PandaDoc stores document data such as metadata, activity, original files, and customer’s data in different locations while also compiling and generating documents when requested. All data in each location is encrypted at rest with AES-256 and sophisticated encryption keys management.
Security
Your document security is a top priority at PandaDoc. Your business documents contain information that only you and your clients need to see, and we intend to keep it that way. Every day we ensure that our security is parallel with industry standards and compliance.
Certification
PandaDoc is SOC II Type II certified. We can provide an SSAE 18 SOC 2 report and attestations of compliance, upon request. PandaDoc services are hosted on the Amazon AWS platform and this document details the ways in which we leverage the massive investments that Amazon continues to make in security to the benefit of our customers.
GDPR compliance
PandaDoc recognizes that protecting privacy requires a holistic security program. We’ve completed extensive research and created a resources page with detailed information explaining what GDPR is and how PandaDoc is compliant.
Physical security
PandaDoc data centers (handled by Amazon AWS) are state of the art, utilizing innovative architectural and engineering approaches. Amazon has many years of experience in designing, constructing, and operating large-scale data centers. This experience has been applied to the AWS platform and infrastructure.
Third-party Subprocessors
PandaDoc currently uses third-party Subprocessors to provide various business functions after due diligence to evaluate their defensive posture and executes an agreement requiring each Subprocessor to maintain minimum acceptable security practices.
FERPA
PandaDoc helps schools facilitate electronic communication between educators, administrators, and school districts and parents and students in full compliance with FERPA (20 U.S.C. § 1232g; 34 CFR Part 99) as to protect the privacy of student education records.
Privacy Shield
PandaDoc relies on its annual certifications under both the EU-U.S. and Swiss-U.S. Privacy Shields for its cross-border transfers of data to its U.S. based AWS data centers.
Software security
Responsible Vulnerability disclosure
In case you found a vulnerability, please follow Responsible Vulnerability Disclosure Process to report it to our Security team.