PandaDoc vs Youtrust

PandaDoc 77

The OpenAPI repository moved to 8.25.1 on 29 October 2026, after 8.22.0 (8 October), 8.22.1, 8.23.0, 8.24.0, 8.24.1 and 8.25.0, adding template approval-workflow endpoints (30). Over three releases in 90 days, with 23 spec versions from 8.10.0 on 5 August to 8.25.1, and nine dated docs changelog entries from 8 September to 2 October (20). A closed service with a public changelog, a help centre, an API support address in the spec and a UserVoice forum. We didn't test how quickly support answers (10 of 15). The MCP server is in the official registry under the com.pandadoc.mcp namespace, still at 1.0.0, and its plugin repository (mcp-server-guide) tagged 1.0.1 on 12 October and kept adding client plugins to 30 October. Official SDKs exist in four languages, but pandadoc-python-client is at 6.2.0 from 8 April 2024 and the Node client's 7.0.0 line has been a release candidate since January 2026 (12 of 15). The Node repository has a publish workflow. The GitHub spec now leads the docs changelog by four versions, and the Python, Java and PHP clients haven't changed since April 2024 (5 of 10).

Youtrust 61

Read as a closed service. The changelog's newest entries are dated 21 October 2026 (30). Ten entries between 13 and 21 October 2026 (20). A help centre, contact@youtrust.com in the OpenAPI contact block, a changelog RSS feed and a feedback form for the AI connector. No public issue tracker (8 of 15). No official SDK; the GitHub organisation holds no client library and the docs point to generators and Postman (0 of 15). The OpenAPI file is current with the October changes and the MCP setup page was updated on 7 September 2026 (3 of 10). 30 + 20 + 8 + 0 + 3 = 61.

PandaDoc 59

The service is closed under a Master Services Agreement named in the OpenAPI spec. That page refused our reader, so the terms are unread, while the spec, the SDKs and the MCP guide are MIT (8 of 30). The AI policy says customer content isn't used to train models and that third-party AI providers can't retain it, with an opt-out for aggregated usage data. The compliance article says signed documents are kept for the length of the customer relationship. The privacy notice and DPA were not read, so agreement between them is unconfirmed (12 of 30). No written deprecation policy found. The spec marks six items deprecated and the auth overview labels API keys legacy, without removal dates (5 of 20). The docs describe separate US and EU regions and US-only AI processing. A sub-processor page exists at www.pandadoc.com/legal/subprocessors but refused our reader (8 of 20, partly unchecked).

Youtrust 72

Closed service under Terms of Use and Subscription updated 2 July 2026 that name Youtrust SAS under French law, with the previous version linked. The OpenAPI file's licence reads proprietary (15 of 30). The privacy policy names Youtrust SAS of Caen, lists retention periods by purpose (the contract term plus five years in France and ten in Germany and Italy for some records), links a list of subprocessors, and the security page says hosting is exclusively in France with evidence files archived at Arkhinéo (22 of 30). The versioning page says deprecated endpoints and properties keep working and are not planned for removal, compatible changes arrive without notice, and the terms describe an end-of-life notice for old platform versions with no period (10 of 20). A subprocessor list is linked from the privacy policy, hosting is in France at AWS EMEA's French branch per the legal notice, and no notice period for new subprocessors was found (17 of 20). 15 + 22 + 10 + 17 = 64.

PandaDoc 73

Read with the hosted lines and scored on the REST API, which the hosted MCP server calls. status.pandadoc.com on Statuspage has components for API, Webhooks, sending, uploading and downloading in two regions, with history (20). In the 90 days from 4 August 2026 its feed lists three incidents. On 20 August document creation and viewing degraded for some users, mitigated by PandaDoc's own update after 17 minutes. On 1 September inline fields failed in the recipient view for some users. On 6 September document processing was unavailable for many customers from 17:00 to 20:28 PDT, through the app and the API, on the US and Global components only. Each names some customers or one region, so all three read as partial and minor (20 of 30). The 15 July Public API failures have left the window. Rate limits published per endpoint, 100 to 2,000 requests a minute (15). The docs say to retry 409 and back off on 429, but Retry-After appears only on four not-ready responses and there are no idempotency keys for creates (8 of 15). No SLA found in the developer docs or help centre, and the legal pages on www.pandadoc.com still answer with a browser check (0, unchecked). The v1 API is generally available and the MCP server is at 1.0.0 in the registry, with a few endpoints under /public/beta (10).

Youtrust 85

Read with the hosted lines and scored on the Public API v3 at api.yousign.app, the surface both MCP servers call. yousign.statuspage.io on Atlassian Statuspage has an incident history and a feed (20). Between 5 August and 3 November 2026 the feed records HTTP 500 errors on the public API from 11:24 to 11:35 and 14:42 to 15:19 CEST on 7 October, caused by an infrastructure provider; about 45 minutes of delayed advanced and unavailable qualified signatures on 13 August; identity verification delays at a third-party provider on 1 September (most of a day), 2 September, 14 September and 16 October (33 minutes); 16 minutes of delayed seals on 16 October; email delays to Microsoft mailboxes on 4 September; and Orange network routing on 2 October. Several incidents, mostly at identity providers, and no outage of the core API over an hour (20). Rate limits are published per minute and hour for each environment (15). 429 answers Too many requests with x-ratelimit headers and a Ratelimit-Reset in seconds, the docs say to slow down and increase the delay, and there are no idempotency keys and no Retry-After (10 of 15). The API pricing page states 99 per cent and 99.9 per cent SLAs on the Plus and Pro plans (10). v3 is generally available (10). 20 + 20 + 15 + 10 + 10 + 10 = 85.

PandaDoc 30

Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public in the help centre (Starter $19 a user a month billed annually, Business $49, Enterprise through Sales), but usage credit packs for API documents are priced only on the in-app billing page (10). The Free plan includes API and MCP access with 25 API-created documents and 5 sends a month, and the sandbox key isn't charged, with no card needed (20). A person has to sign up in a browser, verify an email address and approve OAuth or create a key, and a production key needs approval from Sales (0).

Youtrust 40

Read with the hosted rubric. No x402, MPP or L402 (0). API plan prices are public without login, Plus from €104 a month and Pro from €129 with €2 per extra signature (20). The sandbox trial lasts 40 days and needs no credit card per the API pricing page (20). A person signs up in a browser and an Admin creates the key there (0). 0 + 20 + 20 + 0 = 40.

PandaDoc 61

OAuth 2.0 authorisation code for the API with read and write scopes, and for the MCP server OAuth with PKCE (S256), dynamic client registration and five scopes (read, write, documents:read, documents:edit, documents:send). Credentials travel in the Authorization header. API keys are labelled legacy, belong to one workspace and carry their owner's full role, and the scopes are broad (26 of 30). Read-only scopes exist and a sandbox key can send only within the sender's own email domain. No confirmation step for sending or deleting was found in the API or MCP docs (11 of 20). Documents and recipient-filled fields are untrusted content, and we found no prompt-injection guidance for MCP hosts. PandaDoc's skills do tell the agent that AI-extracted contract values are unconfirmed (3 of 15). API request logs with key, user and body in the developer centre and through /public/v2/logs, a per-document audit trail endpoint, and API actions attributed to the key owner. The account audit log is Enterprise only and covers 30 days (13 of 15). The help centre states SOC 2 Type II and now carries a security bulletins page, updated in the week of 26 October 2026, giving PandaDoc's exposure and status for five public vulnerabilities and incidents. The security page and security.txt on www.pandadoc.com still answer with a browser check, app and api hosts return 404 for security.txt, and no bug bounty was established. That is above the 5 for a bare SOC 2 claim, for the public bulletins (8 of 20, partly unchecked).

Youtrust 68

Bearer API keys with an Organization or Workspace scope and a Read-Only or Full-Access permission, separate per environment, created only by Admins and Owners, and OAuth for the AI connector with revocation in account settings. No expiry or rotation guidance found (26 of 30). Read-Only keys, workspace scoping, draft-then-activate, and the AI connector's examples ask before sending. The Developer MCP's execute-request runs any call with the key's full permissions, activation, cancellation and deletion included, and the API has no approval step (14 of 20). Signer names, field answers and documents return through the API, Safe String rules strip HTML, URLs and email addresses from inputs, and no injection guidance was found (4 of 15). Audit trails per signature request and signer, downloadable, plus consumption records; no log of API calls or key use was found (8 of 15). PGP-signed security.txt, a bug bounty and annual technical audits on the security page, eIDAS certification as a trust service provider, hosting in France. ISO 27001 was not named on the pages read (16 of 20). 26 + 14 + 4 + 8 + 16 = 68.

PandaDoc 68

List endpoints take count (default 50, maximum 100) and page. There is no field selection, but a light status endpoint sits beside the full details call, and beta endpoints return a document summary in four lengths or the content as Markdown or plain text. The number of MCP tools isn't published, and PandaDoc's own skills name 17 (17 of 25). Document lists filter by status, dates, template, folder, contact, tag, metadata and free text, with order_by (20). Errors carry a type and detail, with 409 for a document that isn't ready, 403 forbidden_error when usage credits run out and 423 for a locked account, each explained in the guides (16 of 20). No idempotency keys on creates or sends. Webhook deliveries carry a stable X-PandaDoc-Webhook-Event-Id, and we couldn't see whether the MCP tools carry readOnlyHint or destructiveHint (4 of 20). Creating from a template needs a name, a template ID and recipients, but creation is asynchronous and needs a poll or webhook before sending. Official SDKs in Python, Node, Java and PHP, with the Python package unchanged since April 2024 (11 of 15).

Youtrust 63

List calls take limit and filters, and a signature request's documents, signers and fields are fetched by their own calls, so responses stay moderate. No field selection (14 of 25). Cursor pagination with limit and after on 26 list operations, with status, workspace_id, created_at and date range filters (20). Errors carry a type an agent can branch on, a detail and invalid_params naming the field and reason, with guidance to retry only 500 and 503 (17 of 20). No idempotency keys. A request is a draft until activate, pause and cancel are explicit calls, and the MCP tools' annotations couldn't be read (6 of 20). A first send takes four calls (create, add document, add signer with fields, activate), identity and seal options add more, and there is no official SDK in any language (6 of 15). 14 + 20 + 17 + 6 + 6 = 63.