Sign up to receive our monthly newsletter.
Have a question? Contact us here.
Learn about job openings.
Penpot is the first open-source design and prototyping platform that enables true collaboration between designers and developers. Built on web standards (SVG, CSS, HTML), it provides professional design tools without vendor lock-in, available as cloud service or self-hosted.

Owner
Kaleidos
Type
web
Licence
MPL-2.0
Last evaluated
24.03.2026
Origin country
Spain
contact
support@penpot.appRelease date
-
DPG since
24.03.2026
The following repositories were submitted by the solution and included in our evaluation. Any repositories, add-ons, features not included in here were not reviewed by us.
N/A
N/A
Portuguese, French, German, Spanish, English
Over 1M users use the solution. Companies all over the world are using it.
* This information is self-reported and updated annually

SDG 9: Industry, Innovation and Infrastructure Target 9.5 (Enhance Research and Upgrade Technology): Penpot advances open-source design technology infrastructure, providing web-based design and prototyping capabilities using open standards (SVG, CSS, HTML, JSON). It enables innovation in digital product development by breaking vendor lock-in and promoting interoperability. Target 9.c (Universal Access to ICT): Penpot significantly increases access to information and communications technology. Being free, web-based, and open-source, it provides professional-grade design tools to users who cannot afford expensive proprietary subscriptions (like Figma or Adobe), bridging the digital divide. SDG 10: Reduced Inequalities Target 10.2 (Promote Universal Inclusion): Penpot empowers the social and economic inclusion of all by removing financial gatekeeping. It allows any person, regardless of their economic status or geographic location, to access the same high-level design and collaboration tools used by top-tier tech companies. Target 10.3 (Ensure Equal Opportunity): Penpot reduces inequality in access to professional design tools by providing free, open-source alternatives to expensive proprietary software, enabling participation from underrepresented regions and communities.
No mandatory proprietary dependencies
Yes
Privacy by Design, Data Security, Contribution Guidelines
PII data is collected and stored but NOT distributed.
Encryption: HTTPS/TLS encryption for all data transmission between users and servers Secure Authentication: Password hashing, secure session management, optional two-factor authentication (2FA) for Enterprise Access Controls: Role-based permissions (Owner, Administrator, End User) limit data access Self-Hosting Option: Organizations can deploy Penpot on their own infrastructure for complete data sovereignty and control Data Isolation: User workspaces and projects are isolated from each other Privacy by Design: Minimal data collection - only necessary information is gathered GDPR Compliance: Adherence to European data protection standards Data Processing Addendum: Clear contractual commitments for organizational customers User Rights: Users can delete their accounts and data, request data exports Open Source Transparency: Security vulnerabilities can be identified and patched by community review Regular Updates: Security patches and updates to address vulnerabilities Third-party Vetting: Careful selection of service providers with appropriate security measures Secure Storage: Database security measures, encrypted connections to storage backends SSO Support: Single sign-on integration for enterprise security policies (Enterprise plan) For maximum security, organizations can self-host Penpot on-premise to maintain full control over all data.
Content is collected and stored but NOT distributed.
(1) Policies for Identifying Inappropriate and Illegal Content: Terms of Service Prohibition: Users explicitly agree not to upload, distribute, or publish content that is: Libelous, defamatory, obscene, or pornographic Threatening or abusive Invasive of privacy or publicity rights Illegal under applicable laws Violates third-party copyright, trademarks, or proprietary rights Good Faith Contribution: Users must contribute to public projects in good faith and refrain from boycotting, damaging, or making projects useless Code of Conduct: Community contributors must foster a positive and safe environment Clear Violation Standards: Defined in Terms of Service at https://penpot.app/terms (Section 5 and 11) (2) Mechanisms for Detection, Moderation, Reporting, and Removal: Detection: User reporting through email: [email protected] Community flagging in public projects and forums Manual review when violations are reported Moderation: Platform reserves the right to review reported content No pre-screening of uploads, but reactive moderation based on reports Manual review by Kaleidos team Reporting: Email support: support@penpot.app Community forum moderation for public discussions Users can report violations directly to platform administrators Removal: Kaleidos has the right (discretion) to remove content that breaches Terms of Service Account suspension or termination for repeat violators Immediate removal capability for illegal or harmful content Users can be removed from workspaces by organization owners/administrators for policy violations Additional Protections: Private workspace options to limit content exposure Self-hosted deployments allow organizations to implement their own content policies Legal compliance: Platform will remove content when required by law enforcement or legal obligations
Yes
(1) Policies and Processes for Protection from Harassment: Code of Conduct: All contributors to Penpot (through code, community, or events) must adhere to a Code of Conduct Requirement to foster a positive and safe environment Available in GitHub repository and community spaces Terms of Service Protections: Users prohibited from uploading/distributing content that is threatening, abusive, or harassing Users cannot engage in activities that violate privacy or publicity rights Platform has right to remove violating users and content Reporting Mechanisms: Email Support: [email protected] for reporting harassment or abuse Community Moderation: Active moderation on community forum (https://community.penpot.app) GitHub: Code of Conduct enforcement through GitHub repository moderation Direct Contact: Users can contact Kaleidos directly for safety concerns Protection Processes: Workspace owners/administrators can remove users engaging in harassment Private workspaces available to limit exposure Platform can suspend or terminate accounts for violations Users can control who has access to their projects Community guidelines enforced in public spaces (2) Safety and Security of Underage Users: Age Restrictions: Minimum age requirement: 14 years old (stated in Terms of Service Section 3.1) Users under 14 are not permitted to access or use the platform Protections for Minors (14-18): Same harassment protections apply Parental/guardian oversight recommended for users under 18 Corporate email controls: If using organization email, the organization (e.g., school) maintains oversight Private workspace defaults protect young users' work from public exposure Reporting mechanisms available for any safety concerns Additional Safeguards: No public profile requirements - users can remain relatively anonymous Content moderation removes inappropriate material Self-hosted option allows schools/organizations to maintain complete control for minor users https://help.penpot.app/contributing-guide/coc/
2026-03-24 15:57:55
Ricardo Torres (L2 Reviewer) submitted their review of Penpot (152) and found it to be a DPG
2026-03-24 15:57:54
System unmarked Penpot (13398) as a nominee
2026-03-24 15:57:48
Ricardo Torres (L2 Reviewer) passed 1. SDG Relevance for Penpot (13398)
2026-03-24 15:57:46
Ricardo Torres (L2 Reviewer) edited 1. SDG Relevance for Penpot (13398)
2026-03-24 15:55:59
Ricardo Torres (L2 Reviewer) edited a note on 1. SDG Relevance for Penpot (13398)
2026-03-24 15:54:12
Ricardo Torres (L2 Reviewer) passed 4. Platform Independence for Penpot (13398)
2026-03-24 15:54:07
Ricardo Torres (L2 Reviewer) moved Penpot (13398) to under review
2026-03-24 12:34:53
Ricardo Torres (L2 Reviewer) finished consultation on 4. Platform Independence for Penpot (13398)
2026-03-24 08:51:19
Ivan Perdomo (Expert) submitted their inputs on 4. Platform Independence for Penpot (13398) as “input”
2026-03-24 04:02:42
Ricardo Torres (L2 Reviewer) requested consultation on 4. Platform Independence for Penpot (13398)
2026-03-24 04:02:25
Ricardo Torres (L2 Reviewer) moved Penpot (13398) to under consultation
2026-03-24 04:00:43
Ricardo Torres (L2 Reviewer) passed Scale of Solution for Penpot (13398)
2026-03-24 04:00:40
Ricardo Torres (L2 Reviewer) passed 9C. Protection from Harassment for Penpot (13398)
2026-03-24 04:00:37
Ricardo Torres (L2 Reviewer) passed 9B. Inappropriate & Illegal Content for Penpot (13398)
2026-03-24 04:00:35
Ricardo Torres (L2 Reviewer) passed 9A. Data Privacy & Security for Penpot (13398)
2026-03-24 04:00:30
Ricardo Torres (L2 Reviewer) passed 8. Standards & Best Practices for Penpot (13398)
2026-03-24 04:00:27
Ricardo Torres (L2 Reviewer) passed 7. Privacy & Applicable Laws for Penpot (13398)
2026-03-24 04:00:23
Ricardo Torres (L2 Reviewer) passed 6. Mechanism for Extracting Data for Penpot (13398)
2026-03-24 04:00:18
Ricardo Torres (L2 Reviewer) passed 5. Documentation for Penpot (13398)
2026-03-24 04:00:00
Ricardo Torres (L2 Reviewer) passed 3. Clear Ownership for Penpot (13398)
2026-03-24 03:59:54
Ricardo Torres (L2 Reviewer) passed 2. Open Licensing for Penpot (13398)
2026-03-24 03:59:34
Ricardo Torres (L2 Reviewer) passed General Information for Penpot (13398)
2026-03-24 03:58:17
Ricardo Torres (L2 Reviewer) pulled Penpot (13398) under review
2026-03-18 10:23:55
System remove tag Late from Penpot (13398)
2026-03-18 10:23:55
Bolaji Ayodeji (L1 Reviewer) submitted their review of Penpot (13398)
2026-03-18 10:23:26
Bolaji Ayodeji (L1 Reviewer) passed Scale of Solution for Penpot (13398)
2026-03-18 10:23:23
Bolaji Ayodeji (L1 Reviewer) passed 9C. Protection from Harassment for Penpot (13398)
2026-03-18 10:23:21
Bolaji Ayodeji (L1 Reviewer) edited 9C. Protection from Harassment for Penpot (13398)
2026-03-18 10:22:47
Bolaji Ayodeji (L1 Reviewer) passed 9B. Inappropriate & Illegal Content for Penpot (13398)
2026-03-18 10:22:18
Bolaji Ayodeji (L1 Reviewer) passed 6. Mechanism for Extracting Data for Penpot (13398)
2026-03-18 10:22:14
Bolaji Ayodeji (L1 Reviewer) passed 9A. Data Privacy & Security for Penpot (13398)
2026-03-18 10:21:06
Bolaji Ayodeji (L1 Reviewer) passed 8. Standards & Best Practices for Penpot (13398)
2026-03-18 10:20:39
Bolaji Ayodeji (L1 Reviewer) passed 7. Privacy & Applicable Laws for Penpot (13398)
2026-03-18 10:20:06
Bolaji Ayodeji (L1 Reviewer) edited a note on 6. Mechanism for Extracting Data for Penpot (13398)
2026-03-18 10:19:56
Bolaji Ayodeji (L1 Reviewer) edited 6. Mechanism for Extracting Data for Penpot (13398)
2026-03-18 10:17:23
Bolaji Ayodeji (L1 Reviewer) passed 5. Documentation for Penpot (13398)
2026-03-18 10:16:31
Bolaji Ayodeji (L1 Reviewer) edited 5. Documentation for Penpot (13398)
2026-03-18 10:15:55
Bolaji Ayodeji (L1 Reviewer) passed 4. Platform Independence for Penpot (13398)
2026-03-18 10:15:47
Bolaji Ayodeji (L1 Reviewer) edited a note on 4. Platform Independence for Penpot (13398)
2026-03-17 14:32:54
Bolaji Ayodeji (L1 Reviewer) passed 3. Clear Ownership for Penpot (13398)
2026-03-17 14:31:21
Bolaji Ayodeji (L1 Reviewer) passed 2. Open Licensing for Penpot (13398)
2026-03-17 14:31:08
Bolaji Ayodeji (L1 Reviewer) failed 1. SDG Relevance for Penpot (13398)
2026-03-17 14:30:57
Bolaji Ayodeji (L1 Reviewer) edited a note on 1. SDG Relevance for Penpot (13398)
2026-03-17 14:30:02
Bolaji Ayodeji (L1 Reviewer) edited a note on 1. SDG Relevance for Penpot (13398)
2026-03-17 02:00:02
System add new tag Late to Penpot (13398)
2026-03-16 18:13:02
Bolaji Ayodeji (L1 Reviewer) passed General Information for Penpot (13398)
2026-03-16 18:12:32
Bolaji Ayodeji (L1 Reviewer) edited General Information for Penpot (13398)
2026-03-16 17:53:03
Bolaji Ayodeji (L1 Reviewer) pulled Penpot (13398) under review
2026-03-13 19:01:14
Admin (Admin) modified owner from 4666 (Mario Araujo) to 4794 (Pablo Ruiz-Mzquiz) for Penpot (13398)
2025-11-14 15:35:09
Mario Araujo () submitted application for Penpot (13398)