# Penneo — E-Signature

Penneo by Penneo A/S holds a panel rating of 2.5/5 from 6 AI judges (category median 2.5/5), as of 2026-10-15. Provenance: EU-Made; sovereignty: not determined.

- Vendor: Penneo A/S (https://penneo.com)
- Category: [E-Signature](https://whats-best.ai/software/e-signature.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/e-signature/penneo
- Alternatives: https://whats-best.ai/software/e-signature/penneo/alternatives ([markdown](https://whats-best.ai/software/e-signature/penneo/alternatives.md))
- Data as of: 2026-10-20 · evaluated 2026-10-15 · oldest source captured 2026-10-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Penneo A/S
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Default not stated; pages mention the EU [S3]
- Free plan: Not stated on the vendor’s pages as of 13 Oct 2026

## The panel's verdict

Penneo is an e-signature SaaS from Penneo A/S in Copenhagen, offering advanced and qualified signatures through named national eIDs — MitID, MitID Erhverv and Swedish BankID at the advanced level; itsme, MitID QES, Norwegian BankID, Belgian eID, AusweisApp or passport at the qualified one — with Penneo itself named as the trust service provider under eIDAS and certificates, signatures, seals and timestamps generated on HSMs in Danish data centres. The bench scored it highest on integration and API, 6 to 7, and on sovereignty, 6 to 7, citing a documented REST API with webhooks, a sandbox and single-request case files, and EU data centres on AWS — though CRM subprocessors Salesforce and Clari process data in the EU and US under the Data Privacy Framework, and independently sourced ownership and residency details came back unconfirmed. Pricing transparency is the weakest criterion, 2 to 4: add-on prices are published exactly, but the captured pages give no plan prices or envelope limits, and MitID QES and Penneo Verify are 'On request'. Signature levels, signing workflow and evidence and retention range 4 to 6.

**Speaks for it:**
- Every action is logged, timestamped and cryptographically sealed into a permanently archived evidence chain, with archive documents kept until the end user deletes them.
- A documented REST API offers OAuth short-lived tokens, real-time webhooks at every event, a sandbox and single-request casefile creation.
- Customer data is stored in EU data centres on AWS, and a subprocessor list with per-recipient locations is published.
- The published accessibility statement covers screen-reader support, full keyboard navigation and 200% text scaling.
- Advanced and qualified signatures are labelled with named national eID methods, and itsme is stated to cover all 27 EU countries plus the UK, Norway and Iceland.

**Held against it:**
- We found no public information on subscription plan prices or envelope and document limits, so a month's signing volume cannot be priced.
- MitID QES and Penneo Verify are listed 'On request', leaving the cost of the Danish qualified route unstated.
- We found no public information on templates, field placement, signing order or automatic reminders, and tailored signing flows cost DKK 20,000 per flow.
- We found no public link to an EU Trust List entry or a mapping of which plan and country delivers which signature level.
- We found no public information on long-term validation (PAdES-LTV) or on a validation tool or report.

**Best for:**
- You send documents across the EU and need qualified signatures — itsme is stated to cover all 27 EU countries plus the UK, Norway and Iceland, and passport or national ID card signing is priced at DKK 12 per signature.
- Your developers are embedding signing into existing systems — integration and API scored 6 to 7, with a REST API, webhooks, a sandbox and single-request case files.
- You need evidence that stands up years later — every action is logged and sealed, and archive documents are kept until the end user deletes them.
- You want EU data residency with published subprocessor locations — customer data is stored in EU data centres and HSMs sit in Danish data centres.

**Avoid if:**
- You must budget a Danish qualified-signature volume before talking to sales — MitID QES and Penneo Verify are listed 'On request', and the captured pages give no plan prices.
- Your team builds its own templates with signing order and automatic reminders — we found no public information on these, and a tailored signing flow costs DKK 20,000 per flow.
- Every processing step must stay in Europe — CRM data is processed by Salesforce and Clari in the EU and US under the Data Privacy Framework.
- Your procurement requires a published EU Trust List entry or certification scope — the pages describe practices 'in accordance with' ISO 27001 and ISO 27701 standards rather than a published certificate with scope.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The Legal Counsel | The HR Operations Lead | The Revenue Operations Lead | The Integration Engineer | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| eIDAS levels & trust services | 2.5/5 | 3/5 | 2.5/5 | 2/5 | 3/5 | 2/5 |
| Signer identification | 3/5 | 3/5 | 2.5/5 | 2.5/5 | 3/5 | 2.5/5 |
| Signing workflow & signer experience | 2.5/5 | 3/5 | 2/5 | 2.5/5 | 3/5 | 2/5 |
| Evidence, validation & retention | 3/5 | 3/5 | 2.5/5 | 2.5/5 | 3/5 | 2/5 |
| Integrations & API | 3/5 | 3.5/5 | 3/5 | 3.5/5 | 3/5 | 3/5 |
| European sovereignty | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 | 3/5 | 3/5 |
| Pricing transparency | 2/5 | 1.5/5 | 2/5 | 2/5 | 2/5 | 1/5 |
| **Weighted verdict** | **3/5** | **3/5** | **2.5/5** | **3/5** | **3/5** | **2/5** |

### The judges

- **The Legal Counsel** (v1.0): Decides which contracts may be signed electronically and at which level. Wants SES, AdES and QES named per plan and country, the qualified trust service provider linked to the EU Trust List, and an audit trail with timestamps that still validates when the contract is disputed in eight years.
- **The HR Operations Lead** (v1.0): Sends two hundred employment contracts a year, many of them fixed-term and so under written form. Wants QES that a new hire can complete on a phone in ten minutes, identification that accepts the IDs applicants actually hold, bulk sending from templates, and a price per qualified signature known before the contract is signed.
- **The Revenue Operations Lead** (v1.0): Measures how long a quote takes to come back signed and where it stalls. Wants signing from inside the CRM, templates sales cannot break, reminders and signing order that run themselves, and a signer experience that needs no account, no app and no explanation.
- **The Integration Engineer** (v1.0): Embeds signing into the company's own portal and archives the result in the DMS. Wants a versioned API with webhooks and a sandbox, every signature level reachable through the API rather than only in the web app, and signed documents exported with their evidence intact.
- **The Data Protection Officer** (v1.0): Knows every signer who holds an ID card up to a camera hands biometric and identity data to a provider they never chose. Asks who performs the identification, where documents and ID data are stored, how long the audit trail keeps IP addresses, and who the subprocessors in the trust service chain are.
- **The Skeptic** (v1.0): Knows "legally binding" usually means a simple signature. Reads for the level the default plan actually signs at, the QTSP the provider does not operate itself, the per-QES and ident fees on top of the plan, the envelope limit, and "eIDAS-compliant" from a provider that names no trust service at all.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- 2FA: yes [S3]
- Access management: 2FA · VPN · role-based access · unique user accounts · at least annually [S3]
- Accessibility statement: EU 2019/882 [S4]
- Assessment method: self-evaluation [S7]
- Audit trail: yes [S8]
- Breach reporting assistance: 72 [S4]
- Certification requirement: applications must demonstrate adherence via ISO 27001 certification, SOC 2 reports or similar [S3]
- Certifications referenced: ISO 27001 · SOC 2 [S3]
- Cookie consent: yes [S3]
- DPA available: https://penneo.com/terms/ · yes [S3]
- DPA available: https://penneo.com/terms/ · yes [S3]
- Eaa directive: European Accessibility Act · EU 2019/882 [S7]
- Eidas levels: SES · AdES · QES [S1]
- Encryption: yes · TLS 1.2 or higher [S3]
- External audit: ISO 27001 · ISO 27701 · yes [S4]
- External audit standards: ISO 27001 · ISO 27701 · yes [S3]
- ISO 27001: external audit of Information Security and Privacy Management System · yes · yes [S3]
- ISO 27001: yes [S1]
- ISO 27701: yes [S1]
- ISO certifications: yes · yes [S8]
- New subprocessor notice: 30 [S4]
- No data sale: no [S3]
- Penetration testing: at least annually · yes [S3]
- Penetration testing: at least annually [S3]
- Policy version: 2026-10-12 · 1.9 [S3]
- Product liability insurance: 15000000 [S4]
- Qes API: yes [S8]
- Qes legal effect: yes [S5]
- Qtsp: yes [S1]
- Qtsp: yes [S8]
- Qtsp status: yes · yes [S5]
- Regulatory monitoring: yes [S8]
- Security incident notification: 36 [S4]
- Security measures 2FA: yes [S3]
- SSO access management: yes · yes [S3]
- Statement review: 2026-06-08 · 1.0 [S7]
- Statement scope: signer functionalities of Penneo Sign [S7]
- Status page: https://status.penneo.com/ [S4]
- Subprocessor annual review: at least annually [S3]
- Subprocessor list URL: https://penneo.com/subprocessors/ [S4]
- Subprocessor monitoring: at least annually [S3]
- Uptime: 99.9 [S4]
- Wcag level: WCAG 2.1 AA [S7]
- Whistleblowing: EU 2019/1937 · yes [S3]
- Whistleblowing directive: EU 2019/1937 [S3]

**Data**
- Analytics retention: 2 [S3]
- Archive retention: until deleted by end user [S3]
- Backup frequency: daily [S4]
- Customer data deletion: 90 [S3]
- Deletion after termination: 90 [S4]
- Disaster recovery testing: at least annually [S4]
- Encryption: yes · TLS 1.2+ [S4]
- Exportable data scope: active user list · folder structure · casefiles · documents in PDF · signer details [S4]
- File share platform: Visma Group · Oslo, Norway · Serv-U by Solarwinds [S4]
- Job application retention: 6 [S3]
- Job application retention: 6 [S3]
- No sale: no [S3]
- On site audit notice: 90 [S4]
- Pen test frequency: at least annually [S4]
- Platform optional data: Job title · phone number · electronic ID information · national identification number [S3]
- Platform personal data: Name · email address · IP address [S3]
- Platform retention: 90 [S3]
- Post switch deletion: 90 [S4]
- Processed types: full name · email address · IP address [S4]
- Processed types: job title · phone number · electronic ID information · national identification number · name · email address · IP address [S3]
- Retrieval period: 30 [S4]
- Storage location: EU [S4]
- Support retention: 2 [S3]
- Support retention: 2 [S3]
- Switching completion: 30 [S4]
- Switching notice: 2 [S4]
- User experience retention: 2 [S3]

**Hosting**
- Archive aws EU: EU · Amazon Web Services [S3]
- Archive hosting: EU · Penneo Archive · Amazon Web Service [S3]
- Data centers EU: EU [S3]
- Data location: EU [S3]
- EU residency: yes · yes [S1]
- Hsm location: yes · EU · Denmark [S1]

**Integrations**
- Access methods: web application · desktop application · API · partnership integrations [S4]
- API: yes [S1]
- API documentation: https://www.support.penneo.com/hc/en-gb/articles/20505576929053-API-Documentation-for-developers · yes [S4]
- Caseware price: DKK · 10 [S2]
- Compare: Silverfin · M-Files · Unik · EG [S2]
- Connectors: yes [S1]
- Custom automation: developers can plug digital signing into existing systems and automate steps [S9]
- Open API: yes · yes [S5]
- Open API: yes [S7]
- Open API: yes [S9]
- Plus default: yes [S2]
- Prebuilt list: prebuilt integrations with existing tools [S9]
- Pro API: yes [S2]
- Solutions industries: Audit & Accounting · Finance & Banking · Legal Services · Real Estate · Administration & HR [S1]
- Suggestion: users can suggest new integrations [S9]
- Webhooks: yes · yes [S1]

**Legal**
- Address: 35633766 · Gærtorvet 1-5, DK-1799 København V [S4]
- Address: 35633766 · Gærtorvet 1-5, DK-1799 København V [S3]
- Archive controller exception: yes [S3]
- Company entity: 35633766 · Penneo A/S · Gærtorvet 1-5, DK-1799 København V [S6]
- Controller processor roles: processor · controller [S3]
- Entity: 35633766 · Penneo A/S · Gærtorvet 1-5, DK-1799 København V [S1]
- Entity: 35633766 · PENNEO A/S · Gærtorvet 1-5, DK-1799 København V [S2]
- Entity: Penneo A/S · Denmark · 35633766 [S4]
- Entity: 35633766 · PENNEO A/S · Gærtorvet 1-5, DK-1799 København V [S5]
- Entity: 35633766 · Penneo A/S · Gærtorvet 1-5, DK-1799 København V [S8]
- Entity: 35633766 · PENNEO A/S · Gærtorvet 1-5, DK-1799 København V [S9]
- Entity: Penneo A/S [S3]
- Entity: 35633766 · Gærtorvet 1-5, DK-1799 København V · Penneo A/S [S3]
- Entity address: 35633766 · Gærtorvet 1-5, DK-1799 København V · Penneo A/S [S7]
- Governing law: Danish law [S4]
- Jurisdiction: City Court of Copenhagen [S4]

**Pricing**
- Auto renewal: yes · 12 [S4]
- Billing period: annual [S4]
- Free sandbox trial: yes · yes [S8]
- Initial subscription period: 12 [S4]
- Late payment interest: 0.015 [S4]
- Payment terms: 14 [S4]
- Price increase notice: 4 [S4]
- Price index adjustment: yes [S4]
- Sign essential: DKK · 899 · yes · 500 [S2]
- Sign plus: DKK · 1499 · yes · 500 [S2]
- Sign pro: On request [S2]
- SLA uptime: yes · 99.9 [S1]
- Termination notice: 3 [S4]
- VAT: yes · yes [S4]

**Product**
- Addons: Penneo Verify · MitID QES · International signing · Custom signing flows · Registered letter [S2]
- Ades methods: MitID · Swedish BankID [S5]
- Ades methods full: MitID · MitID Erhverv · Swedish BankID [S5]
- AI chatbot: Help Center information only · yes [S3]
- AI chatbot support: Help Center only · yes [S3]
- Analytics processors: EU · Amplitude · Visma Software International AS [S3]
- API capabilities: Send documents for signature, collect verified data, automate document workflows, and retrieve signed files via API [S8]
- Archive: personal archive for end users to manage signed documents [S3]
- Backups: daily · at least annually [S3]
- Batch casefile: yes [S8]
- Collect description: High-volume data collection, fully automated [S1]
- Color independence: yes [S7]
- Cookie policy: functional · analytical · advertising · yes [S3]
- Custom signing flow price: DKK · 20000 [S2]
- Customer count: 3000+ [S5]
- Customer count: 3500 [S8]
- Daily backups: yes [S3]
- Data act addendum: yes · EU 2023/2854 [S4]
- Demo: 30 · no [S1]
- Development practices: yes · yes [S3]
- Disaster recovery testing: at least annually [S3]
- Dk annual reports share: 81 [S5]
- Documentation: endpoints, authentication, examples, guides [S8]
- Eid support: e.g. MitID, BankID [S2]
- Encryption tls: yes · 1.2 [S3]
- Evidence archiving: yes · yes [S1]
- File uploads: JSON + multipart for case file creation [S8]
- Font: Open Sans · 14 · 16 · 18 [S7]
- Free trial: yes [S1]
- Free trial: yes [S2]
- Industries: accounting · auditing · real estate · finance · HR [S5]
- International signing: DKK · 12 [S2]
- Itsme coverage: UK · Norway · Iceland · 27 [S6]
- Keyboard navigation: yes [S7]
- Languages: 8 [S2]
- Maintenance window: 17:00-06:00 CET/CEST [S4]
- Mitid qes: no [S2]
- Modules: Penneo Sign · Penneo Collect · Penneo Verify [S5]
- Modules: Penneo Sign · Penneo Collect · Penneo Verify [S9]
- No blinking graphics: no [S7]
- No video audio: no [S7]
- Non repudiation: yes [S5]
- Oauth authentication: OAuth · yes [S8]
- Other products: Penneo Sign · Penneo Collect · Penneo Verify [S7]
- Penneo verify: no [S2]
- Platform description: SaaS [S4]
- Platform modules: Penneo Sign · Penneo Collect · Penneo Verify [S1]
- Platform modules: Penneo Sign · Penneo Collect [S3]
- Platform products: Penneo Sign · Penneo Collect [S3]
- Policy review frequency: at least once a year [S3]
- Products listed: Penneo Sign · Penneo Collect · Penneo Verify [S4]

**Subprocessors**
- Billing recipient: EU · Younium · e-conomic · Likvido [S3]
- Job applicant recipient: EU · job applications · Personio [S3]
- Newsletter recipient: EU · newsletter · Salesforce [S3]
- Support recipient: EU · support requests · Zendesk [S3]
- Whistleblower recipient: EU · whistleblowing reports · Whistlelink AB [S3]

**Support**
- Accessibility contact: https://www.support.penneo.com/hc/en-gb/requests/new [S7]
- Channels: ticket system [S4]
- Continuous onboarding price: DKK · 1200 [S2]
- Dedicated contact: yes [S1]
- Help center: yes [S9]
- Included: English primarily · yes [S4]
- Integration support: yes [S8]
- Localised: yes [S1]
- Onboarding: yes [S1]
- Onboarding: online training · Help Center · ticket support [S2]
- Onboarding price: 10000 · DKK [S2]
- Premium: yes [S2]
- System status: yes [S9]

29 more facts on the canonical page: https://whats-best.ai/software/e-signature/penneo

## Questions

### Is Penneo European?

Yes. whats-best.ai classifies Penneo as EU-Made.

### Where does Penneo store data?

The default storage location for customer data is not stated on the vendor’s pages as of 13 Oct 2026. The vendor’s pages mention the EU as hosting location, per [the vendor’s page captured 1 Oct 2026](https://whats-best.ai/evidence/6655).

### Does Penneo have a free plan?

Not stated on the vendor’s pages as of 13 Oct 2026.

### What are the best alternatives to Penneo?

As of 15 Oct 2026, the panel rates [Youtrust (Yousign) (2.5/5)](https://whats-best.ai/software/e-signature/youtrust), [MOXIS (2.5/5)](https://whats-best.ai/software/e-signature/moxis) and [Scrive (2.5/5)](https://whats-best.ai/software/e-signature/scrive) highest among the other 14 E-Signature products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Youtrust (Yousign)](https://whats-best.ai/software/e-signature/youtrust) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Penneo alternatives](https://whats-best.ai/software/e-signature/penneo/alternatives).

## What this page leaves out

- 7 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 6 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://penneo.com/ (checked 2026-10-13)
- [S2] Pricing page: https://penneo.com/pricing-sign-collect/ (checked 2026-10-13)
- [S3] Privacy policy: https://penneo.com/privacy-policy/ (checked 2026-10-13)
- [S4] Terms of service: https://penneo.com/terms/ (checked 2026-10-13)
- [S5] EIDAS levels & trust services — found from sitemap: https://penneo.com/use-cases/eidas-compliance/ (checked 2026-10-13)
- [S6] EIDAS levels & trust services — found from sitemap: https://penneo.com/product-updates/penneo-qes-highest-legal-standard-proven-security/ (checked 2026-10-13)
- [S7] Signing workflow & signer experience — found from sitemap: https://penneo.com/accessibility-statement/ (checked 2026-10-13)
- [S8] Integrations & API — found from sitemap: https://penneo.com/penneo-api/ (checked 2026-10-13)
- [S9] Integrations & API — found from sitemap: https://penneo.com/integrations/ (checked 2026-10-13)

---

Cite as: whats-best.ai, "Penneo — E-Signature", AI panel analysis, as of 2026-10-20. https://whats-best.ai/software/e-signature/penneo

Corrections: https://whats-best.ai/correct/636?target=page