PandaDoc
Connect PandaDoc to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect PandaDoc to collect digital signature evidence with automated compliance tests, switched on per workspace.
| Category | Digital Signature |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| PandaDoc's guide | developers.pandadoc.com |
Connect with an API token
-
In PandaDoc:
- Sign in to PandaDoc as a stable, long-term user with the access you need (API keys are tied to the user who generates them; removing that user deactivates the key).
- Open the Dev Center (Developer Dashboard) and go to its Configuration page.
- Generate a Production API key (production keys require approval from PandaDoc Sales; a Sandbox key is available for testing) and copy it.
Where to find the other values:
- Access token (optional): Only if you use PandaDoc OAuth instead of an API key: an OAuth access token granted the read scope.
PandaDoc's public documentation does not cover every step.
The key is sent as 'Authorization: API-Key {key}' to https://api.pandadoc.com. PandaDoc API keys inherit the generating user's role and license and there is no read-only key; the list-members endpoint returns members of the workspace implied by the key. The API starts with a sandbox key on the Enterprise plan (active or trial). Not sourced: the OAuth app registration steps for the optional access token, and whether the key is shown only once.
Source: developers.pandadoc.com, developers.pandadoc.com, checked 2026-10-07.
The permissions Safeguard needs:
read. -
On Compliance › Connectors, open PandaDoc, click Connect, choose API token and fill in:
Field What to enter API key Optional. Stored encrypted and never shown again. Or, instead: Access token (optional).
-
Click Connect with token.
Frameworks
Safeguard's automated tests read PandaDoc and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 3 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.2 | 3 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 3 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5 | 3 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 3 |
These tests are switched on per workspace by the Safeguard team.
Related
- Digital Signature connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks