PandaDoc
Hosted platform for building, sending and e-signing proposals and contracts.
Where your files are processed
Reported to upload your files
The vendor states that files are uploaded to their servers. We have not independently tested this.
Hosted web application: documents are uploaded to PandaDoc’s cloud and recipients sign in the browser. The retention or deletion period is marked unverified rather than stated as lasting the life of the account. The retention or deletion period is marked unverified rather than stated as lasting the life of the account.
What it does
A hosted document platform built around proposals, quotes and contracts. You create documents from templates or uploads, drag signature and form fields onto them, then send them for e-signature with an audit trail and a completion certificate. A REST API, embedded signing and CRM integrations let teams automate document generation and sending. The free e-signature tier is capped at sixty sends a year with two recipients per document.
Best for: Sales, legal and operations teams that need reusable quote and contract templates, approval steps and e-signature in one hosted tool.
Worth knowing: Feature gating is steep — negotiated redlining, bulk send, content locking and most admin roles sit in higher tiers or cost extra. The free tier's sixty sends a year with two recipients runs out quickly, and there is no self-hosting or offline option. The free plan also has a five-template limit, and the free-plan guide documents API eligibility for accounts created after 5 June 2026 with their own create and send limits, so not every free account has identical API access and web and API quotas are separate. Authoring a document, adding fields to an uploaded PDF and editing an original PDF's text are three different operations, so the Edit and Convert badges identify the supported operation and plan; exporting a document as PDF does not substantiate broad conversion. Public help pages differ on some free editor fields, so the current entitlement is to be verified rather than silently combined.
Details, and where each comes from
Vendor statements, our own reading of their pages, and the things nobody has established yet, each answered separately. Where we have not confirmed something it says so rather than guessing, and a row nobody has established is greyed out.
- Versions covered
- Web · API
- Website
- pandadoc.com
- Requires an account
- Yes
- Free tier
- Yes
- Watermark on the free tier
- Not verified
- Maximum file size
- Not verified
- Batch processing
- Yes
- Data residency
- Multiple regions
- Open source
- No
- Self-hostable
- No
- Licence
- Proprietary
- Redaction
- No redaction feature
- Programmatic access
- HTTP API
- Last availability check
- We could not check 16 October 2026
Checked automatically by our own runner, not reported by the vendor. The site refused our request (HTTP 429). That is usually bot protection, and it tells us nothing about whether the tool is working.
What the redaction verdict rests on
From the vendor's own documentation, read 22 September 2026. Not tested by us.
What that does not establish: The vendor’s own site was read on 22 September 2026 and contains no mention of redaction, sanitisation, blackout or whiteout. Absence from a vendor’s own material is not proof that a feature does not exist — it may be undocumented, or on a page the reading did not reach — but for a NEGATIVE claim it is the strongest evidence available, and it is weaker than a positive quote. Recorded as such rather than presented as certainty.
What the vendor says
Claims are labelled rather than repeated as fact. Where we have checked something ourselves, it says so and shows when. Checked means we read the vendor's own page and it says what we recorded — not that we tested the behaviour, unless the note says we did.
-
“With our Free plan you can send 60 documents per year, 2 recipients per document.”
Checked by us — the source says this Read 22 September 2026
Confirmed verbatim: the sentence is the article's opening answer. The page gives it a shape the claim does not: on signup you receive 60 documents to use over the next 14 days as "a 'test drive'", and once the trial ends on day 15 the limit resets to a full 60. It also states that the cap is on sending rather than creating — "You can create unlimited documents, but only 60 can be sent for eSignature per year" — and that the allowance is per calendar year, so the reset is not on the anniversary of signup. And the 2-recipient limit is a hard cap on the free plan rather than a default. A reader budgeting around "60 documents per year" should know whether that resets in January or on their own anniversary, and only the page says.
Standing: Re-read and matched byte for byte
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- f1531df85f91b312c6f4b48702b35554777d56a633874f7f226f635ea8370840
How we checked: Re-verified verbatim on 2026-09-22: https://support.pandadoc.com/en/articles/9715030-pandadoc-free-plan-guide re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-21. sourceHash is the SHA-256 of the re-rendered text, held as rv-support-pandadoc-com-en-articles-9715030-pandadoc-free-pla-f7d770b5.txt.
-
“PandaDoc is fully HIPAA-compliant and supports the secure transmission and storage of electronic Protected Health Information (ePHI).”
Checked by us — the source only partly supports this Read 22 September 2026
The sentence is verbatim on the page, under a heading reading "Healthcare: HIPAA Compliance", but the same section attaches a condition the claim omits and which a reader acting on the claim would need — so partial rather than confirmed. The page states: "Execute a Business Associate Agreement (BAA) with PandaDoc before using the platform for any ePHI workflows. Contact your account team to request a BAA." Without that agreement in place, an organisation putting ePHI into the product is not covered by the compliance posture the claim describes, and the claim as recorded would not tell them. Two further facts from the page. PandaDoc lists HIPAA among the frameworks its eSignatures are compliant with, alongside ESIGN, UETA, eIDAS, FERPA and FDA 21 CFR Part 11. And it states that AES-compliant signatures are supported when recipient identity verification is enabled, backed by FIPS-validated AWS CloudHSM cryptographic services. "Fully HIPAA-compliant" is a self-assessment of the vendor's own; the article references no audit report or certificate that could be checked, and we have not checked one.
Standing: Re-read and matched byte for byte
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- c939baa3e5797b2427142688e27f3bedbeab846c3aff31788bdfc2bb797a9a7f
How we checked: Re-verified verbatim on 2026-09-22: https://support.pandadoc.com/en/articles/16640382-pandadoc-esignature-compliance re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-21. sourceHash is the SHA-256 of the re-rendered text, held as rv-support-pandadoc-com-en-articles-16640382-pandadoc-esignat-f8621ea8.txt.
Each claim is quoted from the vendor's own pages. This section describes what we have and have not checked — it is not a judgement about anyone.
Sponsorship is distribution, not an endorsement or a promise of search rankings, AI citations, traffic, or sales. This listing is a free entry, compiled from published sources.