | a dedicated AI contract addendum dated February 2026 with no word on the regulation — The vendor runs AI features on its customers content and published a dedicated contract addendum for them in February 2026. Neither that addendum nor the other legal and security documents reviewed mention Regulation (EU) 2024/1689 at any point, by number or by name. There is therefore no named commitment on the transparency duties under Article 50. What decides the rating is who the AI faces: it produces drafts and summaries for the customer own staff, who review them before sending. The labelling towards the recipient of an offer can therefore be set in house, and that is precisely why this stands at amber rather than red. | partially evidenced | 2026-08-27 |
| Audit logging | audit trail on every plan, export expressly ruled out by the vendor, no retention period — The plan comparison lists the audit trail as included on all four tiers, the free one included. Its scope is described: per document it records who opened, viewed, changed, approved and signed it, each with a timestamp. Two pieces are missing, and one of them the vendor answers on its own product page with a plain no. Asked whether the audit trail can be exported, the page says that it unfortunately cannot, because it is built into the application; the only thing that can be taken out is the signature certificate for a signed document. No retention period for the audit trail is stated anywhere. Anyone who has to keep evidence in a system of their own therefore plans that route without the vendor, and this is the kind of statement that is rarely this plain across the collection. | partially evidenced | 2026-08-27 |

## Cost

- Entry: Four tiers. The free plan covers 60 documents a year and costs nothing. Starter costs 19 dollars per seat per month on annual billing and 35 dollars on monthly billing. Business costs 49 dollars per seat per month on annual billing and 65 dollars on monthly billing. The fourth tier is quoted by sales, either per seat or per document, and carries no figure on the pricing page. Taxes come on top in each case. (as of 2026-08-27)
- Where it gets expensive: In three places, and none of them appears in the headline price. First, in everything a vendor review asks about: SSO sign-in, EU data residency and the API all sit in the quoted tier, and even there the API is still listed as an add-on. Second, in the billing cycle. Paying monthly rather than annually costs 84 per cent more on Starter and 33 per cent more on Business; the toggle on the same page advertises the identical gap as a saving of up to 46 per cent and therefore counts from the other end. Third, in two functions European buyers look for first: the qualified electronic signature and recipient verification are tied to the annual plan and cannot be had on monthly billing.

## Three routes compared

### Docusign for the signature, the quote staying in the CRM

The established split separates the two jobs. Docusign produces the signature and in many organisations already sits inside the framework agreement, while the offer itself is built in the sales system, with Salesforce CPQ or quotes in HubSpot. Corporates stay with this for two reasons that have little to do with features. One is the chain of evidence: it hangs off whichever vendor produced the signature, and long-term contracts get challenged years later. The other is pricing authority. Anyone running discount limits and approval tiers wants them where the customer data sits rather than in a second tool alongside.

### Buying the deal room from an AI-native vendor

A younger class builds the same room from the other end. Qwilr generates the offer from a description and treats it as a page rather than a document, while Aligned and Dock put the weight on the shared room with the buyer and on what happens inside it. These vendors usually sit in the same list-price range as the Business plan, and the figures deserve checking first-hand before deciding, because they behave differently with the number of rooms than a per-seat price does. What you give up is the bundling towards the back end. The qualified signature, the management of contracts after signing and the depth of the CRM connection are weaker there or absent, and the regulatory shelf at younger houses is routinely thinner than the forty rows published here.

### Building the deal room yourself and buying the signature in

The room itself is manageable. One page per offer with Astro, delivered through Cloudflare Pages, catalogue and pricing logic in Supabase, access through Ory, payment through Stripe, built with Claude Code or Lovable. The signature is bought in, because the qualified level may only come from a qualified trust service provider. For the simple case five to eight person-days to the first offer sent is realistic; at a day rate of 1,000 euros that lands in the range of one year of the Business plan for ten seats. It fails in two places, and both show up late. The first is pricing governance: discount limits, approval tiers and the question of who approved which price when look like a spreadsheet while building and turn into an evidence problem the moment the first deal is audited. The second is keeping the content current after the builder leaves, because a deal room lives on text blocks that somebody has to maintain.

Recommendation by size:

- Solo: Start on the free plan and only move once the 60 documents a year get tight.
- Mid-market: Buy Business, pay annually, and check beforehand whether three closing rooms are enough.
- Enterprise: Settle what the quoted tier costs before asking for a proposal, and weigh the missing audit trail export against your own evidence obligations.

## Context

- Implements method: [Pricing Authority Grid (Delegating Price Discretion)](https://www.convios.com/en/methods/price-authority-delegation) — The method sets per segment how much pricing latitude sales has without asking; the pricing table, the approval route and content locking inside the offer are where that decision turns into a rule that bites in the individual case instead of sitting in a policy.
- Implements method: [Good-Better-Best Pricing](https://www.convios.com/en/methods/good-better-best) — The method calls for three packages at three prices in which the customer places themselves; selectable and optional line items in a pricing table are the form in which those three packages actually reach the buyer and in which what they picked becomes visible.
- Implements method: [MEDDIC / MEDDPICC](https://www.convios.com/en/methods/meddpicc) — The method carries the paper process as a checkpoint of its own alongside the decision process, because deals routinely stall there; a closing room with reading traces turns that checkpoint from a hunch into an observation.
- Implements method: [Bowtie Funnel / Revenue Architecture](https://www.convios.com/en/methods/bowtie-funnel) — The method places commitment as the measurable handover between acquisition and expansion; the offer sent and the signature under it are the two timestamps that evidence that handover without anyone having to estimate it.
- Alternative: [Docusign](https://www.convios.com/en/toolbox/docusign)
- Displaces: The offer as a PDF attachment in an email, in its third version, A price list in a spreadsheet that nobody maintains any more, Chasing whether the offer arrived and was read

## Evidence

- Data processing agreement dated May 2025, effective with the main agreement, data importer PandaDoc, Inc. in San Francisco, return or deletion at the customer choice in clause 2.3.5, carve-out for usage and billing data in clause 2.3.6, primary processing in the United States in clause 8.1, standard contractual clauses under Decision (EU) 2021/914 module 2, the UK addendum, the Swiss deviations, certification under the EU-US Data Privacy Framework, and a thirty business day objection period for new subprocessors — https://www.pandadoc.com/legal/dpa/ (as of 2026-08-27)
- AI addendum dated February 2026: separation of AI output and derived improvement data, perpetual, irrevocable, worldwide and sublicensable licence in clause 3.1, no deletion duty after the contract ends, survival of the clause, opt-out available only by giving up the AI features in clause 3.2, and a disclaimer of responsibility for the prior training of third-party models — https://www.pandadoc.com/legal/ai-addendum/ (as of 2026-08-27)
- Subprocessor list with forty entries, each with processing purpose, hosting location and address, among them OpenAI, LLC for large language model processing via APIs inside the application with hosting in the United States, and the statement that this page is the notification channel for changes — https://www.pandadoc.com/legal/subprocessors/ (as of 2026-08-27)
- Two separate and isolated installations for the United States and the European Union with a server in Frankfurt, exclusion of any migration between them, a list of the data that stays in the chosen region, and of the three kinds of data that leave it towards the United States by design; page dated 1 September 2023 — https://www.pandadoc.com/legal/pandadoc-data-residency/ (as of 2026-08-27)
- Plan prices of 0, 19 and 49 US dollars on annual billing plus 35 and 65 US dollars on monthly billing, 60 documents a year on the free plan, the audit trail on all four tiers, the allocation of EU data residency, SSO sign-in, API and webhooks to the quoted tier, and the tie of the qualified signature and recipient verification to annual billing — https://www.pandadoc.com/pricing/ (as of 2026-08-27)
- The vendor statement on the audit trail product page that it cannot be exported because it is built into the application, and that only the signature certificate for a signed document can be downloaded, together with the description of the events recorded — https://www.pandadoc.com/features/report-and-track/audit-trail/ (as of 2026-08-27)
- SOC 2 Type II attestation under SSAE 18 for the vendor with the report provided on request, and the naming of ISO 27001, FedRAMP and PCI DSS certifications that are attributed to the infrastructure provider Amazon Web Services — https://www.pandadoc.com/security/compliance/ (as of 2026-08-27)
- Provision of the SOC 2 Type 2 report through a form in which a confidentiality agreement is signed beforehand — https://www.pandadoc.com/legal/pandadoc-soc2-type-2-report/ (as of 2026-08-27)
- Self-declarations on E-SIGN, UETA, eIDAS, HIPAA, CCPA, FERPA, PCI-DSS and 21 CFR Part 11 on the security page, and the statement that PandaDoc provides signatures at qualified electronic signature level — https://www.pandadoc.com/security/ (as of 2026-08-27)
- Press release of 6 January 2026 on the leadership change with Keith Rabkin as Chief Executive Officer and Mikita Mikado as Chief Product Officer, plus the figures of more than 700 employees, over 56,000 customers, the investors OMERS Growth Equity, M12, HubSpot and Altos Ventures, and the founding year 2013 — https://www.pandadoc.com/press/pandadoc-announces-leadership-transition/ (as of 2026-08-27)
- Milestone strip on the company page with the founding year 2014, reaching 100 million US dollars of annual recurring revenue in 2024, and the launch of quote configuration for Salesforce and HubSpot in 2025 — https://www.pandadoc.com/about/ (as of 2026-08-27)
- Series C round of 22 September 2021 at a valuation of 1 billion US dollars, led by OMERS Growth Equity and G Squared — https://techcrunch.com/2021/09/22/pandadoc-the-e-document-startup-now-valued-at-1b-as-it-closes-a-big-series-c/ (as of 2026-08-27)
- Report of 16 December 2025 on an investment of 5 million euros by Indico Capital Partners to expand AI development and the Lisbon site — https://tech.eu/2025/12/16/ndico-capital-partners-invests-5m-in-pandadoc/ (as of 2026-08-27)
- Security practices as an annex to the data processing agreement with encryption in transit and at rest, multi-factor authentication for personnel with access to customer content, deletion procedures under NIST SP 800-88 Revision 1, and notification of confirmed security breaches to the billing email address on file — https://www.pandadoc.com/legal/security-practices/ (as of 2026-08-27)