PandaDoc Sync — Executed Documents, Automatically Where They Belong

Type: Webhook Automation & Document Pipeline

Stack: Python 3.11, GCP Cloud Functions, PandaDoc API, HubSpot CRM API, Google Drive API

Role: Sole Developer

Problem

Executed contracts, NDAs, proposals, and other documents flow through PandaDoc — but once signed, they live only in PandaDoc. Sales reps, account managers, legal, and HR teams all need access to these documents, but getting them into the right place required manual effort: download from PandaDoc, upload to the right folder in Google Drive, attach to the right deal in HubSpot. Multiply that by every document across every team and it becomes a meaningful operational burden, and the kind of task that gets skipped under pressure.

The result is predictable: documents in the wrong place, deals missing attachments, legal looking for contracts that were never filed, and no consistent record of what was executed and when.

There's also a structural challenge across teams. Legal, HR, sales, and operations each send documents through separate PandaDoc workspaces with different security contexts — different API keys, different webhook secrets, different filing requirements. A single integration needs to handle all of them without one team's documents ending up in another's folder.

Solution

A Google Cloud Function that receives PandaDoc webhook events and handles the entire sync automatically — no manual downloads, no manual uploads, no missed filings.

When a document is sent or a PDF is ready, the function:

1. Validates the webhook signature (HMAC-SHA256, per-workspace secrets) to prevent spoofed events
2. Identifies which workspace sent the event from the webhook URL path
3. Extracts the company name, document type, and HubSpot deal ID from the document metadata
4. Downloads the PDF from PandaDoc using the workspace-specific API key
5. Uploads it to a shared Google Drive in a nested folder hierarchy organized by workspace, company, document type, and status — this happens for every document across all workspaces
6. If the document is linked to a HubSpot deal, also uploads it to HubSpot, creates a Note with the file attached, and associates the note to all linked contacts, companies, and the deal

In practice this means sales documents — which are typically created directly from a HubSpot deal — sync to both destinations. Legal, HR, and executive documents, which are rarely linked to a deal, go to Google Drive only. The routing is automatic and requires no configuration per document.

Company name resolution uses a priority fallback chain: PandaDoc tokens (Client.Company, Company.Name) first, then recipient email addresses. For Legal and HR workspaces, full email addresses are used as folder names rather than just the domain — appropriate for documents associated with specific individuals.

Multi-workspace support means a single deployed function handles all business units. Each workspace (sales, legal, hr, operations, executive) has its own webhook secret and API key in GCP Secret Manager, and is routed by URL path — so each team's documents are isolated and correctly filed without separate deployments.

Outcome

Every executed PandaDoc document is automatically filed within seconds of being sent, with no manual effort from any team.

• All documents across all workspaces land in Google Drive, organized by workspace, company, document type, and status — one consistent filing system for the entire organization
• Sales documents linked to a HubSpot deal also appear in the CRM: attached to the deal record, associated with all linked contacts and companies, with a timestamped note confirming what was executed and when
• Legal, HR, and executive documents go to Google Drive only — they're not deal-linked, so HubSpot is skipped automatically without any configuration
• Filing is consistent regardless of who sends the document or which team it originates from

Part of a professional portfolio. Full source available at github.com/Suixcity/pandadoc-sync