Is PandaDoc Secure? Security, Compliance and E-Signature Legality Explained

Yes: PandaDoc is SOC 2 Type II audited, encrypts stored documents with AES-256, offers a choice of US or EU data storage, signs HIPAA Business Associate Agreements, and produces e-signatures that satisfy the US ESIGN Act and UETA, with support up to qualified electronic signatures (QES), the highest tier under the EU and UK eIDAS framework. For most security questionnaires, the platform itself is not the weak point: the configuration your team runs it with is.

This guide is written for the person who gets handed the vendor review late in the deal: the IT lead, the ops manager, or the founder wearing both hats. It covers what PandaDoc certifies, how documents are protected, how signer identity is verified, which access controls exist on which plan, and what to configure before the first real proposal goes out. Every compliance claim below was verified on PandaDoc’s own security and HIPAA pages in November 2026; packaging changes, so re-check anything load-bearing before you sign.

Key takeaways

• PandaDoc holds a SOC 2 Type II attestation (SSAE 18) and will share the latest report under NDA on request: ask sales, do not hunt for a download link.
• E-signatures are legally binding in the US under the ESIGN Act and UETA, and PandaDoc supports the full eIDAS range in the EU and UK, up to qualified electronic signatures.
• HIPAA, GDPR, CCPA, FERPA and 21 CFR Part 11 are all covered, and PandaDoc signs a Business Associate Agreement for healthcare customers.
• Documents are encrypted at rest with AES-256, signing keys live in AWS CloudHSM running in FIPS mode, and you can choose US or EU data residency.
• Two-factor authentication via authenticator app is available on every plan, but it cannot be enforced account-wide from inside PandaDoc: org-wide enforcement requires SSO, which is included on Enterprise and a paid add-on on Business.
• The most common real-world gap is not the platform, it is the account: everyone an admin, no 2FA, no signer verification on sensitive documents. Day-one configuration closes it.

Is PandaDoc legally binding?

The question behind the question in most reviews. In the United States, electronic signatures have carried the same legal weight as ink since the ESIGN Act (2000) and UETA, provided four conditions hold: the signer intended to sign, consented to do business electronically, the signature is associated with the record, and the record is retained. PandaDoc’s signing flow is built around exactly those four requirements: the signer takes a deliberate signing action, consents on screen, the signature is embedded in the document, and the completed record is stored with its history.

In the EU and UK, the eIDAS regulation defines three tiers: simple, advanced and qualified electronic signatures. PandaDoc supports the full range, including QES, the qualified tier that is legally equivalent to a handwritten signature across EU member states. Most B2B proposals and service agreements do not need QES; knowing it is available matters mainly to teams selling into regulated European buyers.

Two practical notes. First, legality was never really the risk for a proposal or order form: enforceability disputes turn on evidence, which is what the audit trail section below is for. Second, a small set of document types (wills, certain property transfers, some court filings, varying by jurisdiction) still require wet ink or notarisation, and no e-signature platform changes that. For the broader signing mechanics, our PandaDoc e-signature guide covers the day-to-day workflow.

The certification and compliance list, verified

As of November 2026, PandaDoc’s security page states the following. Each item here is a claim PandaDoc publishes about itself; for anything contractual, get it in writing from them.

SOC 2 Type II. PandaDoc is SOC 2 Type II compliant under SSAE 18, and offers the latest report and attestation on request. Type II matters because it audits controls operating over a period, not a point-in-time snapshot. If your questionnaire requires the report itself, request it through their sales or security contact; it is shared under NDA, not published.

GDPR and CCPA. PandaDoc states compliance with GDPR (lawful processing, data minimisation, individual rights, security safeguards) and with CCPA. A data processing agreement is part of the standard paperwork for European customers, and the EU data residency option below is the companion control.

HIPAA. PandaDoc states compliance with the HIPAA Privacy Rule and the Administrative, Physical and Technical Safeguards of the Security Rule, and signs a Business Associate Agreement (BAA) with healthcare customers who will transmit or store electronic protected health information. The BAA is arranged through sales rather than self-serve, and no specific plan is named publicly as the HIPAA tier, so healthcare teams should confirm plan requirements in the same conversation.

FERPA. For schools and education providers, PandaDoc states FERPA compliance for handling student records.

21 CFR Part 11. For life sciences teams, PandaDoc offers Part 11-compliant workspaces with enhanced signer verification, audit trails and strict access controls. This is a workspace-level configuration, which pairs naturally with the brand and entity separation covered in our PandaDoc workspaces guide.

PCI DSS. PandaDoc does not process, store or transmit card data itself; payments run through PCI DSS compliant processors such as Stripe. For a reviewer, that means card-data scope stays with the gateway, not with PandaDoc.

How PandaDoc protects document data

Encryption. Stored data is encrypted at rest with AES-256 with managed keys. Document signing uses AWS CloudHSM running in FIPS mode, which PandaDoc describes as FIPS 140-3 certified hardware aligned with the FIPS 186-5 digital signature standard. In plain terms: the cryptographic keys that make a signature tamper-evident live in dedicated hardware, not in application code.

Infrastructure. The platform runs on AWS (Amazon RDS and S3 are named), with the web application split into front-end, mid-tier and database layers in a DMZ configuration, and production networks logically isolated from corporate, QA and development. Databases are backed up daily, with backups encrypted.

Data residency. Customers can choose US or EU data storage and processing. For European teams whose legal or procurement review requires EU residency, this is a configuration decision to make at account setup, before documents accumulate in the wrong region.

Monitoring and testing. Production is monitored 24/7/365 with on-call escalation. PandaDoc’s HIPAA page additionally cites external penetration tests, internal vulnerability scanning and risk reviews, and development follows OWASP guidelines with a published responsible disclosure process.

A reviewer reading that list will notice what it is: standard, well-executed SaaS security architecture. PandaDoc is not an outlier in either direction here, which is the correct answer for a platform holding your proposals and contracts.

Verifying who signed: identity checks and the audit trail

Enforceability disputes are evidence disputes, and this layer is where the evidence comes from.

Recipient verification. PandaDoc offers four signer identity methods: a passcode you share out of band, SMS verification to the signer’s phone, knowledge-based authentication (KBA, the public-records quiz used for US regulated signing, available on Business and Enterprise), and ID Check, where the signer photographs a government ID. None of these are on by default. For routine proposals most teams rightly skip them; for high-value contracts, HR documents or anything a counterparty might later deny signing, turning one on is a checkbox, not a project.

The audit trail and signature certificate. Every document carries an event history: sends, views, verification attempts, field completion and signing, with timestamps, and completed documents get a signature certificate. The audit trail is on by default per workspace and exports to CSV. What the trail records, how per-recipient analytics work, and the gotchas around editing sent documents are covered in depth in our PandaDoc document tracking guide; for a security review, the relevant point is that the evidence layer exists, is tamper-evident, and does not depend on anyone remembering to switch it on.

Controlling who gets in: 2FA, SSO and roles

This is the section where plan gating actually bites, so here it is precisely, verified on PandaDoc’s help centre in November 2026.

Two-factor authentication. 2FA via authenticator app (Google Authenticator, Authy and similar) is available on every plan. SMS-based 2FA is available on Starter, Business and Enterprise, but not on free eSign accounts or trials. Physical security keys are not supported. The important limitation: admins cannot enforce 2FA account-wide from inside PandaDoc. Each user enables it individually, and the account owner can only see who has not, under Settings, All users. If your policy requires enforced MFA, the supported route is SSO with enforcement at your identity provider.

Single sign-on. SSO is SAML 2.0, with Okta, Microsoft Entra ID, Google Workspace, OneLogin, AD FS, Salesforce and Auth0 among the documented providers, plus SCIM 1.1 and 2.0 for automated provisioning and deprovisioning. It is included on Enterprise and available on Business as a paid add-on at $20 per seat per month ($240 per year). With SCIM 2.0 configured, removing a user in your identity provider removes them from PandaDoc, which is the deprovisioning answer most questionnaires are looking for.

Roles and permissions. Access control inside the account runs on five built-in roles plus Enterprise custom roles, and it is the enforcement layer for everything else: locked templates, catalog pricing, approval routing. It is also the control teams most often misconfigure, usually by making everyone an admin. The full role map, the least-privilege pattern for a sales team, and the four common misconfigurations are in our PandaDoc roles and permissions guide.

What to configure on day one

PandaDoc’s platform controls pass most reviews. Accounts fail them. The gap between the two is about an afternoon of configuration, and it belongs inside PandaDoc onboarding rather than after the first incident:

1. Set the role map before inviting the team. Reps as members, one or two managers, a deliberately short admin list, and a named backup for the account owner.
2. Enable 2FA for every user, starting with admins. Since it cannot be forced from inside PandaDoc, make it an onboarding checklist item and have the account owner audit the user list monthly, or put SSO in front of it.
3. Decide data residency immediately if EU processing matters to you. This is far easier at setup than after a year of documents.
4. Confirm the audit trail is on in each workspace, and leave it on.
5. Pick a signer verification default for sensitive document types. Routine proposals can stay frictionless; contracts above a threshold get passcode or SMS verification as a standing rule.
6. Put ownership transfer on the leaver checklist. Billing and workspace creation are locked to the account owner role, and recovering an orphaned owner account means a support ticket.
7. If you handle PHI, get the BAA signed before the first document, not when the compliance officer finds out.

In the implementations we run, the security configuration is rarely why a team called us: of the 129 sales calls we analysed, 82 cited manual proposal creation time as the driving pain, and security came up as a procurement gate, not a goal. But it is the part of a PandaDoc implementation that costs almost nothing to do correctly at the start and the most to retrofit under pressure.

Security questionnaire quick answers

The questions that come up on almost every vendor review, with the short answer and where it depends on plan. Every answer is drawn from the sections above, verified on PandaDoc’s own pages in November 2026.

Questionnaire item	Short answer	Plan or condition
SOC 2 Type II report	Yes, SSAE 18, shared under NDA on request	Request through PandaDoc sales or security
Encryption at rest	AES-256 with managed keys	All plans
Signing key protection	AWS CloudHSM in FIPS mode	All plans
Data residency	US or EU storage and processing	Choose at account setup
HIPAA BAA	Yes, signed for customers handling ePHI	Arranged through sales; confirm the plan in the same conversation
GDPR and CCPA	Stated compliance; DPA for European customers	All plans
21 CFR Part 11	Part 11-compliant workspaces	Workspace-level configuration
Card data (PCI DSS)	Not processed by PandaDoc; runs through processors such as Stripe	Payment gateway holds PCI scope
E-signature legality	ESIGN Act and UETA in the US; eIDAS up to QES in the EU and UK	All signing
MFA	Authenticator-app 2FA per user; SMS 2FA on Starter, Business and Enterprise	Cannot be enforced account-wide without SSO
SSO and SCIM	SAML 2.0, SCIM 1.1 and 2.0	Included on Enterprise; $20 per seat per month add-on on Business
Signer identity verification	Passcode, SMS, KBA, ID Check	KBA on Business and Enterprise; all off by default
Audit trail	Event history plus signature certificate, CSV export	On by default per workspace

If the questionnaire is holding up a deal and the account behind it has not been reviewed since setup, the PandaDoc onboarding service covers the role map, 2FA coverage and workspace settings, or you can book a free call and we will tell you which rows your current configuration actually passes.

What a reviewer should still check

An honest list of what this article cannot settle for you:

• The SOC 2 report itself. Claims on a marketing page are not evidence; request the report and read the exceptions section like you would for any vendor.
• Plan gating for your specific controls. SSO on Business is an add-on, KBA needs Business or Enterprise, and PandaDoc’s packaging has shifted more than once. Confirm the features your policy requires are on the tier you are buying.
• Your own retention and deletion obligations. PandaDoc retains completed documents; whether that satisfies or conflicts with your retention schedule is a question about your policy, not their platform.
• Subprocessors. PandaDoc states all subprocessors meet its security and data processing standards; regulated teams should pull the current subprocessor list as part of the DPA review.
• The configuration audit. If PandaDoc is already live in your business and nobody has looked at roles, 2FA coverage or workspace settings since setup, assume drift. That review is quick, and it is the part we most often find undone.

FAQ

Is PandaDoc safe for confidential documents?

Yes, with the same qualifier as any document platform: the controls have to be used. Storage is AES-256 encrypted on AWS with US or EU residency, access can be restricted by role and workspace, and sensitive documents can require signer identity verification. The realistic risk is a loose account configuration, not the platform’s cryptography.

Does PandaDoc sign a HIPAA BAA?

Yes. PandaDoc signs Business Associate Agreements for customers handling electronic protected health information, arranged through their sales team rather than self-serve. No plan is publicly named as the HIPAA tier, so confirm plan requirements when you request the BAA, and have it signed before any PHI touches a document.

Are PandaDoc signatures legally binding in court?

PandaDoc signatures meet the ESIGN Act and UETA requirements in the US and the eIDAS framework in the EU and UK, up to qualified electronic signatures. What wins a dispute is evidence: the audit trail, the signature certificate and any identity verification you enabled, all of which PandaDoc records automatically on completed documents.

Can we force every user to turn on two-factor authentication?

Not from inside PandaDoc. 2FA is enabled per user (authenticator app on all plans, SMS on Starter, Business and Enterprise), and admins can only see who has not enabled it. To enforce MFA account-wide, put SAML SSO in front of PandaDoc (included on Enterprise, a $20 per seat monthly add-on on Business) and enforce the second factor at your identity provider.

Where is PandaDoc data stored?

On AWS, with a customer choice of US or EU storage and processing. Teams with EU data residency requirements should select the EU region at account setup, since moving an established account’s documents later is a migration, not a toggle.