# Penpot — Design

Penpot by Kaleidos Subsidiary S.L. holds a panel rating of 2.5/5 from 6 AI judges (category median 2/5), as of 2026-10-15. Provenance: EU-Made; sovereignty: not determined.

- Vendor: Kaleidos Subsidiary S.L. (https://penpot.app)
- Category: [Design](https://whats-best.ai/software/design.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/design/penpot
- Alternatives: https://whats-best.ai/software/design/penpot/alternatives ([markdown](https://whats-best.ai/software/design/penpot/alternatives.md))
- Data as of: 2026-10-20 · evaluated 2026-10-15 · oldest source captured 2026-10-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Kaleidos Subsidiary S.L.
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Yes, per the vendor’s own page [S6]

## The panel's verdict

Penpot, an open-source design and prototyping tool from Kaleidos Subsidiary S.L., scores highest on file ownership and portability at 8-9: an MPL 2.0 core, files on SVG, CSS and HTML, import of.penpot,.zip,.svg and.json, a Figma exporter in the vendor's repository, self-hosting down to air-gapped deployment, and sole ownership of uploaded content written into the terms. Design and prototyping scores run 7-8 on built-in tokens, variants and shared, synced libraries. AI and content rights runs 2-3 — the AI offer is any agent or LLM, and the only named generative model, a fine-tuned OpenAI model, belongs to a community plugin — and pricing transparency runs 2-4: no price figure appears on the captured pricing pages, and Enterprise says only "Penpot Enterprise - check pricing". Sovereignty splits the bench, 3 to 7: high scores credit the named entity, a published data processing agreement, EU or US hosting choice and self-hosting to air-gapped; the data protection officer's 3 holds that the captured pages leave jurisdiction, ownership and residency unconfirmed, and no subprocessor list beyond payment providers as a category.

**Speaks for it:**
- Files are based on open standards (SVG, CSS and HTML), with import of.penpot,.zip,.svg and.json and a Figma exporter in the vendor's public repository
- Self-hosting is documented from Docker through Helm charts, OpenShift, Rancher and TrueNAS to air-gapped deployment, optionally behind a VPN or zero-trust layer with your own identity provider
- The terms name the user as sole owner of uploaded content, and self-hosted deployments are stated to continue running
- Inspect mode expresses designs as real HTML, CSS and SVG, stated as free for developers, alongside an API with access tokens, a plugin system and an open MCP server
- Design tokens for colour, typography, spacing and themes are built in without a plugin, and components publish as shared, synced libraries

**Held against it:**
- No price figure appears on any captured pricing page — tiers state "Up to 8 team members, and unlimited viewers" with storage up to 10GB and 25GB — and Enterprise says only "Penpot Enterprise - check pricing"
- The only evidenced generative capability is a community plugin, Rapid Prototyping with AI by ramby.ai, running a fine-tuned OpenAI model under a no-guarantee disclaimer
- We found no public information on whether customer files train models, on commercial-use rights or indemnity for generated output, or on where AI processing runs
- Brand asset governance scores run 3-4: we found no public information on locked templates, brand guidelines published in the tool, or rights, usage and expiry metadata on assets
- The privacy policy names payment service providers only as a category, and we found no published subprocessor list with names, locations and purposes

**Best for:**
- You need to run design tooling on your own infrastructure — file ownership and portability scores run 8-9, with self-hosting down to air-gapped deployment behind your own VPN and identity provider
- You want engineers and stakeholders in the file without paying seats — inspect output is stated free for developers and viewers are unlimited
- You are moving work between tools — import of.penpot,.zip,.svg and.json plus a Figma exporter in the vendor's repository are documented
- You manage a design system in-tool — design and prototyping scores run 7-8 on built-in tokens, variants and shared, synced libraries

**Avoid if:**
- You must compute an annual cost from public pages before signing — the captured pricing pages show no price figures and Enterprise says only "Penpot Enterprise - check pricing"
- You need vendor-guaranteed generative AI with defined output rights — the one named model belongs to a community plugin the vendor does not guarantee
- You need non-designers producing on-brand material from locked templates — the captured pages show share libraries and browsable templates, and we found no public information on locked elements or in-tool brand guidelines
- Your cloud procurement requires a published subprocessor list and confirmed data residency — the privacy policy names payment service providers only as a category, and the captured pages leave residency unconfirmed

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The Product Designer | The Frontend Engineer | The Brand Marketer | The Agency Owner | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Design, prototyping & design systems | 4/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Collaboration, review & developer handoff | 3/5 | 3.5/5 | 3/5 | 3/5 | 3/5 | 3.5/5 |
| Brand assets & governance | 2/5 | 2/5 | 1.5/5 | 1.5/5 | 2/5 | 2/5 |
| Files, formats & portability | 4.5/5 | 4.5/5 | 4/5 | 4/5 | 4.5/5 | 4.5/5 |
| AI features & rights to the work | 1/5 | 1/5 | 1.5/5 | 1.5/5 | 1/5 | 1/5 |
| European sovereignty | 3.5/5 | 3.5/5 | 2.5/5 | 2/5 | 1.5/5 | 2.5/5 |
| Pricing transparency | 2/5 | 2/5 | 1/5 | 1.5/5 | 1/5 | 1/5 |
| **Weighted verdict** | **3/5** | **3.5/5** | **2/5** | **2.5/5** | **2/5** | **2.5/5** |

### The judges

- **The Product Designer** (v1.0): Owns the design system of a B2B software product. Wants components with variants, tokens with modes, prototypes that test a real flow, and library releases that are versioned and reviewable — a design system is a product, not a page of nicely arranged buttons.
- **The Frontend Engineer** (v1.0): Turns the designs into code and gets the ticket when they disagree. Wants an inspect mode without a paid seat, tokens exported in a documented format, components mapped to the code ones, and an API that reads the whole file rather than a screenshot of it.
- **The Brand Marketer** (v1.0): Keeps the brand consistent across twelve sales offices that make their own flyers. Wants locked templates non-designers can use, guidelines inside the tool, licence and expiry dates on every stock image, and a clear answer on whether a generated image may go on a trade-fair stand.
- **The Agency Owner** (v1.0): Runs a design agency of fifteen and hands every project over to the client at the end. Wants files that export with layers and components intact, guests who are not billed as editors, and terms that say the client owns the work — and what happens to it after a cancellation.
- **The Data Protection Officer** (v1.0): Reviews every tool where unreleased products, customer screenshots and employee photos end up. Wants the contracting entity and hosting region named, the AI providers on the subprocessor list, and training on customer files excluded for the whole organisation in the terms — not behind a toggle each user has to find.
- **The Skeptic** (v1.0): Has read "free for viewers", "commercially safe AI" and "export anytime" on every page in this category. Reads instead for the click that turns a reviewer into a billed editor, the plan the IP indemnity actually covers, and whether the export keeps a single component.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Data retention: as long as commercial relationship is maintained or deletion requested · 2 [S3]
- DPA: yes [S1]
- DPA: yes [S2]
- DPA: yes [S5]
- DPA: yes [S7]
- DPA: yes [S1]
- DPA available: yes [S11]
- DPA available: yes [S5]
- DPA exists: yes [S9]
- GDPR: yes [S10]
- GDPR: yes · deployed for orgs requiring it · deployed for orgs requiring it [S2]
- GDPR SOC 2 HIPAA: yes · deployed for orgs requiring · deployed for orgs requiring [S2]
- International transfers: adequate guarantees · Standard Contractual Clauses of the European Commission [S3]
- Odr: yes [S4]
- Policies incorporated: yes · yes · yes [S4]
- Rights: www.aepd.es [S3]
- Security measures: yes [S3]
- Security page: yes [S5]
- SOC 2 HIPAA deployments: deployed at orgs requiring it · deployed at orgs requiring it [S10]

**Data**
- License grant: worldwide non-exclusive license to host, copy, access, process and transmit user content [S4]
- Metadata analysis: no · yes [S4]
- Ownership: yes [S4]

**Hosting**
- Customer control: Self-hosting runs Penpot on customer's own infrastructure [S10]
- Deployment options: private cloud · on-premise · air-gapped [S10]
- Docker support: yes · Docker [S10]
- Elestio support: yes · Elestio [S10]
- Kubernetes support: yes · Kubernetes [S10]
- Openshift support: yes · OpenShift [S10]
- Options: cloud · self-host [S2]
- Podman support: Podman · no [S10]
- Rancher support: yes · Rancher by SUSE [S10]
- Region choice: EU · US · yes [S2]
- Self host: yes · yes [S8]
- Self host: yes [S7]
- Selfhost requirements: Linux server · Docker [S2]
- Selfhost sizing: 5 · 50 · 100 [S2]
- Selfhost updates: scheduled releases with change management support · pull from repository [S2]
- Truenas support: yes · TrueNAS [S10]

**Integrations**
- API: yes [S1]
- API: Integration & API page listed [S6]
- API: yes [S6]
- API exists: yes [S9]
- API page: yes [S8]
- API tokens: yes · yes · yes [S7]
- API tokens: yes · yes · SaaS · self-host [S7]
- Data transfer categories: payment service providers (banks, payment gateways) [S3]
- Figma exporter: github repository · yes [S8]
- Figma plugin: Figma export plugin in development [S2]
- Import formats: .penpot · .zip · .svg · .json [S8]
- Integration API: yes [S9]
- Mcp server: yes [S7]
- Mcp server: yes [S9]
- Migration partners: yes [S2]
- Open API: yes · yes [S10]
- Plugin install URL: https://ramby.ai/plugin/manifest.json [S12]
- Plugins: yes [S9]
- Plugins: yes [S7]
- Vendor contracts: yes [S3]

**Legal**
- Address: Madrid · Max Aub, 5,Bajo B, 28003 · Spain [S4]
- Company: KALEIDOS Subsidiary SL [S10]
- Company: KALEIDOS Subsidiary SL [S9]
- Controller: Kaleidos Subsidiary S.L · B24967721 · Max Aub, 5, Bajo B, 28003, Madrid, Spain [S3]
- Data processing agreement: yes [S8]
- Data processing agreement: yes [S10]
- Data processor role: Terms of Service [S3]
- Documents: Terms & conditions · Privacy policy · Cookie policy · Data processing agreement · Whistleblowing [S12]
- DPA: Data processing agreement published [S6]
- DPA: yes [S2]
- DPA available: yes [S9]
- Entity: KALEIDOS Subsidiary SL [S1]
- Entity: KALEIDOS Subsidiary SL [S2]
- Entity: KALEIDOS Subsidiary SL [S5]
- Entity: Kaleidos Subsidiary S.L [S4]
- Entity: KALEIDOS Subsidiary SL [S6]
- Entity: KALEIDOS Subsidiary SL [S7]
- Entity: 2026 · KALEIDOS Subsidiary SL [S8]
- Entity: KALEIDOS Subsidiary SL [S11]
- Entity: 2026 · KALEIDOS Subsidiary SL [S12]
- Entity: KALEIDOS Subsidiary SL [S1]
- Entity: KALEIDOS Subsidiary SL [S2]
- Entity: KALEIDOS Subsidiary SL · 2026 [S5]
- Entity: 2026 · KALEIDOS Subsidiary SL [S6]
- Governing law: Spain [S4]
- Jurisdiction: Courts of the City of Madrid [S4]
- Language: English [S4]
- Last updated: 2025-08-05 [S4]
- Plugins terms: yes [S12]
- Tax id: B24967721 [S4]
- Vendor entity: KALEIDOS Subsidiary SL [S9]

**Pricing**
- Cancellation: yes · yes [S4]
- Currency: USD [S2]
- Currency: USD [S2]
- Discounts: yes [S2]
- Discounts: non-profit · education · open-source · yes [S2]
- Enterprise: 25 [S2]
- Enterprise features: advanced governance, centralized administration, team permissions, secure collaboration [S2]
- Enterprise tier: no · yes [S10]
- Enterprise vs professional: enterprise = professional + org management, governance, central admin [S2]
- Free open source: yes · yes · yes [S8]
- Free signup: yes [S7]
- Private server: Private Server · 50000 [S2]
- Private server: 50000 [S2]
- Private server features: dedicated infrastructure, custom hosting, advanced security, enterprise-grade support [S2]
- Professional: 0 [S2]
- Unlimited: 175 · 7 [S2]
- Unlimited features: extra space, extended history, early features [S2]
- Unlimited trial: 14 [S2]
- Unlimited trial: 14 · yes [S2]

**Product**
- Access control selfhost: Self-hosted instances can run behind VPN, reverse proxy, zero-trust access layer, and connect to existing identity provider [S10]
- Account required: yes [S4]
- AI workflows: AI agent/LLM integration for code-to-design, design-to-code, design-to-design workflows [S1]
- AI workflows: AI agent/LLM integration across code-to-design, design-to-code, design-to-design [S1]
- Animated transitions: animated transitions between screens [S5]
- Animated transitions: yes [S5]
- API integration: yes [S5]
- API integration: yes [S5]
- Author community contributed: yes [S9]
- Author website: https://laurakalbag.com [S9]
- Autosave versions: 30 · 7 [S2]
- Browser based: no [S8]
- Code inspect: yes · yes [S8]
- Code standards: CSS · HTML · SVG · JSON · yes [S1]
- Code standards: CSS, HTML, SVG, JSON and open file format [S1]
- Collaborative design: collaborative UI design tool [S8]
- Color contrast plugin compat: color accessibility checking · Color Contrast plugin [S9]
- Color palette kit author: Laura Kalbag [S9]
- Color palette kit category: UI kits · Libraries [S9]
- Color palette kit contrast plugin: Color Contrast plugin · color accessibility checking [S9]
- Color palette kit description: Starter kit for an app color palette using asset colors. Importable as template; can be published as a library. [S9]
- Color palette kit dynamic demos: Editing an asset color updates its demo accordingly [S9]
- Color palette kit exists: Color palette kit - Color assets edition · yes [S9]
- Color palette kit updated: 2025-12-22 · 2025-12-22 [S9]
- Color token edition: color design tokens edition [S9]
- Color tokens edition exists: yes [S9]
- Communication domains: mailpenpot.app · getstartedwithpenpot.com · penpot.app [S3]
- Community plugin disclaimer: Community-developed plugin; Penpot does not guarantee everything will work perfectly; issues can be reported via the Report this plugin button [S12]
- Community sourced: yes [S9]
- Components libraries: Components can be published as libraries shared and synced across teams [S6]
- Components reusable: Reusable components, publishable as shared and synced libraries [S6]
- Containers: cards · accordions · boxes · CSS Grid · Flex Layouts [S8]
- Continuity: self-hosted continue running; standard file formats; no lock-in [S2]
- Cross platform: Windows · Mac · Linux · browser [S8]
- Css grid flex: CSS Grid and Flex Layouts listed as key features [S6]
- Dashboards: yes [S8]
- Data continuity: yes [S2]
- Demo update behavior: Asset color edits update demos accordingly [S9]
- Deployment agnostic: yes · private cloud · on-premise · air-gapped [S10]
- Design system elements scope: Create reusable elements (buttons, menus, paddings) within the design system [S6]
- Design systems: Design components, native design tokens, shared libraries [S1]
- Design systems: Components, Variants, Design Tokens, Shared Libraries [S2]
- Design systems: yes [S5]
- Design systems: yes · yes · yes [S7]
- Design systems: Design components, native design tokens, shared libraries [S1]
- Design systems: Components · Variants · Design Tokens · Shared Libraries [S2]
- Design systems libraries: Libraries, templates, design systems shared across organization; community libraries & templates reusable [S7]
- Design tokens: yes [S5]
- Design tokens: no · yes [S7]
- Design tokens: yes [S8]
- Design tokens: Design Tokens · Design Systems · CSS Grid and Flex Layouts [S5]
- Design tokens feature: Design Tokens [S9]
- Design tokens native: no · yes [S6]
- Design tokens native: Penpot integrates native design tokens, no plugin needed [S6]
- Design tokens native: Built-in design tokens without plugin [S7]
- Design tokens scope: Color, typography, spacing and more themes [S6]
- Design tokens scope: Design tokens cover color, typography, spacing and themes [S6]
- Dev design same tool: Designers and developers use the same tool [S7]
- Dev tools: code inspector · CSS properties · SVG access · plugins · API [S2]
- Developer tools: code inspector, CSS properties, SVG access, plugins, API [S2]
- Download available: yes [S9]
- Enterprise: yes [S7]
- Enterprise: Enterprise offering exists [S6]
- Enterprise edition: yes [S5]
- Enterprise hosting region: EU · US · yes [S2]
- Enterprise ip whitelisting: yes [S2]

**Support**
- Enterprise SLA: yes · 4 [S2]
- Help center: yes [S5]
- Help center: Help center available [S6]
- Help center exists: yes [S9]
- Self host plans: yes [S10]
- Selfhost plans: Self-Host Support plans offer dedicated professional support [S10]

168 more facts on the canonical page: https://whats-best.ai/software/design/penpot

## Questions

### Is Penpot European?

Yes. whats-best.ai classifies Penpot as EU-Made.

### Where does Penpot store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Penpot have a free plan?

Yes. Penpot has a free plan, per [the vendor’s page captured 1 Oct 2026](https://whats-best.ai/evidence/6385).

### What are the best alternatives to Penpot?

As of 16 Oct 2026, the panel rates [Sketch (2.5/5)](https://whats-best.ai/software/design/sketch), [Frontify (2.5/5)](https://whats-best.ai/software/design/frontify) and [Figma (2.5/5)](https://whats-best.ai/software/design/figma) highest among the other 13 Design products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Sketch](https://whats-best.ai/software/design/sketch) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Penpot alternatives](https://whats-best.ai/software/design/penpot/alternatives).

## What this page leaves out

- 16 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 6 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 6 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://penpot.app/ (checked 2026-10-13)
- [S2] Pricing page: https://penpot.app/pricing (checked 2026-10-13)
- [S3] Privacy policy: https://penpot.app/privacy-policy (checked 2026-10-13)
- [S4] Terms of service: https://penpot.app/terms (checked 2026-10-13)
- [S5] Design, prototyping & design systems — found from sitemap: https://penpot.app/design/prototyping (checked 2026-10-13)
- [S6] Design, prototyping & design systems — found from sitemap: https://penpot.app/design/design-systems (checked 2026-10-13)
- [S7] Collaboration, review & developer handoff — found from sitemap: https://penpot.app/collaboration (checked 2026-10-13)
- [S8] Collaboration, review & developer handoff — found from sitemap: https://penpot.app/design/collaborative-UI-design-software (checked 2026-10-13)
- [S9] Brand assets & governance — found from sitemap: https://penpot.app/penpothub/libraries-templates/color-palette-kit-assets (checked 2026-10-13)
- [S10] Files, formats & portability — found from sitemap: https://penpot.app/self-host (checked 2026-10-13)
- [S11] Files, formats & portability — found from sitemap: https://penpot.app/penpothub/plugins/svg-exporter (checked 2026-10-13)
- [S12] AI features & rights to the work — found from sitemap: https://penpot.app/penpothub/plugins/rapid-prototyping-with-ai (checked 2026-10-13)

---

Cite as: whats-best.ai, "Penpot — Design", AI panel analysis, as of 2026-10-20. https://whats-best.ai/software/design/penpot

Corrections: https://whats-best.ai/correct/598?target=page