PandaDoc

A document platform of long standing with a model layer added at the edges. The product has been sold since 2013 as document creation, signature, contract management and quoting, and every one of those capabilities is deterministic: templates populate from field values, pricing tables compute from a catalogue, approval routes follow configured conditions, and a signature is a cryptographic artifact rather than an inference.

Strip the models entirely and the platform sixty thousand organisations bought remains complete. Two model dependent capabilities sit above it. A drafting assistant inside the editor writes and refines document copy, which is a genuine model capability and also an accessory to a document a person is otherwise composing.

And a protocol server launched in 2025 lets external assistants create documents, populate fields, route for approval and send for signature from natural language, which is more consequential but is distribution rather than centrality: the models doing that work belong to whoever the customer connects, not to this vendor. Building a route for other people's agents to drive your product is not the same as your product being an agent. Ask which capabilities stop working without the drafting assistant, and whether any inference occurs inside the platform itself.

Strong native controls over an automated process whose failure mode is expensive, and an unanswered question about the newest path into it. What is published is substantive: multi step approval workflows with conditional logic that hold a document before it reaches a recipient, content locking that prevents a representative editing protected clauses, signing order, automatic expirations, roles and permissions with custom roles at the top tier, and an audit trail included on every tier including the free one.

For a product where the error is a contract leaving with the wrong price or the wrong terms, an approval gate and locked content are exactly the right controls, and putting the audit trail on every tier rather than gating it is a deliberate choice worth crediting. The gap is at the protocol server.

The vendor advertises that an external agent can generate a proposal with a stated contract value and send it for signature from a single prompt, and nothing published states whether approval workflows fire on an agent initiated document, whether content locking holds against an agent, what volume an agent may send, or what a human sees before a legally binding instrument leaves. Ask whether approval workflows and content locking apply to documents created through the protocol server, and what limits an agent initiated send.

The interface to the model layer is documented precisely and the model layer is not described at all. What is published is unusually concrete for this axis: a protocol server with its hosted endpoint stated, an authorisation method named, the compatible client tools listed, a statement that connection carries no separate fee and uses an existing account, and native connectors inside two widely used assistants.

A developer can establish exactly what an agent may do, which is more than most records here disclose about anything. None of that describes a model. No provider, family or version is named for the drafting assistant built into the editor, no model card exists, and no accuracy or quality measurement is published for generated document copy.

The distinction matters commercially as well as technically: for the protocol server the model belongs to whoever the customer connects and its behaviour is their concern, while for the drafting assistant the model is the vendor's choice and the buyer is told nothing about it. Nothing published separates the two for a reader. Ask which model powers the drafting assistant, whether the customer can choose or substitute it, and what evaluation covers generated contract language before a person signs it.

Named customer outcomes without the baselines that would make them measurements, which is what places this grade. The vendor publishes figures attributed to identifiable companies, including a twenty eight percent close rate increase at a meeting scheduling vendor separately recorded here, a twenty percent reduction in customer acquisition cost at another and three thousand hours saved annually at a third, each linked to its own case study.

Every one is a single account with no stated baseline, cohort or measurement window, and a twenty eight percent close rate change has too many possible causes to attribute to a document tool without one. That is the same shortfall that holds the largest enablement vendor recorded here to the same grade, and the same request applies: an outcome measured across a stated population of customers over a stated period rather than per account highlights.

Two things sit above that floor without lifting it. Company scale is disclosed in a way most private vendors avoid, with more than sixty thousand organisations, one hundred million dollars of annual recurring revenue reached in 2024 and a one billion dollar valuation in December 2025, which speaks to the vendor's own operation rather than to what customers achieve.

And review platform ratings are cited with both the count and the date they were captured across three platforms, which is better disclosure discipline than almost anything in this corpus and also exposes its own weakness, since two of the three carry dates roughly eighteen months before the page was read. One factual defect belongs on this axis and does not move the grade.

The vendor publishes a reference page it describes as the canonical source for how artificial intelligence systems should describe it, and that page names one person as chief executive in its personnel list while its own narrative describes a different person taking that role in January 2026.

A page instructing machines to treat it as authoritative, carrying a contradiction about the company's own leadership, is an error in published material rather than a matter of positioning, and it bears on whether other published assertions can be relied on without checking. It is recorded here because the accuracy of that material is gradeable on this axis; it does not decide the grade, which the missing baselines already settle. Ask what period and baseline each customer figure covers, whether the older review citations still hold, and who currently holds the chief executive role.

The platform sends to counterparties rather than to prospects, so most of this axis applies by scope, and one capability sits outside that. Documents go to recipients the customer has named for signature, approval or review, which is transactional correspondence to someone already in a commercial relationship or actively entering one, and no campaign, sequence or cold contact exists anywhere in the product.

That is a materially lighter posture than anything else in this cohort and the grade should be read accordingly. The exception is bulk send, sold as a paid addition at the two upper tiers, which dispatches a document to many recipients at once.

Nothing published describes what governs it: no volume ceiling, no statement on the basis for holding the recipient list, no unsubscribe or suppression handling, and no guidance on the difference between a bulk agreement dispatch and a marketing send. Optional email white labelling means such mail can leave under the customer's own domain, which places the consequences with them. Ask what limits apply to bulk send, and what the vendor considers the customer responsible for when a document dispatch resembles a campaign.

A regulatory position that is broad, specific and in several places externally regulated rather than self declared. Published across the vendor's own comparison matrix and reference pages are compliance positions for the European data protection regulation, the United States federal and state electronic signature statutes, the European signature framework at all three levels including the qualified standard, health information privacy as a paid addition at the top tier, and, added in 2025, the electronic records rule for regulated medicine.

The qualified signature standard is the one that carries the most weight for this axis, because it is not a claim a vendor can simply make: it requires a regulated trust service and confers equivalence to a handwritten signature across every member state. Around that sit a published privacy notice, a dedicated regulation page, a rights portal for personal information requests, and cookie controls.

A genuine residency election exists between two regions, which is more than most records offer. Two things hold it below the top band. The residency election is available only at the quoted top tier, so where a customer's agreements are stored is a function of what they spend, which is the third record in this project to gate a privacy control commercially.

And the processing instruments were not reached on this pass, so no processing agreement, subprocessor list or retention period was established. Ask for the processing agreement, the subprocessor list and the retention period, and what residency costs at the tier below enterprise.

Almost nothing on this axis applies, and the grade records the scope rather than a shortfall. The vendor supplies no contact database, no firmographic corpus, no intent signal and no enrichment. Every record the platform holds arrived from the customer: their documents, their product catalogue, their pricing, their counterparties.

There is no purchased corpus whose origin a buyer needs to trace, which removes the exposure this axis exists to capture and is a genuinely favourable position when comparing against products that supply their own data. Two smaller questions remain unanswered rather than being absent.

A public template library of several hundred documents is offered to every tier, and nothing states who authored those templates, whether any legal review attaches to them, or what a customer relies on when sending one as the basis of an agreement. And the drafting assistant generates contract language whose training basis is undescribed, which for text that becomes a binding term is a provenance question of a different kind from the usual one on this axis. Ask who authors and reviews the public template library, and what basis the drafting assistant draws on when generating contractual language.

Official routes throughout, and the vendor is a platform provider as much as a platform consumer. Integrations run through the sanctioned interfaces of the systems they connect to, covering four customer record platforms with dedicated quoting variants for three of them, six payment gateways, an automation service, messaging and productivity tools and an applicant tracking system.

Nothing scrapes, no browser extension pulls data off a professional network, and no social automation exists, so the exposures that separate this category fastest do not arise. On its own side the vendor publishes an interface with generated development kits, an embedding capability and a protocol server, so other products build on it as well as the reverse. Held below the top band for two reasons. No conformance position is stated in the vendor's own words for any connected platform.

And the protocol server creates a terms surface that is new and unaddressed: it grants external assistants read and write access to documents, templates and signing workflows through an authorisation handshake, which means executed agreements and their contents can pass into a third party assistant under that provider's terms rather than the vendor's, and nothing published describes what governs the content once it arrives. Ask what terms govern document content passing through the protocol server into a third party assistant, and what the vendor's conformance position is with its connected platforms.

A deliberate route was built for the most sensitive material this platform holds to leave it, and no stewardship position accompanies it. The protocol server lets any compatible assistant read and write documents, templates and signing workflows after an authorisation handshake, and the vendor promotes generating a named customer's proposal with a stated contract value from a single prompt.

The material reachable that way is executed and draft agreements, negotiated pricing, commercial terms and the personal details of signatories. Nothing published states what may be exposed through that route, whether any field is withheld, what the connected provider is permitted to retain or train on, or whether the vendor takes any position on the practice at all.

The page the vendor designates as its canonical reference for artificial intelligence systems describes these capabilities at length and carries no data handling statement for any of them, which makes it a marketing document rather than a governance one. Separately, nothing states whether customer documents train or tune the drafting assistant, which provider processes them, or what retention applies.

No governance document, evaluation record or audited management standard for artificial intelligence was located. Ask what the protocol server exposes and what a connected provider may retain, and whether customer documents train the drafting assistant.

This is the one record in the cohort where authenticity is the product rather than the problem, and the grade reflects that. The recipient is a counterparty to an agreement who expects the document, and the entire apparatus around it exists to prove rather than obscure identity: signature certificates, audit trails included on every tier including the free one, passcode verification, knowledge based authentication with identity verification, message verification, optional notarisation, and support for the qualified European signature standard which is legally equivalent to a handwritten signature across all member states.

Where the rest of this cohort is graded on whether a machine is pretending to be a person, this vendor is graded on whether the person signing is who they claim, and it answers that better than anything else in the index. Held below the top band on the question the newer capabilities raise.

A drafting assistant composes document copy and external agents can generate an entire agreement from a prompt, and nothing published states whether a recipient is told that any part of an instrument they are about to be bound by was machine generated. That question carries more weight for a contract than for a marketing email, and the vendor's own compliance positioning for regulated industries makes it sharper rather than softer. Ask whether documents drafted by the assistant or generated by an agent carry any indication of machine authorship.

Integrations cover HubSpot, Salesforce, Pipedrive and Monday, six payment gateways including Stripe, Square and PayPal, Zapier, Greenhouse, QuickBooks and Slack, with quoting built for Pipedrive, HubSpot and Salesforce. The API is available on every plan, limited on Free and metered by Usage Credits above it, alongside document embedding, a developer center and webhooks on Business and Enterprise. Connectors for Claude and ChatGPT through MCP come with every plan in beta. Depth costs extra: CRM integrations start at Business, the Salesforce integration and automation tools consume Usage Credits, and API calls stop when credits run out until more are bought.

A real residency choice exists, it is sold rather than provided, and the architecture around it is described in more detail than the plan comparison suggests. The comparison matrix lists data residency in the United States or the European Union as a capability of the quoted top tier alone, absent from all three tiers beneath it.

That is a genuine election and more than most vendors offer, and it is also a compliance question being priced: a customer whose regulator requires European storage must buy the top tier to get it, whatever their size. Retrieved directly on a second pass, the security pages do name the hosting provider explicitly along with the specific storage and database services in use, describe document data as held in separated locations by type covering metadata, activity, original files and customer content, state that production systems are continuously patched, and name a validated hardware cryptographic module operated in its certified mode for the signing operation.

That is a materially fuller account than the summary sentence elsewhere on the site, which describes the credentials the hosting provider holds rather than the vendor's own arrangements, and it addresses protection of stored data rather than leaving it to inference. What remains absent is what a location obligation actually turns on.

No region is stated for any tier below the one where residency is sold, no tenancy or isolation model is described, and no recovery time or recovery point objective appears anywhere. For a platform storing executed contracts indefinitely, the recovery commitment is the gap that matters most. Ask which regions serve customers below the top tier, what the tenancy model is, and what the recovery objectives are.

Retrieved directly on a second pass, and the security surface is substantially stronger than the plan comparison suggested. The decisive material is contractual rather than promotional. A published security practices document commits the vendor to an audit covering the entire measurement period since the previous one ended, which is a commitment to no gaps between reports rather than a claim to hold one, performed by independent third party security professionals at the vendor's expense and producing a report a customer may request annually.

The same document commits to penetration testing by external experts at least annually and to a year round bug bounty programme for continuous vulnerability scanning. Commitments of that kind sit in an instrument a customer can hold the vendor to, which is a different class of evidence from a marketing page listing badges. Around them sit two further things worth crediting.

There is a working request route rather than an email address: a dedicated page takes a name and an address, presents an agreement to sign, and releases the audited report on completion. And the signing function itself rests on a validated hardware cryptographic module operated in its certified mode, named specifically along with the digital signature standard it meets, which is architecture level detail for the one operation this product exists to perform.

Held below the top band because the verifiable specifics remain absent: no auditor is named, no audit period, date or certificate number appears, the report is confidential and available once a year under agreement, and an independent vendor risk assessor reports finding no public trust portal. Ask for the current report with its audit period and auditor, and the most recent penetration test summary.

PandaDoc publishes four plans: Free at $0 with 5 documents a month, Starter at $19 and Business at $49 per seat a month on annual billing, and Enterprise quoted per seat or per document, with a 14 day trial and no card. Documents created in the app are unlimited on every paid plan; documents created through the API, Zapier, forms, bulk send and other automations draw on Usage Credits, sold in recurring packs whose prices are not on the page.

Overage is published at $3.50 a document on Starter monthly, $2 on Starter annual and $2.60 on Business monthly, and unused allowance does not roll over. Around a dozen capabilities are marked optional or credit based with no price, among them the Salesforce integration, web forms, bulk send, email white labeling, single sign on on Business, configure price quote, workflow automation, HIPAA and premium support, beneath a headline of no extra charges and no fees.

Every plan, the free one included, stores documents without limit with folders, tags, search and an audit trail, and Business adds a contract repository with AI search and AI data extraction. The API, available on every plan through Usage Credits, is the route for bulk retrieval, and documents can be imported in bulk at any tier. What a customer receives of executed agreements and their signature certificates at termination, in what format and for how long, and when data is deleted, is not set out on the pricing page.

The platform sends on every customer's behalf at every tier and publishes nothing about how. Documents reach recipients by electronic mail, which is the delivery mechanism for the entire product rather than an accessory to it, and a document that lands in a spam folder is a deal that stalls for reasons the customer will attribute to the counterparty rather than to their tooling.

Nothing published describes which infrastructure sends, whether mail leaves from vendor domains or the customer's own, what bounce handling applies, or whether any threshold pauses sending. Two published features raise the question rather than settle it.

Email white labelling is offered as a paid addition at the upper tiers, which means mail can leave under the customer's own domain, and nothing states who then configures the sender authentication records or carries the reputational consequence. And bulk send, also a paid addition, dispatches to many recipients at once, which is the volume pattern that makes authentication and bounce discipline matter.

The transactional nature of the correspondence keeps the risk lower than for the outbound products in this cohort. Ask which infrastructure sends, who configures authentication when white labelling is enabled, and what bounce handling applies to bulk send.

The widest coverage statement in this index, published in detail, and the breadth is itself the thing a buyer should weigh. The vendor names its target teams as sales, human resources, marketing, customer success, legal and finance, its industries as software, professional services, education, healthcare and construction, and its ideal customers from freelancers and small teams through mid market to enterprises requiring quoting, advanced compliance and single sign on, with developers named as a segment in their own right.

The tier ladder supports that from a free plan to a quoted enterprise tier with a per document alternative for organisations whose usage does not fit per seat. Regulated coverage is concrete rather than claimed, with health information and regulated medicine records compliance available and the qualified European signature standard extending legal coverage across all member states, and a Spanish locale is published. Held below the top band on two counts.

The horizontal reach that makes coverage broad also makes the product something other than a revenue tool, and a buyer working from this index should weigh that rather than assume a revenue focus. And the vendor's own reference page names a plan with a per result pricing model that does not appear on the pricing page at all, so the plan set a buyer is choosing between is not consistent between two of the vendor's own surfaces. Ask which plans currently exist, and what the per result option covers.