Penneo A/S

Denmark · owned by Visma AS (Norway) · penneo.com · 26 vendors

Penneo A/S is a Danish Software-as-a-Service (SaaS) company that provides secure digital signing and Know Your Customer (KYC) workflow solutions. It helps businesses, particularly in the auditing and accounting industries, to automate document processes, streamline client onboarding, and ensure regulatory compliance. The platform aims to simplify complex document workflows, boosting operational efficiency and security.

Resilience scores

Disruption prediction

Penneo A/S has an estimated 11% probability of disruption in the next 6 months.

15 of Penneo A/S's 26 vendors monitored for disruptions.

Technology vendors

Services catalogue

3 services in catalogue across 3 categories; runs on 26 sub-vendors.

Insights

Last updated 2026-09-13 · revision 2

26 direct vendors, 326 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 5/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Penneo exhibits medium migration readiness, primarily driven by its modern, cloud-native technology stack. The use of AWS, REST API architecture, and webhook-based integrations suggests a decoupled and flexible system, which generally facilitates migration efforts. The presence of a Penneo Open API further indicates a modular design, making it easier to re-platform or integrate components. Furthermore, the company's established ISO/IEC 27001/27701 certifications and adherence to eIDAS and GDPR mean it has mature processes for security and data privacy, which are critical for managing a complex migration. The most significant challenges for migration readiness stem from the stringent regulatory environment. As an EU Qualified Trust Service Provider (QTSP) with eIDAS and GDPR compliance, any migration must meticulously ensure continued adherence to these complex requirements, potentially limiting options and increasing costs. While not explicitly stated, the use of EU data centers and operations in EU countries strongly implies EU data residency requirements, which would restrict migration to non-EU regions. The 'Total Services: 32' and 'Vendor Lock-in Risk: Unknown' indicate potential complexities in managing numerous vendor dependencies and contracts during a migration. The absence of financial stability data also prevents a full assessment of the company's capacity to fund a significant migration initiative.

Compliance

11 in-scope frameworks identified; showing 3.

ISO — Compliant

Penneo holds ISO/IEC 27701:2019 certification, which is the international standard for Privacy Information Management Systems (PIMS) and directly extends ISO 27001 to cover privacy management aligned with GDPR requirements. This certification is independently audited and publicly disclosed. Risk is Low as the certification is active, verifiable, and directly supports GDPR compliance obligations.

Evidence: https://penneo.com/trust-center/, https://penneo.com/iso-certificates/, https://penneo.com/wp-content/uploads/2025/09/Certificate-Penneo-ANAB-ISO-27701-19_signed.pdf

DORA (source) — Assessment Required

DORA applies to financial entities and their critical ICT third-party service providers operating in the EU. Penneo explicitly serves the Finance & Banking sector and is used by financial institutions for document signing. As a critical ICT service provider to financial entities, Penneo may be classified as a 'critical ICT third-party service provider' under DORA, which would subject them to direct oversight by EU supervisory authorities. Penneo's Trust Center explicitly acknowledges DORA and states they 'support financial entities' ICT risk management and reporting obligations under DORA,' indicating active engagement with this regulation. Risk is Medium because while Penneo is clearly aware of and engaged with DORA, their formal classification as a critical ICT third-party provider and the scope of their DORA obligations require further assessment.

Evidence: https://penneo.com/trust-center/, https://penneo.com/finance/

eIDAS Regulation — Compliant

Penneo is a recognized EU Qualified Trust Service Provider (QTSP) listed on the European Union Trust List (EUTL), which is the highest level of compliance with the eIDAS Regulation. QTSP status requires rigorous conformity assessment by a national supervisory body (in Denmark, Erhvervsstyrelsen) and ongoing supervisory audits. This is a core regulatory requirement for Penneo's business model, and their QTSP status confirms full compliance. Risk is Low as QTSP status is actively maintained and publicly verifiable on the EUTL.

Evidence: https://penneo.com/trust-center/, https://eutl.penneo.com, https://penneo.com/use-cases/eidas-compliance/, https://penneo.com/blog/eidas-2-impact-on-digital-transactions-identity-verification/

Financials

Three-year financials

Financial Resilience Score: 6/10

Penneo A/S demonstrates moderate financial resilience characterized by strong revenue quality and market positioning offset by persistent operating losses. The company operates a high-quality SaaS subscription model with strong ARR growth (from ~DKK 64M in 2021 to ~DKK 97M in 2023) and enjoys a dominant position in its Danish home market, where approximately 81% of Danish annual reports are signed via its platform. Its customer base includes all Big 4 accounting firms and 3,500+ companies, creating meaningful switching costs through deep ERP and audit-tool integrations. However, the company has been loss-making since inception, requiring a rights issue in 2023 to strengthen its balance sheet after two years of investment-driven losses (EBIT of ~DKK -45M in 2021 and ~DKK -51M in 2022). Management has since pivoted toward disciplined profitability, narrowing the FY2023 operating loss to ~DKK -23M and guiding toward EBITDA break-even in 2024. Regulatory tailwinds from eIDAS 2.0 and increasing EU digital compliance requirements support the growth outlook, but geographic concentration in Denmark (~70-75% of revenue) and competitive pressure from global (DocuSign, Adobe Sign) and regional (Scrive, Signicat, Visma Sign) players constrain the resilience score. As a small-cap on Nasdaq First North, the company also faces limited float, higher volatility, and dependence on capital markets access.

Key strengths: High-quality SaaS subscription model with strong ARR growth (~27% CAGR 2021-2023), Dominant niche position with ~81% of Danish annual reports signed via Penneo, Big 4 accounting firms (Deloitte, KPMG, EY, BDO) as customers, 3,500+ diversified customer base reducing single-customer risk, Regulatory tailwind from eIDAS 2.0 and EU digital compliance requirements, 2023 equity raise improved runway and management pivoted to path to profitability, Narrowing operating losses with EBITDA break-even guidance for 2024

Risk factors: Loss-making since inception with historical cash burn, Profitability targets have shifted repeatedly, Small-cap on Nasdaq First North with limited float and higher volatility, Geographic concentration in Denmark (~70-75% of revenue), Slower-than-planned international expansion, Competitive pressure from DocuSign, Adobe Sign, Scrive, Signicat, Visma Sign, Ongoing product transition/consolidation of KYC product, Business model dependency on national eIDs (MitID, BankID, itsme)

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report