BoldSign vs PandaDoc

BoldSign 77

Closed service under Terms of Use effective February 2025 that name Syncfusion, Inc. and North Carolina law. The SDKs and the deprecated MCP package are MIT (17 of 30). The privacy policy (July 2026) keeps personal data as long as necessary with no number, the terms keep signed documents and audit trails at least three years and schedule inactive accounts for deletion after six months, sandbox documents go after 14 days, and the terms say customer data is used for nothing but performing the agreement. A subprocessor list is linked and no DPA was found on the pages read (20 of 30). No deprecation policy. The terms let Syncfusion modify or discontinue BoldSign at its discretion, and the changelog labels breaking changes without a notice period (6 of 20). The privacy policy links the subprocessor list, and the security page names Google Cloud and Azure regions in US East, the EU, Canada and Australia (16 of 20). 17 + 20 + 6 + 16 = 59.

PandaDoc 59

The service is closed under a Master Services Agreement named in the OpenAPI spec. That page refused our reader, so the terms are unread, while the spec, the SDKs and the MCP guide are MIT (8 of 30). The AI policy says customer content isn't used to train models and that third-party AI providers can't retain it, with an opt-out for aggregated usage data. The compliance article says signed documents are kept for the length of the customer relationship. The privacy notice and DPA were not read, so agreement between them is unconfirmed (12 of 30). No written deprecation policy found. The spec marks six items deprecated and the auth overview labels API keys legacy, without removal dates (5 of 20). The docs describe separate US and EU regions and US-only AI processing. A sub-processor page exists at www.pandadoc.com/legal/subprocessors but refused our reader (8 of 20, partly unchecked).

BoldSign 84

Read with the hosted lines and scored on the REST API v1, the surface the SDKs and the hosted MCP server call. status.boldsign.com on Atlassian Statuspage has Web App and API components for Global, Europe, Canada and Australia plus Docs, with 90-day uptime and an incident history (20). The history feed, read on 3 November 2026, lists four one-hour scheduled maintenances between 19 and 27 September and no incident after a 20-minute partial disruption on 21 July 2026, so the 90 days from 5 August are clean (30). Rate limits are published per account, 2,000 requests an hour live and 50 an hour in the sandbox (15). The rate-limit page says 429 is returned with messages and usage is tracked in response headers, and the guide recommends webhooks over polling. No Retry-After is documented and there are no idempotency keys (6 of 15). No SLA document was found. security.txt advertises a 99.999 per cent uptime SLA, the terms disclaim uninterrupted service and refer to a support SLA available on request (3 of 10). v1 is the stable version with beta endpoints under v1-beta (10). 20 + 30 + 15 + 6 + 3 + 10 = 84.

PandaDoc 73

Read with the hosted lines and scored on the REST API, which the hosted MCP server calls. status.pandadoc.com on Statuspage has components for API, Webhooks, sending, uploading and downloading in two regions, with history (20). In the 90 days from 4 August 2026 its feed lists three incidents. On 20 August document creation and viewing degraded for some users, mitigated by PandaDoc's own update after 17 minutes. On 1 September inline fields failed in the recipient view for some users. On 6 September document processing was unavailable for many customers from 17:00 to 20:28 PDT, through the app and the API, on the US and Global components only. Each names some customers or one region, so all three read as partial and minor (20 of 30). The 15 July Public API failures have left the window. Rate limits published per endpoint, 100 to 2,000 requests a minute (15). The docs say to retry 409 and back off on 429, but Retry-After appears only on four not-ready responses and there are no idempotency keys for creates (8 of 15). No SLA found in the developer docs or help centre, and the legal pages on www.pandadoc.com still answer with a browser check (0, unchecked). The v1 API is generally available and the MCP server is at 1.0.0 in the registry, with a few endpoints under /public/beta (10).

BoldSign 40

Read with the hosted rubric. No x402, MPP or L402 (0). The Enterprise API plan is public at $30 a month with 40 envelopes and $0.75 per additional envelope, and add-ons are priced per unit (20). The free sandbox gives full API access with no credit card, and the 30-day trial also needs no card per the pricing page (20). A person signs up in a browser and mints the key or registers the OAuth app in the web app (0). 0 + 20 + 20 + 0 = 40.

PandaDoc 30

Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public in the help centre (Starter $19 a user a month billed annually, Business $49, Enterprise through Sales), but usage credit packs for API documents are priced only on the in-app billing page (10). The Free plan includes API and MCP access with 25 API-created documents and 5 sends a month, and the sandbox key isn't charged, with no card needed (20). A person has to sign up in a browser, verify an email address and approve OAuth or create a key, and a production key needs approval from Sales (0).

BoldSign 62

List calls take Page and PageSize and document properties return the full object; no field selection was found. The hosted MCP server has 14 compact tools, but the REST API is the graded surface (14 of 25). Page and PageSize on document, template, contact, user and team lists, with search, status, date, label and team filters on documents (16 of 20). The troubleshooting page gives a cause and a fix per status code, 401 covers a region mismatch, and 422 carries validation detail (14 of 20). No idempotency keys. Draft send and the sandbox make trial calls safe, and the MCP docs ask for a human confirmation before send, reminder and revoke, but the tools' annotations couldn't be read (5 of 20). A send needs files or a template, a title and signers with fields, and the SDKs cover .NET, Node, Python, Java and PHP (13 of 15). 14 + 16 + 14 + 5 + 13 = 62.

PandaDoc 68

List endpoints take count (default 50, maximum 100) and page. There is no field selection, but a light status endpoint sits beside the full details call, and beta endpoints return a document summary in four lengths or the content as Markdown or plain text. The number of MCP tools isn't published, and PandaDoc's own skills name 17 (17 of 25). Document lists filter by status, dates, template, folder, contact, tag, metadata and free text, with order_by (20). Errors carry a type and detail, with 409 for a document that isn't ready, 403 forbidden_error when usage credits run out and 423 for a locked account, each explained in the guides (16 of 20). No idempotency keys on creates or sends. Webhook deliveries carry a stable X-PandaDoc-Webhook-Event-Id, and we couldn't see whether the MCP tools carry readOnlyHint or destructiveHint (4 of 20). Creating from a template needs a name, a template ID and recipients, but creation is asynchronous and needs a poll or webhook before sending. Official SDKs in Python, Node, Java and PHP, with the Python package unchanged since April 2024 (11 of 15).