{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-10", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "pennylane", "name": "Pennylane", "vendor": "Pennylane SAS", "vendorUrl": "https://www.pennylane.com", "kind": "http-api", "category": "accounting", "summary": "Pennylane is a French accounting and invoicing platform for companies and accounting firms. Its Company and Firm REST APIs cover invoices, supplier invoices, ledger entries, transactions and exports. A hosted read-only MCP server exposes the same books to AI assistants.", "url": "https://www.anchorterminal.com/tools/pennylane", "markdownUrl": "https://www.anchorterminal.com/tools/pennylane.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/pennylane.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/pennylane.json", "license": "Proprietary service under Pennylane's API agreement and customer terms", "transports": [ "http" ], "remoteUrl": "https://app.pennylane.com/api/external/v2", "packages": [], "auth": "mixed", "authNotes": "Bearer token on every call. Companies generate a Company API token under Settings, Connectivity, Developers, which needs the Essentiel plan or above and an admin role. Each token is tied to one company, is read only or read and write, expires after 1, 6 or 12 months or never, and can be deleted. Firms generate Firm API tokens. Integration partners use the OAuth 2.0 authorisation code grant after the Partnerships team issues a client ID and secret, with 24-hour access tokens and rotating 90-day refresh tokens. The MCP server uses OAuth 2.1 with PKCE and dynamic client registration, and the user signs in through a browser.", "pricing": "paid", "pricingNotes": "API and MCP access for companies needs the Essentiel plan or above, listed at 24 euros a month before VAT for one user on the pricing tab for sole traders and single-shareholder companies. Premium is 79 euros. Each plan has a 15-day trial with no commitment, and a sandbox can be created inside an account. Whether the trial needs a card and the prices for other company types were not established. Accounting firms get the MCP at no extra cost (https://www.pennylane.com/fr/tarifs, checked 2026-10-09).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the MCP docs or the pricing page (checked 2026-10-09).", "endpoints": [] }, "toolCount": 31, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://pennylane.readme.io/docs/api-overview", "llmsTxt": "https://pennylane.readme.io/llms.txt", "capabilities": [ "accounting.ledger", "accounting.invoices", "accounting.bills", "accounting.reports" ], "tags": [ "hosted", "closed-source", "oauth", "openapi", "mcp", "llms-txt", "webhooks", "status-page" ], "lastRelease": "2026-09-30", "graded": true, "anchor": { "graded": true, "score": 66.3, "grade": "B", "agentReady": false, "rank": 297, "ranked": true, "rankOf": 950, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 66, "maintenance": 65, "payments": 20, "reliability": 75, "schema": 85, "security": 68, "transparency": 76 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 75, "points": 15, "reason": "Graded on the hosted lines. Atlassian Statuspage at status.pennylane.com with seven components, one of them the API on app.pennylane.com (20). Four incidents between 11 July and 9 October 2026. On 20 July several services were disrupted intermittently from 10.55 until the 19.03 CEST resolution, with the application unavailable from 16.53 to 17.00. The others were mobile uploads for about three hours on 27 August, slowdowns for 50 minutes on 14 September and instability for 37 minutes on 25 September. We scored this between minor incidents and one major outage (15). 25 requests per 5 seconds per token (15). 429 carries `retry-after`, every response carries rate limit headers and the error guide asks for exponential backoff on 5xx, but creation endpoints do not enforce idempotency except supplier invoice imports (10). The customer terms commit to 99.9 per cent for app.pennylane.com with credits, while the API agreement supplies the API as is with no warranty, so half credit (5). v2 is described as the official stable version (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 85, "points": 13.81, "reason": "Each reference page carries an OpenAPI 3.0.1 definition for its operation, readable through the Markdown twin. One downloadable file for the whole API was not located, and the MCP tool schemas need a signed-in session, so we did not read them (23). llms.txt indexes the guides and 179 reference pages, and every page has a Markdown twin (10). Descriptions state purpose, the scopes required and side effects, such as a finalised invoice no longer being editable, and guides compare importing with creating an invoice (14). Typed parameters with minimum and maximum values and enums on the page read, though `filter` is a JSON array passed as a string (11). Examples in the definitions and an error guide covering nine status codes with fixes (12). Versioned as v2 with a dated changelog and RSS feed (15). Based on one reference page read in full." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 66, "points": 10.73, "reason": "The REST API is the main surface. Responses are sized with `limit` from 1 to 100, default 20, and filters, with no field selection found. The MCP server lists 31 tools, each data type switched on by its own scope (15). Cursor pagination, a `filter` parameter with operators and `sort` on list endpoints (20). Errors return `error`, `message` and `details` naming the field and rule, with a table of which codes to retry (17). No idempotency keys. The docs say creation endpoints do not enforce idempotency except supplier invoice imports, and a duplicate file returns 409. The MCP server is read only, and its annotations were not read (7). Sensible defaults, but no official SDK was found. The reference shows generated samples in six languages (7)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 68, "points": 11.9, "reason": "OAuth 2.0 authorisation code with 24-hour access tokens and rotating refresh tokens for partners, company and firm tokens with chosen scopes, expiry and deletion, and OAuth 2.1 with PKCE on the MCP server. No documented option to send a token in a URL (30). Every resource has a `:readonly` scope, tokens can be read only and the MCP server cannot write. No confirmation step for irreversible calls such as finalising an invoice (16). The API returns invoice and supplier text written by other parties. The MCP docs warn that data goes to the AI vendor and that answers can be wrong, with no prompt-injection guidance (4). The token list shows last use, and changelog endpoints and the `get_changelog` tool list record changes over four weeks. No per-call log for the operator was found (6). ISO 27001 with a 2026 certificate published, an annual third-party penetration test in the customer terms, a security white paper and an incident response plan. No security.txt, bug bounty or disclosure policy was found (12)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 20, "points": 2.5, "reason": "No x402, MPP or L402 (0). Plan prices are public, 7 to 79 euros a month before VAT on the tab for sole traders and single-shareholder companies, with the API from Essentiel at 24 euros. No per-call price, so plan-only credit (10). A 15-day trial with no commitment and a sandbox inside an account. Whether the trial needs a card, and whether it includes the API, was not established, so half credit (10). A person signs up in a browser, OAuth apps need the Partnerships team, and the MCP flow needs a browser sign-in (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 65, "points": 5.69, "reason": "Newest changelog entry 30 September 2026 (30). Five dated entries between 15 July and 30 September 2026 (20). Closed service with a dated changelog, an RSS feed, a public roadmap, support by chat or account manager for customers and Zendesk for partners, and a community forum we did not read (10). No official SDK was found, and a search of the official MCP registry for pennylane returned no server (0). No package to assess. The docs are current, with pages updated on 23 September and 5 October 2026 (5)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 76, "points": 6.65, "note": "editorial 71, provenance 80", "reason": "Closed service. The API agreement of January 2024 and the customer terms of 16 December 2025 are public and name the entity and French law. The API agreement lets Pennylane change or revoke access without notice and takes an exclusive licence over integrations, and its registered office differs from the one in the customer terms (13). Privacy policy of 30 January 2026, a data processing agreement annexed to the terms, deletion 30 days after termination, EU hosting and a commitment not to train AI models on customer data. The privacy policy allows providers outside the EU while the sub-processor list shows none (24). The 2026 breaking changes had dated phases over 24 weeks and v1 had an end date, but no standing deprecation policy was found and the agreement reserves changes without notice (14). Sub-processor list with locations, dated 16 December 2025, with update notices 30 days ahead (20)." } ], "assessment": { "date": "2026-10-09", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "The REST API is the main surface. Responses are sized with `limit` from 1 to 100, default 20, and filters, with no field selection found. The MCP server lists 31 tools, each data type switched on by its own scope (15). Cursor pagination, a `filter` parameter with operators and `sort` on list endpoints (20). Errors return `error`, `message` and `details` naming the field and rule, with a table of which codes to retry (17). No idempotency keys. The docs say creation endpoints do not enforce idempotency except supplier invoice imports, and a duplicate file returns 409. The MCP server is read only, and its annotations were not read (7). Sensible defaults, but no official SDK was found. The reference shows generated samples in six languages (7).", "maintenance": "Newest changelog entry 30 September 2026 (30). Five dated entries between 15 July and 30 September 2026 (20). Closed service with a dated changelog, an RSS feed, a public roadmap, support by chat or account manager for customers and Zendesk for partners, and a community forum we did not read (10). No official SDK was found, and a search of the official MCP registry for pennylane returned no server (0). No package to assess. The docs are current, with pages updated on 23 September and 5 October 2026 (5).", "payments": "No x402, MPP or L402 (0). Plan prices are public, 7 to 79 euros a month before VAT on the tab for sole traders and single-shareholder companies, with the API from Essentiel at 24 euros. No per-call price, so plan-only credit (10). A 15-day trial with no commitment and a sandbox inside an account. Whether the trial needs a card, and whether it includes the API, was not established, so half credit (10). A person signs up in a browser, OAuth apps need the Partnerships team, and the MCP flow needs a browser sign-in (0).", "reliability": "Graded on the hosted lines. Atlassian Statuspage at status.pennylane.com with seven components, one of them the API on app.pennylane.com (20). Four incidents between 11 July and 9 October 2026. On 20 July several services were disrupted intermittently from 10.55 until the 19.03 CEST resolution, with the application unavailable from 16.53 to 17.00. The others were mobile uploads for about three hours on 27 August, slowdowns for 50 minutes on 14 September and instability for 37 minutes on 25 September. We scored this between minor incidents and one major outage (15). 25 requests per 5 seconds per token (15). 429 carries `retry-after`, every response carries rate limit headers and the error guide asks for exponential backoff on 5xx, but creation endpoints do not enforce idempotency except supplier invoice imports (10). The customer terms commit to 99.9 per cent for app.pennylane.com with credits, while the API agreement supplies the API as is with no warranty, so half credit (5). v2 is described as the official stable version (10).", "schema": "Each reference page carries an OpenAPI 3.0.1 definition for its operation, readable through the Markdown twin. One downloadable file for the whole API was not located, and the MCP tool schemas need a signed-in session, so we did not read them (23). llms.txt indexes the guides and 179 reference pages, and every page has a Markdown twin (10). Descriptions state purpose, the scopes required and side effects, such as a finalised invoice no longer being editable, and guides compare importing with creating an invoice (14). Typed parameters with minimum and maximum values and enums on the page read, though `filter` is a JSON array passed as a string (11). Examples in the definitions and an error guide covering nine status codes with fixes (12). Versioned as v2 with a dated changelog and RSS feed (15). Based on one reference page read in full.", "security": "OAuth 2.0 authorisation code with 24-hour access tokens and rotating refresh tokens for partners, company and firm tokens with chosen scopes, expiry and deletion, and OAuth 2.1 with PKCE on the MCP server. No documented option to send a token in a URL (30). Every resource has a `:readonly` scope, tokens can be read only and the MCP server cannot write. No confirmation step for irreversible calls such as finalising an invoice (16). The API returns invoice and supplier text written by other parties. The MCP docs warn that data goes to the AI vendor and that answers can be wrong, with no prompt-injection guidance (4). The token list shows last use, and changelog endpoints and the `get_changelog` tool list record changes over four weeks. No per-call log for the operator was found (6). ISO 27001 with a 2026 certificate published, an annual third-party penetration test in the customer terms, a security white paper and an incident response plan. No security.txt, bug bounty or disclosure policy was found (12).", "transparency": "Closed service. The API agreement of January 2024 and the customer terms of 16 December 2025 are public and name the entity and French law. The API agreement lets Pennylane change or revoke access without notice and takes an exclusive licence over integrations, and its registered office differs from the one in the customer terms (13). Privacy policy of 30 January 2026, a data processing agreement annexed to the terms, deletion 30 days after termination, EU hosting and a commitment not to train AI models on customer data. The privacy policy allows providers outside the EU while the sub-processor list shows none (24). The 2026 breaking changes had dated phases over 24 weeks and v1 had an end date, but no standing deprecation policy was found and the agreement reserves changes without notice (14). Sub-processor list with locations, dated 16 December 2025, with update notices 30 days ahead (20)." }, "sources": [ { "what": "API agreement (API Contract terms)", "url": "https://pennylane.readme.io/page/api-contract-terms", "seen": "2026-10-09" }, { "what": "docs index for agents", "url": "https://pennylane.readme.io/llms.txt", "seen": "2026-10-09" }, { "what": "which API to use and plan needed", "url": "https://pennylane.readme.io/docs/what-apis-are-available", "seen": "2026-10-09" }, { "what": "company API tokens", "url": "https://pennylane.readme.io/docs/generating-my-api-token", "seen": "2026-10-09" }, { "what": "OAuth 2.0 guide", "url": "https://pennylane.readme.io/docs/oauth-20-walkthrough", "seen": "2026-10-09" }, { "what": "scopes", "url": "https://pennylane.readme.io/docs/v2-scopes", "seen": "2026-10-09" }, { "what": "rate limits", "url": "https://pennylane.readme.io/docs/rate-limiting-1", "seen": "2026-10-09" }, { "what": "errors and retry guidance", "url": "https://pennylane.readme.io/docs/error-handling-status-codes", "seen": "2026-10-09" }, { "what": "cursor pagination", "url": "https://pennylane.readme.io/docs/using-cursor-based-pagination", "seen": "2026-10-09" }, { "what": "2026 API changes migration guide", "url": "https://pennylane.readme.io/docs/2026-api-changes-guide", "seen": "2026-10-09" }, { "what": "v1 to v2 migration", "url": "https://pennylane.readme.io/docs/api-v2-vs-v1", "seen": "2026-10-09" }, { "what": "reference page with OpenAPI definition", "url": "https://pennylane.readme.io/reference/getcustomerinvoices", "seen": "2026-10-09" }, { "what": "API changelog feed", "url": "https://pennylane.readme.io/changelog.rss", "seen": "2026-10-09" }, { "what": "MCP server docs and tool list", "url": "https://pennylane-mcp.readme.io/docs/getting-started", "seen": "2026-10-09" }, { "what": "MCP product page", "url": "https://www.pennylane.com/fr/mcp", "seen": "2026-10-09" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0.1/servers?search=pennylane", "seen": "2026-10-09" }, { "what": "status page and components", "url": "https://status.pennylane.com", "seen": "2026-10-09" }, { "what": "incident history feed", "url": "https://status.pennylane.com/history.atom", "seen": "2026-10-09" }, { "what": "pricing", "url": "https://www.pennylane.com/fr/tarifs", "seen": "2026-10-09" }, { "what": "terms index", "url": "https://www.pennylane.com/fr/conditions-generales", "seen": "2026-10-09" }, { "what": "customer terms for companies, 16 December 2025, with DPA and SLA", "url": "https://assets.ctfassets.net/b76knntgaaiu/716y3zJ75dFd0xHrLdh7v0/06c61353acf52b9fbe507e994439322c/PENNYLANE_ENTREPRISE_CGSU_DEC25.pdf", "seen": "2026-10-09" }, { "what": "privacy policy", "url": "https://www.pennylane.com/fr/legal/privacy", "seen": "2026-10-09" }, { "what": "sub-processor list", "url": "https://www.pennylane.com/fr/legal/subcontractors", "seen": "2026-10-09" }, { "what": "security page", "url": "https://www.pennylane.com/fr/securite", "seen": "2026-10-09" }, { "what": "trust centre", "url": "https://www.pennylane.com/fr/legal/centre-de-confiance", "seen": "2026-10-09" }, { "what": "legal notice", "url": "https://www.pennylane.com/fr/legal/mentions-legales", "seen": "2026-10-09" }, { "what": "domain registration (RDAP)", "url": "https://rdap.verisign.com/com/v1/domain/pennylane.com", "seen": "2026-10-09" } ], "openQuestions": [ "unchecked: no request was sent to the API or the MCP server. The robots.txt on app.pennylane.com disallows every path except /auth/login, so the 401 body, live headers and MCP tool schemas and annotations are unread", "unchecked: whether the 15-day trial needs a card and whether it includes API access. The signup flow is inside the app", "unchecked: prices for company types other than the default pricing tab, which the page draws by script", "unchecked: a single downloadable OpenAPI file, the Firm API reference at firm-pennylane.readme.io and the webhook guides", "unchecked: the security white paper, the incident response plan, the ISO 27001 certificate PDF and the terms for accounting firms, none of which we opened", "unchecked: security incidents in the last 12 months. Web search was not available and nothing was found on the vendor's pages", "unchecked: the community forum and the help centre", "The MCP product page says a connection cannot be cut from the Pennylane account, while the MCP docs say it can be revoked under connected applications", "The introduction guide still shows a first request to `https://api.pennylane.com/v1/me`, although v1 was due for retirement at the end of 2025", "Whether the 99.9 per cent commitment for app.pennylane.com applies to API calls, given that the API agreement disclaims any warranty", "No official SDK and no public repository were found in the docs. GitHub was not searched" ] }, "negative": 0, "verdict": "The v2 API has per-resource read and write scopes, an OpenAPI definition on every reference page, llms.txt and a breaking-change process that ran over 24 weeks. Access needs a paid Essentiel plan or partner approval, creation endpoints are not idempotent, and the API agreement lets Pennylane change or revoke the API without notice.", "bestFor": "An agent working on the books of French companies or an accounting firm's client portfolio, with French chart of accounts, FEC export, Factur-X e-invoicing and VAT returns.", "strengths": [ "Scopes split each resource into `:readonly` and `:all`, for company tokens, firm tokens and OAuth apps", "Hosted MCP server at `https://mcp.pennylane.com/mcp` with 31 read-only tools, OAuth 2.1 with PKCE and dynamic client registration", "OpenAPI 3.0.1 definitions on each reference page, an llms.txt index and Markdown twins of every docs page", "The 2026 breaking changes ran in three phases over 24 weeks with an opt-in header, ending 1 July 2026", "ISO 27001 certificate published, EU hosting on AWS in Ireland, and a dated sub-processor list with 30 days' notice of additions" ], "weaknesses": [ "The API agreement allows changes, suspension or revocation with or without notice and supplies the API as is", "Creation endpoints do not enforce idempotency, except supplier invoice imports", "API and MCP access for companies starts at the Essentiel plan, and OAuth apps need approval from the Partnerships team", "No official SDK was found, and the MCP server is not in the official MCP registry", "No security.txt, bug bounty or published disclosure policy was found", "The API agreement grants Pennylane an exclusive licence over API integrations and their source code on request" ], "agentNotes": [ "Call `GET https://app.pennylane.com/api/external/v2/me` first to confirm the token, user and company context", "Stay under 25 requests per 5 seconds per token and wait for the `retry-after` value on a 429", "Do not retry a create after a timeout without checking first. Only supplier invoice imports are deduplicated", "Send `filter` and `sort` again with every `cursor`. The cursor stores position only", "Send amounts as strings such as \"120.00\", and ask for `:readonly` scopes when the task only reads", "Use the MCP server for reads only. It cannot create, edit or delete, and firm connections need `company_id`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 66.3 } ], "editorialScores": { "ergonomics": 66, "maintenance": 65, "payments": 20, "reliability": 75, "schema": 85, "security": 68, "transparency": 71 }, "provenanceScore": 80 }, "connect": { "http": "curl https://app.pennylane.com/api/external/v2/me \\\n -H \"Authorization: Bearer $PENNYLANE_API_TOKEN\"", "claudeCode": "claude mcp add --transport http pennylane https://mcp.pennylane.com/mcp", "config": { "mcpServers": { "pennylane": { "url": "https://mcp.pennylane.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/accounting.ledger", "tool": "https://letme.dev/pennylane" }, "notable": [ "The Company API v2 answers at `https://app.pennylane.com/api/external/v2` and is included from the Essentiel plan. A separate Firm API serves accounting firms, and a Firm Group API is available on request (https://pennylane.readme.io/docs/what-apis-are-available)", "The hosted MCP server at `https://mcp.pennylane.com/mcp` uses Streamable HTTP and OAuth 2.1 with PKCE, lists 31 read-only tools, and grants one read scope per data type such as `mcp:customer_invoice:read` (https://pennylane-mcp.readme.io/docs/getting-started)", "Rate limit of 25 requests per 5 seconds per token, in production and sandbox, with `retry-after` on 429 and `ratelimit-limit`, `ratelimit-remaining` and `ratelimit-reset` on every response (https://pennylane.readme.io/docs/rate-limiting-1)", "The API agreement, last updated January 2024, says Pennylane may change the API with or without notice, may deny or revoke an integration at any time, and takes an exclusive licence over integrations (https://pennylane.readme.io/page/api-contract-terms)", "The customer terms of 16 December 2025 commit to 99.9 per cent monthly availability of `https://app.pennylane.com` with credits, forbid load tests, and say customer data is never used to train AI models (https://www.pennylane.com/fr/conditions-generales)", "The status page lists four incidents between 20 July and 25 September 2026, the longest an intermittent disruption on 20 July from 10.55 to about 19.00 CEST (https://status.pennylane.com/history)", "The pricing page lists Starter at 7 euros, Basique at 14, Essentiel at 24 and Premium at 79 a month before VAT for one user, with a 15-day trial (https://www.pennylane.com/fr/tarifs)" ], "area": "domain-data", "details": [ { "label": "APIs", "value": "Company API v2 (REST, JSON, 179 reference pages in llms.txt across accounting, exports, customer and supplier invoices, quotes, transactions, mandates, subscriptions, webhooks and changelogs), Firm API, Firm Group API on request. v1 was due for retirement at the end of 2025" }, { "label": "MCP server", "value": "Hosted at `https://mcp.pennylane.com/mcp`, Streamable HTTP, OAuth 2.1 with PKCE and dynamic client registration, 31 read-only tools, 100 records a page. Write tools are planned for a later version" }, { "label": "Credentials", "value": "Company API token (read only or read and write, expiry of 1, 6 or 12 months or unlimited, shown once, deletable), Firm API token, or OAuth 2.0 authorisation code for partners with 24-hour access tokens and rotating 90-day refresh tokens" }, { "label": "Scopes", "value": "`resource:readonly` and `resource:all` per resource, such as `customer_invoices:readonly`, `ledger_entries:all` and `exports:fec`. The bundled `ledger` scope was replaced in 2026" }, { "label": "Rate limits", "value": "25 requests per 5 seconds per token, with `retry-after` on 429 and rate limit headers on every response" }, { "label": "Pagination", "value": "Cursor-based with `cursor` and `limit` (default 20, 1 to 100 on the page read), plus JSON `filter` and `sort` parameters" }, { "label": "Errors", "value": "JSON body with `error`, `message` and `details`. 400, 401, 403, 404, 409, 422, 429, 500 and 503 documented with fixes" }, { "label": "Sandbox", "value": "Companies create one from the profile menu under Test environment. Integration partners request one from the Partnerships team. Firms have none" }, { "label": "Prices", "value": "For sole traders and single-shareholder companies, before VAT, one user: Starter 7 euros a month, Basique 14, Essentiel 24, Premium 79, each with up to 1,200 invoices a year and a 15-day trial. The API and MCP need Essentiel or above. Accounting firms get the MCP at no extra cost" }, { "label": "SLA", "value": "99.9 per cent a month for `https://app.pennylane.com` in the customer terms, with credits and a right to terminate below 90 per cent. Outages under 15 minutes and partial faults are excluded. The API agreement itself gives no warranty" }, { "label": "Certifications", "value": "ISO 27001 with a 2026 certificate on the security page, annual third-party penetration test under the customer terms, ACPR registration as an account information service provider" }, { "label": "Hosting", "value": "AWS in Ireland, with the French e-invoicing platform on S3NS, Outscale and Scalingo in France" }, { "label": "Sub-processors", "value": "30 entries with locations, all in the European Union, last modified 16 December 2025, with a sign-up for updates and 30 days' notice" }, { "label": "Status", "value": "Atlassian Statuspage at status.pennylane.com with seven components, one of them the API" } ], "provenance": { "legalEntity": "Pennylane SAS", "domain": "pennylane.com", "domainRegistered": "1998-09-23", "endpointOnVendorDomain": true, "terms": "https://pennylane.readme.io/page/api-contract-terms", "privacy": "https://www.pennylane.com/fr/legal/privacy", "statusPage": "https://status.pennylane.com", "changelog": "https://pennylane.readme.io/changelog", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "The legal notice (updated 8 September 2026) names Pennylane, a société par actions simplifiée, SIREN 880 265 921 RCS Paris, 2-4 rue Jules Lefebvre, 75009 Paris. Pennylane GmbH sells the product in Germany.", "The API agreement (API Contract terms, last updated January 2024) governs API use and is cited by clause 26.9 of the customer terms. It gives a registered office in Cherbourg-en-Cotentin, which differs from the Paris address in the customer terms and legal notice.", "The customer terms for companies (version of 16 December 2025) are a PDF linked from https://www.pennylane.com/fr/conditions-generales, with the data processing agreement and the SLA as annexes.", "The privacy policy (updated 30 January 2026) covers processing where Pennylane is controller. Processing as processor is governed by the data processing agreement annexed to the customer terms.", "www.pennylane.com/.well-known/security.txt returns 404.", "The API answers on app.pennylane.com and the MCP server on mcp.pennylane.com. The API docs are hosted on pennylane.readme.io.", "RDAP for pennylane.com gives a registration date of 1998-09-23." ], "score": 80, "checks": [ { "check": "Legal entity named", "value": "Pennylane SAS", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "pennylane.com, registered 1998-09-23 (28 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "app.pennylane.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 5.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 1 of the 8 things a reader expects", "points": 4.8, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.pennylane.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://pennylane.readme.io/page/api-contract-terms", "state": "read", "readAt": "2026-10-09", "words": 5937, "points": 5.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This API Agreement shall be governed by the laws of France, without regard to its conflict of laws rules.", "says": "The law of France" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…INCIDENTAL, INDIRECT, SPECIAL, PUNITIVE, OR OTHER LOSS OR DAMAGE WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOSS OF DATA, LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, COMPUTER FAILURE, LOSS OF BUSINESS INFORMATION), ARISING OUT OF OR RELATED TO THIS API AGREEMENT, OR YOUR USE OF OR INABILITY TO USE THE PENNYLANE API…", "says": "Rules out indirect and consequential losses, with no cap named in this sentence" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "We may modify the permitted use of or suspend Your access to the Pennylane API at any time and for any reason." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "…or by a third party) and (v) any exchange of information or data (including but not limited to personal information or data) between the Non-Pennylane Application and the Services through the API Integration and Pennylane API (and You shall ensure that such exchange of information or data comply with all applicable la…" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "If you do not have such authority, or if you do not agree with these terms and conditions, you must not accept this API Agreement and may not use the Pennylane API, the Pennylane API Materials or the API Integrations." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "…will be free of viruses or other harmful components, error-free or that they will meet any specified service level, or will operate without interruptions or downtime, (ii) any information or advice obtained by in connection with the Pennylane API, Pennylane API Materials and API Integrations, will be accurate or compl…" } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "use the Pennylane API, Pennylane API Materials, or API Integrations in any manner to offer similar services as Pennylane or to compete directly or indirectly with Pennylane services or which aim to circumvent the pricing model or licensing model of the Services;", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "We reserve the right to make changes to the Pennylane API and the Pennylane API Materials from time to time in our sole discretion, with or without notice, (and future versions may not be compatible with Your API Integrations or the Non-Pennylane Applications developed using previous versions), without liability to Yo…", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "We may modify the permitted use of or suspend Your access to the Pennylane API at any time and for any reason." } ], "notes": [ { "date": "2026-10-08", "text": "The total liability of Pennylane, its affiliates and licensors under the API agreement is capped at 50 euros.", "quote": "THE AGGREGATE LIABILITY OF PENNYLANE AND ITS AFFILIATES AND LICENSORS ARISING FROM OR RELATED TO THIS API AGREEMENT OR YOUR USE OF OR INABILITY TO USE THE PENNYLANE API, PENNYLANE API MATERIALS OR API INTEGRATIONS, WILL NOT EXCEED FIFTY (50) EUROS." }, { "date": "2026-10-08", "text": "The developer agrees to give Pennylane the source code of its API integrations on request.", "quote": "You agree to provide Pennylane with the source code for Your API Integrations upon request." }, { "date": "2026-10-08", "text": "After termination, the developer may lose access to content, data or information submitted to Pennylane through the API or its integrations.", "quote": "In addition, following termination, you acknowledge that you may no longer have access to any content, data or information submitted to Pennylane relating to the Pennylane API or your API Integrations, including, without limitation any of Your Content." } ] }, { "kind": "privacy", "url": "https://www.pennylane.com/fr/legal/privacy", "state": "read", "readAt": "2026-10-09", "words": 5770, "points": 4.8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": false }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": false }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": false }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": false }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "Vous pouvez contacter notre délégué à la protection des données à l’adresse email suivante : dpo@pennylane.com.", "says": "dpo@pennylane.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": false } ], "notes": [ { "date": "2026-10-08", "text": "The annex lists AI model training among the purposes of further processing, in a row covering connection, audit log and usage data.", "quote": "- Utilisation des données à des fins d’amélioration des produits ; entraînement de modèle d’IA," }, { "date": "2026-10-08", "text": "The annex lists personalised advertising, with Google Ads as the example, as a purpose based on browsing, profile and information supplied.", "quote": "Publicité personnalisée en fonction de votre navigation, de votre profil et des informations que vous nous avez fournies (e.g. Google ads)" }, { "date": "2026-10-08", "text": "Some customer support requests may be handled and answered automatically by an AI system through Intercom (Fin AI).", "quote": "Certaines demandes adressées à notre support client peuvent être traitées et recevoir une réponse générée de façon automatisée par un système d’intelligence artificielle (IA), notamment via notre partenaire Intercom (Fin AI)." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/pennylane.json", "live": { "slug": "pennylane", "probe": { "target": "https://app.pennylane.com/api/external/v2", "method": "get", "lastAt": "2026-10-10T02:07:20.006934907Z", "lastOk": true, "lastStatus": 200, "lastMs": 86, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 111, "p95ms24h": 670, "samples24h": 107, "samples30d": 107, "days": [ { "date": "2026-10-09", "probes": 85, "ok": 85 }, { "date": "2026-10-10", "probes": 22, "ok": 22 } ] }, "vendorStatus": { "page": "https://status.pennylane.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-10T02:06:22.892177668Z" }, "pages": [ { "url": "https://pennylane.readme.io/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-09T18:43:10.597188172Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "baba0cf1ecaa" }, { "url": "https://www.pennylane.com/fr/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-09T18:52:57.370338236Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "2e89b0e31f0b" }, { "url": "https://pennylane.readme.io/page/api-contract-terms", "kind": "terms", "status": 200, "checkedAt": "2026-10-09T18:43:13.114667877Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "7815b7f4ccf6" } ], "updatedAt": "2026-10-10T02:07:20.006934907Z" } } }