E-Signature
Penneo
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Penneo A/S · penneo.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Penneo at a glance
- Vendor
- Penneo A/S
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Default not stated; pages mention the EU source, captured 1 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 13 Oct 2026
- Panel verdict
- The AI panel rates Penneo 2.5/5, the mean of 6 judges. Penneo is an e-signature SaaS from Penneo A/S in Copenhagen, offering advanced and qualified signatures through named national eIDs — MitID, MitID Erhverv and Swedish BankID at the advanced level; itsme, MitID QES, Norwegian BankID, Belgian eID, AusweisApp or passport at the qualified one — with Penneo itself named as the trust service provider under eIDAS and certificates, signatures, seals and timestamps generated on HSMs in Danish data centres. how scores are made
- As of
- Vendor pages captured 1 Oct 2026 to 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Penneo is an e-signature SaaS from Penneo A/S in Copenhagen, offering advanced and qualified signatures through named national eIDs — MitID, MitID Erhverv and Swedish BankID at the advanced level; itsme, MitID QES, Norwegian BankID, Belgian eID, AusweisApp or passport at the qualified one — with Penneo itself named as the trust service provider under eIDAS and certificates, signatures, seals and timestamps generated on HSMs in Danish data centres. The bench scored it highest on integration and API, 6 to 7, and on sovereignty, 6 to 7, citing a documented REST API with webhooks, a sandbox and single-request case files, and EU data centres on AWS — though CRM subprocessors Salesforce and Clari process data in the EU and US under the Data Privacy Framework, and independently sourced ownership and residency details came back unconfirmed. Pricing transparency is the weakest criterion, 2 to 4: add-on prices are published exactly, but the captured pages give no plan prices or envelope limits, and MitID QES and Penneo Verify are 'On request'. Signature levels, signing workflow and evidence and retention range 4 to 6.
Speaks for it
- Every action is logged, timestamped and cryptographically sealed into a permanently archived evidence chain, with archive documents kept until the end user deletes them.
- A documented REST API offers OAuth short-lived tokens, real-time webhooks at every event, a sandbox and single-request casefile creation.
- Customer data is stored in EU data centres on AWS, and a subprocessor list with per-recipient locations is published.
- The published accessibility statement covers screen-reader support, full keyboard navigation and 200% text scaling.
- Advanced and qualified signatures are labelled with named national eID methods, and itsme is stated to cover all 27 EU countries plus the UK, Norway and Iceland.
Held against it
- We found no public information on subscription plan prices or envelope and document limits, so a month's signing volume cannot be priced.
- MitID QES and Penneo Verify are listed 'On request', leaving the cost of the Danish qualified route unstated.
- We found no public information on templates, field placement, signing order or automatic reminders, and tailored signing flows cost DKK 20,000 per flow.
- We found no public link to an EU Trust List entry or a mapping of which plan and country delivers which signature level.
- We found no public information on long-term validation (PAdES-LTV) or on a validation tool or report.
Best for
- You send documents across the EU and need qualified signatures — itsme is stated to cover all 27 EU countries plus the UK, Norway and Iceland, and passport or national ID card signing is priced at DKK 12 per signature.
- Your developers are embedding signing into existing systems — integration and API scored 6 to 7, with a REST API, webhooks, a sandbox and single-request case files.
- You need evidence that stands up years later — every action is logged and sealed, and archive documents are kept until the end user deletes them.
- You want EU data residency with published subprocessor locations — customer data is stored in EU data centres and HSMs sit in Danish data centres.
Avoid if
- You must budget a Danish qualified-signature volume before talking to sales — MitID QES and Penneo Verify are listed 'On request', and the captured pages give no plan prices.
- Your team builds its own templates with signing order and automatic reminders — we found no public information on these, and a tailored signing flow costs DKK 20,000 per flow.
- Every processing step must stay in Europe — CRM data is processed by Salesforce and Clari in the EU and US under the Data Privacy Framework.
- Your procurement requires a published EU Trust List entry or certification scope — the pages describe practices 'in accordance with' ISO 27001 and ISO 27701 standards rather than a published certificate with scope.
The scores
| Criterion | Panel median |
|---|---|
| eIDAS levels & trust services | 2.5 of 5 |
| Signer identification | 3 of 5 |
| Signing workflow & signer experience | 2.5 of 5 |
| Evidence, validation & retention | 3 of 5 |
| Integrations & API | 3 of 5 |
| European sovereignty | 3.5 of 5 |
| Pricing transparency | 2 of 5 |
eIDAS levels & trust services
Show reasoningHide reasoning
How this is scored
Which signature levels the platform offers — simple, advanced, qualified, and qualified seals — through which qualified trust service provider on the EU Trust List, for which countries and legal regimes (eIDAS, ZertES), and on which plans.
0 — No signature level named; the platform calls its signature "legally binding" without saying which kind it is.
3 — Simple signatures by default with "advanced" or "qualified" mentioned as available, but no trust service provider named and no statement on which plan or country offers which level.
5 — SES, AdES and QES offered and labelled in the product, the qualified trust service provider named, and which documents need which level explained for at least Germany or the EU.
8 — Every level documented with the plans and countries it is available in, the QTSP's entry on the EU Trust List linked, QES under eIDAS (and ZertES where relevant) stated, qualified electronic seals for company documents, and the signature level printed in the signed document and audit trail.
10 — Levels are an explicit product decision: the provider is or contracts a named QTSP with its conformity assessment published, level selection per document type or template, remote QES without a separate account, EUDI wallet support stated with a date, and the legal effect per level documented for the main EU markets.
The Legal Counsel
Advanced and qualified signatures are labelled with named national eIDs and an eIDAS page explains their legal effect, and Penneo names itself as the trust service provider that verifies identity and issues, manages and revokes certificates. However, I found no public link to that provider's entry on the EU Trust List, no statement of which plan or country offers which level beyond add-ons 'on request', and no public information naming simple signatures as a distinct level or stating that the level is printed in the signed document and audit trail. 5 6 3 2
The HR Operations Lead
Advanced and qualified signatures are clearly labelled with their national eID routes, the reversed burden of proof for QES under eIDAS is explained, and Penneo names itself as the trust service provider that verifies signers and issues certificates — exactly the openness I want when a fixed-term contract needs the written form. Seals and timestamps are generated on HSMs in Danish data centres. We found no public information on an EU Trust List entry, ZertES, or which plan and country carries which level — the Danish MitID qualified route is listed only "On request". 5 6 3 1 2
The Revenue Operations Lead
AdES and QES are labelled by method — MitID, MitID Erhverv and Swedish BankID for advanced; itsme, MitID QES, Norwegian BankID,.beID, AusweisApp or passport for qualified — and the privacy policy names Penneo itself as the trust service provider verifying identities and issuing certificates. I found no public information on an EU Trust List entry, on which plan carries which level, on simple signatures or qualified seals, and MitID QES is listed as on request. 2 3 5 6
The Integration Engineer
Advanced and qualified signatures are clearly labelled with named national eID methods, and Penneo acts as the trust service provider under eIDAS itself, which is more than most. But we found no public information on simple signatures, on qualified seals offered as a product capability, on the EU Trust List entry, or on which plan in which country delivers which level — MitID QES sits behind "On request". 2 3 5 6
The Data Protection Officer
Advanced and qualified signatures are offered and labelled with named national eID methods, Penneo names itself as the trust service provider under eIDAS, and certificates, signatures, seals and timestamps are generated on HSMs in Danish data centres. The qualified level's EU-wide legal effect and reverse burden of proof are explained. I found no public information on simple signatures, a link to a trust-list entry, which plan or country carries which level beyond 'MitID QES — On request', or the signature level being recorded in the signed document and audit trail. 5 6 3 2
The Skeptic
Advanced and qualified signatures are labelled with named methods (MitID, MitID Erhverv, Swedish BankID for advanced; itsme, MitID QES, Norwegian BankID, Belgian eID, AusweisApp or passport for qualified), and the privacy policy puts Penneo itself in the trust service provider role under eIDAS. But qualified signing with MitID and identity verification are listed as on request rather than in a plan, we found no public link to an EU Trust List entry, no mapping of which plan or country delivers which level, and no evidence of simple signatures or qualified seals for company documents as documented capabilities. 2 3 5 6
Signer identification
Show reasoningHide reasoning
How this is scored
How the signer is identified for each level: email and SMS codes, video ident, eID card (Online-Ausweis), bank ident or EUDI wallet — who performs it, in which countries it works, and what happens to the ID data afterwards.
0 — Email link only; no statement on how signers are authenticated.
3 — Email plus SMS or access code, with "ID verification" mentioned as an add-on but no methods, provider or countries named.
5 — Identification methods for AdES and QES listed by name (for example video ident, eID, bank ident), the identification provider named, and the countries or ID documents they accept stated.
8 — Methods documented per level and country, automated and agent-based ident distinguished, reuse of an identification for later signatures explained, retention and deletion of ID data stated, and the ident provider listed as subprocessor.
10 — Identification is transparent end to end: every method with its countries, assurance level and failure rate or completion guidance, EUDI wallet and national eID supported, ID data minimisation and retention committed, and the signer-facing privacy notice published.
The Legal Counsel
Identification methods are named per level — MitID, MitID Erhverv and Swedish BankID for advanced; MitID QES, itsme, Norwegian BankID, Belgian eID, AusweisApp or passport for qualified — with countries (itsme across all 27 EU states plus UK, Norway and Iceland) and accepted ID documents stated, and Penneo states it performs the identity check itself as trust service provider. I found no public information on retention and deletion of the ID data, on reuse of an identification for later signatures, or on whether the identification is automated or agent-based. 5 6 2 3
The HR Operations Lead
Methods are named by level — MitID and Swedish BankID for advanced signatures; itsme, MitID QES, Norwegian BankID,.beID, AusweisApp or passport for qualified — with Penneo itself performing identity verification as trust service provider, and itsme coverage stated for all 27 EU countries plus the UK, Norway and Iceland. The passport route at DKK 12 per signature matters to me for applicants who hold no national eID. We found no public information on EUDI wallet support, on per-country document acceptance beyond itsme, or on retention specific to identification data. 5 6 2 3 3
The Revenue Operations Lead
Methods are named per level, with itsme's coverage of all 27 EU countries plus the UK, Norway and Iceland stated, and a published price of DKK 12 per signature for signing with passport or national ID card via itsme, ID Verifier or AusweisApp. I found no public information distinguishing automated from agent-assisted identification, on reuse of an identification for later signatures, or on how long identification data is kept beyond the platform-wide 90-day deletion. 2 5 6
The Integration Engineer
Methods are named for both levels — MitID, MitID Erhverv and Swedish BankID for advanced, itsme, MitID QES, Norwegian BankID, Belgian eID, AusweisApp and passport for qualified — with itsme coverage stated for all 27 EU countries plus the UK, Norway and Iceland, and Penneo performing the identity check in its trust service role. What keeps me at the middle: no per-country documentation per level, no reuse of an identification, and nothing specific on what happens to ID data afterwards beyond the general 90-day deletion. 2 3 5 6
The Data Protection Officer
Identification methods are named for each level — MitID, MitID Erhverv and Swedish BankID for advanced signatures; MitID QES, itsme, Norwegian BankID, Belgian eID, AusweisApp and passport for qualified ones — with Penneo performing the identity verification as trust service provider, itsme's coverage of all 27 EU countries stated, and passport or national ID card signing priced per signature. Electronic ID information and national identification numbers are collected depending on the signing method, and I found no public information on retention or deletion of identification data, on reuse of an identification for later signatures, or on the identification provider appearing as a subprocessor. 5 6 2 3
The Skeptic
The identification routes are named per level — MitID, MitID Erhverv and Swedish BankID for advanced signatures, itsme, Norwegian BankID, Belgian eID, AusweisApp or passport via ID Verifier for qualified ones — with the privacy policy putting the identity check in Penneo's own hands as trust service provider, and itsme stated to cover all 27 EU countries plus the UK, Norway and Iceland. What is missing is the afterlife of the ident: we found no public information on reuse of an identification for later signatures, on retention specific to ID data, or on automated versus assisted identification. 2 3 5 6 3
Signing workflow & signer experience
Show reasoningHide reasoning
How this is scored
Getting a document out and back signed: templates and form fields, signing order and roles, bulk sending, reminders and delegation, signing without an account or app, mobile signing, and accessibility for signers.
0 — Single-recipient signing of an uploaded PDF; no templates, order or reminders.
3 — Multiple signers and basic templates, but no signing order, no bulk send, and signers must create an account.
5 — Templates with field placement, sequential and parallel signing order, automatic reminders and expiry, signing without an account on mobile, and a status overview for the sender.
8 — Roles and conditional fields, bulk sending, delegation and substitute signers, team and approval workflows, branded signer experience, signer languages listed, and signer accessibility addressed.
10 — The workflow is complete and documented: web forms and self-service signing links, mixed signature levels within one process, in-person and remote signing, a published accessibility conformance statement, and team administration with shared templates and audit of sender actions.
The Legal Counsel
Multiple signers and recipients, multi-document case files, batch signing, eight languages and a paid custom signing flow are documented, and the published accessibility statement covers keyboard navigation, screen-reader support, 200% text scaling and no reliance on colour alone. I found no public information on templates and field placement, signing order, automatic reminders and expiry, delegation or team approval workflows. 2 7 8
The HR Operations Lead
Batch signing, multi-document case files with multiple signers and recipients are on the feature list, a whole casefile goes out in a single API request, and signers get eight languages plus a genuinely detailed accessibility statement covering screen readers, keyboard-only signing and 200% text scaling — good for a new hire working from a phone. Tailored signing flows exist, but as a paid setup. We found no public information on templates, signing order, automatic reminders, or delegation and substitute signers. 2 7 8
The Revenue Operations Lead
Multiple signers, multi-document case files, batch signing and drawn or uploaded signatures are evidenced, and the accessibility statement is unusually concrete — keyboard-only signing, screen-reader readable dialogs, 200 percent text scaling, 8 languages. But the things that decide whether a quote comes back same-day are invisible: I found no public information on templates with field placement, signing order, automatic reminders or expiry, and tailored signing flows are sold as a service at DKK 20,000 per flow rather than templates sales can build themselves. 2 7
The Integration Engineer
Multi-document case files, batch signing, multiple signers, eight signer languages and an unusually thorough published accessibility statement carry this. I found no public information on field templates, signing order, automatic reminders, delegation or account-free mobile signing, and tailored signing flows are a DKK 20,000 add-on rather than a built-in capability. 2 5 7
The Data Protection Officer
Multi-document case files, batch signing, multiple signers and recipients, SMS verification and eight languages are listed, and there is a published accessibility statement covering screen-reader support, full keyboard navigation, 200% text scaling and non-colour-dependent status cues. I found no public information on templates with field placement, signing order, automatic reminders and expiry, delegation and substitute signers, or whether signers can sign without creating an account. 2 7
The Skeptic
Multi-document case files, batch signing, multiple signers and drawn or uploaded signatures are on the pricing page, and the published accessibility statement covers keyboard navigation, screen readers and 200 percent text scaling — genuinely rare detail. But we found no public information on templates with field placement, signing order, automatic reminders and expiry, or whether signers must create an account, which are the basics a mature flow documents. 2 7
Evidence, validation & retention
Show reasoningHide reasoning
How this is scored
What proves a signature years later: the audit trail and certificate of completion, qualified timestamps, long-term validation (PAdES-LTV), validation reports, and how long signed documents and evidence are kept — and whether they can leave the platform.
0 — A signed PDF and nothing else; no audit trail, no statement on storage or deletion.
3 — An audit trail or completion certificate exists, but its contents, the timestamp source and the retention period are unstated.
5 — Audit trail with signer events, IP addresses and authentication method embedded in or attached to the signed PDF, timestamps applied, documents downloadable, and the retention period stated.
8 — PAdES signatures with long-term validation, qualified timestamps from a named provider, a validation tool or report, configurable retention and automatic deletion, and bulk export of documents with their evidence.
10 — Evidence outlives the subscription: LTV and archive timestamps documented, validation verifiable with independent tools such as the EU DSS validator, export to a DMS or archive with evidence intact, and post-termination access and deletion committed in the terms.
The Legal Counsel
Every action is logged, timestamped instantly and sealed upon completion on HSMs in Danish data centres, documents in the archive are kept until the end user deletes them, and the terms commit to export of PDFs with signer details, a 30-day retrieval period and deletion 90 days after the agreement ends. For a dispute eight years out I found no public information on long-term validation (PAdES-LTV), archive timestamps, or any validation tool or report that would independently re-verify the signature. 1 4 3 2
The HR Operations Lead
Every action is logged, timestamped and cryptographically sealed into a permanently archived evidence chain, with certificates, seals and timestamps generated on Danish HSMs — this is what proves a fixed-term contract years later. Retention is explicit: archive documents stay until the user deletes them, other data ninety days after the agreement expires, and the terms commit to a thirty-day retrieval window before deletion. We found no public information on long-term validation (PAdES-LTV) or on a validation tool or report. 1 2 4 3
The Revenue Operations Lead
Every action is logged, timestamped and sealed on completion, certificates, signatures, seals and timestamps are generated on HSMs in Danish data centres, and retention is committed: the archive holds documents until the end user deletes them, with platform data deleted 90 days after agreement expiry and exportable PDFs and signer details enumerated in the terms. I found no public information on PAdES long-term validation, on a validation tool or report, or on the itemized contents of the audit trail. 1 4 3
The Integration Engineer
The evidence chain is real — every action logged and timestamped then sealed on completion, certificates, seals and timestamps generated on HSMs in Danish data centres, an event log, and retention committed: archive documents until the user deletes them and everything else 90 days after the agreement ends, with a 30-day retrieval window. We found no public information on long-term validation, a validation report or independent validator, and export into my DMS is promised only generically as retrieving signed files via the API. 1 3 4 8 3
The Data Protection Officer
Every action is logged, timestamped and sealed into a cryptographically sealed, permanently archived evidence chain, with timestamps generated in Danish data centres, and the terms commit to a 30-day retrieval period with deletion 90 days after the agreement ends, while archive documents are kept until the end user deletes them. Exportable data includes casefiles, documents in PDF and signer details. I found no public information on long-term validation such as PAdES-LTV, a validation tool or report, or how long the IP addresses collected from signers are kept in the evidence. 1 4 3
The Skeptic
Every action is claimed logged, timestamped and sealed, certificates, signatures, seals and timestamps are generated on HSMs in Danish data centres, and retention is stated — the archive keeps documents until end users delete them, deletion follows 90 days after an agreement expires, and a 30-day retrieval window with export of casefiles, PDF documents and signer details exists. We found no public information on long-term validation (PAdES-LTV), a validation tool or report, or whether the audit trail carries IP addresses and authentication method inside the signed PDF. 1 2 4 3
Integrations & API
Show reasoningHide reasoning
How this is scored
Signing from inside the systems where contracts are made: a documented API with webhooks and a sandbox, embedded signing, and connectors for Microsoft 365, CRM, HR, DMS and ERP systems.
0 — No API and no integrations; everything happens in the vendor's web app.
3 — A few named integrations or a Zapier connector, and an API mentioned without public documentation.
5 — A documented REST API with webhooks and a sandbox, plus connectors for Microsoft 365 or Google Workspace and at least one CRM or HR system named.
8 — Embedded signing in the customer's own application, API access to every signature level, versioned API with rate limits published, SDKs, and connectors for named DMS, ERP or HR systems with their scope.
10 — Integration is a product: white-label and embedded flows documented, API parity with the web app, a status page with incident history, deprecation policy, and a marketplace of integrations with stated maintainers.
The Legal Counsel
A documented REST API with OAuth, short-lived tokens, real-time webhooks at every event, a sandbox and single-request batch case files is public, alongside named connectors including Microsoft, Silverfin, M-Files, Unik, EG and Caseware, plus a status page. I found no public information on embedded signing in the customer's own application, SDKs, published rate limits or API versioning, and access to every signature level through the API is not shown. 8 9 2 4
The HR Operations Lead
A publicly documented REST API with OAuth, real-time webhooks, a named sandbox URL, one-request multi-document casefiles, and connectors including Microsoft by default plus Silverfin, M-Files, Unik and EG — this is how signing belongs inside the HR systems where contracts are made, and a system status page with 99.99% uptime is published. We found no public information on rate limits, SDKs, API versioning, or embedded signing inside our own application. 8 4 9 1 2
The Revenue Operations Lead
A documented REST API with OAuth, short-lived tokens, a sandbox, real-time webhooks and single-request multi-document case files, plus named connectors for Microsoft (included by default), Silverfin, M-Files, Unik, EG and Caseware priced at DKK 10 pr. CVR. I found no public information on embedded signing documentation, published rate limits or SDKs, API access per signature level, or a CRM connector for sending from where sales actually work — the named stack leans audit and accounting. 1 2 8 9
The Integration Engineer
This is close to my checklist: a documented REST API with OAuth short-lived tokens, real-time webhooks on every event, a sandbox with its own login endpoint, whole case files creatable in a single request, a system status page, and named connectors including M-Files and EG with Microsoft included by default on Plus. What holds it back: we found no public information on published rate limits, API versioning, SDKs or embedded signing in the customer's own portal, and qualified signing sits behind "On request" add-ons rather than being clearly reachable through the API. 1 2 4 8 9
The Data Protection Officer
A REST API with OAuth authentication, real-time webhooks, a sandbox and public developer documentation is offered, and an entire case file with multiple documents and signers goes out in a single API request. Named connectors include Silverfin, M-Files, Unik and EG, a Microsoft integration is included by default on one package, and a system status page exists. I found no public information on embedded signing in the customer's own application, SDKs, published rate limits or API versioning, or API access to each signature level. 8 9 4 2
The Skeptic
There is a documented REST API with webhooks at every event, OAuth with short-lived tokens, a sandbox, public developer documentation, single-request casefile creation, a system status page with 99.99 percent uptime, and named connectors (Microsoft included by default, Silverfin, M-Files, Unik, EG, Caseware). We found no public information on embedded signing inside the customer's own application, SDKs, published rate limits or versioning, or which signature levels are reachable through the API. 1 2 4 8 9
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity, the trust service provider and their owners are, where documents, audit trails and ID data are stored and processed, and who the subprocessors are. Independently sourced by the sovereignty pipeline.
0 — Non-EU contracting entity, no statement on where documents and signer data are stored, and subprocessors unnamed.
3 — An EU entity contracts, but documents or signer data are processed outside the EU by default without an explained safeguard, or the subprocessor list is absent.
5 — EU contracting entity and EU data storage stated, with a DPA, but the hosting, identification or trust service chain is non-EU-controlled without a stated safeguard.
8 — EU entity, documents, audit trails and ID data stored in named EU data centres, an EU qualified trust service provider, subprocessor list with locations published, and certifications (ISO 27001, ETSI conformity) published.
10 — Sovereign end to end and evidenced: European ownership, EU entity and EU QTSP, every processing location and subprocessor European, customer-selectable data residency, and certifications with their scope published.
The Legal Counsel
Penneo A/S contracts from Copenhagen, customer data stays in EU data centres on AWS EU, certificates, signatures, seals and timestamps are generated on HSMs in Danish data centres, Penneo itself is the trust service provider, and a subprocessor list with locations plus ISO 27001 and 27701 certifications are published. Independently sourced ownership and residency details were not confirmed, and the CRM subprocessors Salesforce and Clari process data in the US under the Data Privacy Framework — a stated safeguard, but not European end to end. 3 4 1 3
The HR Operations Lead
Penneo A/S in Copenhagen with a CVR number, data centres in the EU on AWS, certificates and timestamps on Danish HSMs, Penneo itself as the eIDAS trust service provider, and a subprocessor list published with locations largely in the EU — a mostly sovereign picture for my employment files. Security is described as "best practices in accordance with ISO 27001 and ISO 27701 standards" rather than published certification, CRM data is processed in the EU and US under the Data Privacy Framework, and the independently sourced attributes mark ownership and jurisdiction as unconfirmed. We found no public information on customer-selectable data residency. 3 1 4 3
The Revenue Operations Lead
The captured terms and privacy policy state a Copenhagen-registered contracting entity, EU storage on AWS, Danish HSMs for certificates, signatures, seals and timestamps, and a subprocessor list with mostly EU hosting — the exception being CRM data processed by Salesforce and Clari in the EU and US under the Data Privacy Framework. I found no public information on ownership beyond the Copenhagen listing, on named data-centre locations, or on published certification scope, so this stays below the top marks. 1 3 4
The Integration Engineer
The captured pages give me a Danish contracting entity with a CVR, EU data centres, AWS hosting in the EU, Danish HSMs for certificates and timestamps, and a subprocessor list with per-recipient locations, alongside ISO 27001 and 27701 practices. I stop short of the top because the independently sourced sovereignty attributes came back unconfirmed, the data centres are described only as "in the EU" rather than named, ETSI conformity is not published, and two CRM subprocessors process in the US under the Data Privacy Framework — a stated safeguard, but not European end to end. 1 3 4 3
The Data Protection Officer
The vendor's own pages name a Danish contracting entity with a Copenhagen address and CVR number, state that customer data and the personal archive are hosted by Amazon Web Services in the EU, place the HSMs in Danish data centres, and list subprocessors with their locations — with Salesforce and Clari processing CRM data in the EU and US under the Data Privacy Framework — alongside referenced ISO 27001 and 27701 standards. The independently sourced sovereignty information, however, returned no confirmation of ownership, contracting-entity jurisdiction, data residency or subprocessor exposure, and I found no public information on an ETSI conformity assessment or customer-selectable data residency. 3 4 1 3
The Skeptic
Penneo A/S contracts from Copenhagen, the terms state customer data is stored in EU data centres with AWS hosting in the EU and HSMs in Denmark, and a subprocessor list with locations is published, the US ones (Salesforce, Clari) covered by a stated Data Privacy Framework safeguard. Against that, the independently sourced ownership and data residency attributes came back unconfirmed, the ISO 27001 claim reads as practices 'in accordance with' the standards rather than a published certificate with scope, and we found no public EU Trust List entry behind the claimed trust service provider status. 1 3 4 3
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the cost of their signing volume from public pages alone — plan prices, envelope or document limits, the per-signature price of AdES and QES, identification fees, API pricing and overage.
0 — No public prices at all; every plan is a sales conversation.
3 — Plan prices published, but envelope limits, QES and identification fees are unstated — the cost of a qualified signature is unknowable.
5 — Plans with envelope or document limits priced, but at least one commonly incurred cost (per-QES fee, video ident, API access, overage) is missing or "on request".
8 — Every plan and limit priced publicly, AdES and QES priced per signature, identification fees and overage stated, API pricing published, and contract term and notice period given.
10 — Complete cost computability: the cost of a given monthly volume per signature level derivable from public pages, volume tiers published, and every add-on and price-change term on a public page.
The Legal Counsel
Several unit prices are published exactly — DKK 12 per international signature, DKK 10 per registered letter, DKK 10 per Caseware CVR, DKK 20,000 per custom signing flow, onboarding at DKK 10,000 and DKK 1,200 per hour. I found no public information on plan prices or envelope and document limits, and MitID QES and Penneo Verify are listed as 'On request', so the cost of a domestic qualified signature cannot be computed from these pages. 2
The HR Operations Lead
Some unit prices are public — DKK 12 per signature for international signing with passport or national ID card, DKK 10 per letter, DKK 20,000 per custom signing flow, DKK 10,000 onboarding — so I can price the passport route before a contract goes out. But we found no public information on subscription plan prices or envelope limits, and the Danish MitID qualified signature and Penneo Verify are both "On request", so the cost of my core qualified-signature volume is not computable from public pages. 2
The Revenue Operations Lead
Exact figures are published for several add-ons — international signing at DKK 12 per signature, registered letters at DKK 10 per letter, custom signing flows at DKK 20,000 per flow, onboarding at DKK 10,000 and DKK 1,200 / hour — but I found no public information on plan prices or envelope limits in the captured pages, and both MitID QES and Penneo Verify identity verification are listed as on request, so the cost of a Danish qualified-signature volume is not computable. 2
The Integration Engineer
Add-on prices are quoted exactly — international signing at DKK 12 per signature, registered letters at DKK 10 per letter, Caseware at DKK 10 per CVR, custom signing flows at DKK 20,000 per flow — which is more per-unit detail than many publish. But I found no public information on the subscription plan prices or envelope limits, MitID QES and identity verification are "On request", and no overage or separate API pricing is stated, so I cannot compute the cost of a real month's signing volume. 2
The Data Protection Officer
The pricing page publishes exact figures for add-ons — DKK 12 per international signature, DKK 10 per registered letter, DKK 10 per CVR for the Caseware integration, DKK 20,000 per custom signing flow, DKK 10,000 onboarding and DKK 1,200 per hour — and shows per-region currencies with a free trial. Qualified MitID signatures and Penneo Verify are listed as 'On request', and I found no public information on plan prices, envelope or document limits, or overage terms, so the cost of a given signing volume cannot be computed from public pages. 2
The Skeptic
The add-ons carry exact figures — DKK 12 per signature for international signing, DKK 10 per letter for registered mail, DKK 20,000 per flow for custom signing flows, DKK 10,000 for personalised onboarding — but we found no public information on plan prices or envelope and document limits, and both the domestic qualified route (MitID QES) and Penneo Verify identification are 'On request'. The cost of a qualified signature in Denmark is therefore not computable from the captured pages. 2
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Questions about Penneo
Is Penneo European?
Yes. whats-best.ai classifies Penneo as EU-Made.
Where does Penneo store data?
The default storage location for customer data is not stated on the vendor’s pages as of 13 Oct 2026. The vendor’s pages mention the EU as hosting location, per the vendor’s page captured 1 Oct 2026.
Does Penneo have a free plan?
Not stated on the vendor’s pages as of 13 Oct 2026.
What are the best alternatives to Penneo?
As of 15 Oct 2026, the panel rates Youtrust (Yousign) (2.5/5), MOXIS (2.5/5) and Scrive (2.5/5) highest among the other 14 E-Signature products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Youtrust (Yousign) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Penneo alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data residency, Subprocessors. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 7 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (9)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage penneo.com Checked 13 Oct 2026 Details →
- 2 Pricing page penneo.com Checked 13 Oct 2026 Details →
- 3 Privacy policy penneo.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 4 Terms of service penneo.com Checked 13 Oct 2026 Details →
- 5 EIDAS levels & trust services — found from sitemap penneo.com Checked 13 Oct 2026 Details →
- 6 EIDAS levels & trust services — found from sitemap penneo.com Checked 13 Oct 2026 Details →
- 7 Signing workflow & signer experience — found from sitemap penneo.com Checked 13 Oct 2026 Details →
- 8 Integrations & API — found from sitemap penneo.com Checked 13 Oct 2026 Details →
- 9 Integrations & API — found from sitemap penneo.com Checked 13 Oct 2026 Details →