Proposals & Invoices · Article 5.4
The three documents: Proposal, Service Agreement, and the audit row
A signed Clozo proposal produces three legal artefacts: the Proposal PDF (the offer), the Service Agreement (the binding contract), and a SignatureAudit row (the eIDAS evidence). Each plays a different legal role under EU contract law and eIDAS Reg. 910/2014.
EU contract law is built on three concepts: offer, acceptance, and consideration. Clozo maps these to three artefacts so each step has its own permanent record. If you ever need to defend the contract — a dispute, an audit, a chargeback — you cite all three. Most freelancer tools collapse these into a single "signed PDF" and leave the structure invisible; Clozo surfaces it because the structure is what makes the signature legally enforceable, especially given that Clozo issues a Simple Electronic Signature (SES) under eIDAS Art. 3(10) — the audit row is what does the evidentiary work, not the signature classification.
in your Documents dropdown, you have three items per signed proposal: Proposal PDF (PRO-), Service Agreement (AGR-), and (after deposit) Deposit Invoice (DEP-). The Service Agreement is the one you'd attach to a portfolio review or share with an accountant — it's the "this is the contract" document. The SignatureAudit row sits behind the Documents dropdown's "Download signature audit trail" link and is what you cite if a signature is ever challenged.
Why this works this way
The Proposal PDF (PRO-2026-NNNN) is generated the moment you click Send. It contains the line items, totals, payment terms, dates, the client's identity, and your business identity, all formatted to EU VAT Directive Art. 226 standards. Once rendered, it is uploaded to immutable Cloudflare R2 storage with a legal_hold flag — even an admin cannot delete it. This document represents your legal offer to the client.
The Service Agreement (AGR-2026-NNNN) is generated the instant the client clicks Sign. It is a separate PDF that quotes the proposal verbatim and attaches a signature block with the client's typed name and the timestamp. This is the acceptance artefact. It cites the proposal it descends from by number (e.g., "This Service Agreement is the binding acceptance of Proposal PRO-2026-0042 dated 2026-04-15"). Note: the v1 Service Agreement does not embed a SHA-256 hash of the proposal PDF — Clozo's SignatureAudit model has no pdf_hash field, and RFC 3161 trusted timestamping is on the [D-111] roadmap (Phase 4) but is not part of v1. Document integrity is provided at the storage layer (R2 legal_hold flag prevents overwriting or deletion within the retention window) rather than via a cryptographic seal binding signature to document.
The SignatureAudit row is a database record (not a PDF) that captures the eIDAS SES evidence stack ([A-007] DECISIONS.md):
1. Identity: typed signer_name + signer_email matching the client record.
2. Possession: PIN entry from the email (per-slug lockout 5-fails-→-24h-block, sliding 1-hour window, plus per-IP 10 req/min rate limit on the public endpoint).
3. Technical context: ip_address, user_agent, raw_event (full request headers JSONB), signed_at.
4. Consent record: the consent field captures the affirmative confirmation that the signer is authorised to bind the named party.
Together, this stack constitutes a Simple Electronic Signature (SES) under eIDAS Art. 3(10), backed by a 10-year audit trail. For everyday freelance commercial work — design, development, consulting, photography, copywriting, training, translation — SES + audit trail is sufficient and enforceable: Art. 25(1) gives the non-discrimination floor ("shall not be denied legal effect... solely on the grounds that it is in electronic form") and national civil law (DE BGB §126 / Formfreiheit, FR Code civil Art. 1366–1367, ES Ley 6/2020 + RDLeg 1/2007 Art. 102 for B2C distance contracts, NL BW Art. 6:227a + Wetboek van Burgerlijke Rechtsvordering Art. 156/156a, PL KC Art. 60 + KPC Art. 308, IT CAD D.Lgs. 82/2005 Art. 20–21) generally accepts the audit row as sufficient evidence of consensus. The strict equivalence to a handwritten signature under Art. 25(2) applies only to Qualified Electronic Signatures (QES, Art. 3(12)) — which require a hardware token from a Trust Service Provider (Bundesdruckerei in Germany, FNMT in Spain, Certinomis or Universign in France, ARSS in Italy) and are needed only for narrow categories: notarised real-estate transfers, certain regulated financial services, formal court submissions in some Member States, public-sector contracts under eIDAS Art. 27 where the receiving body explicitly demands AES or QES. See eidas-electronic-signature for the detailed level-by-level breakdown.
Retention: all three artefacts are stored for 10 years under GoBD §147 AO (Germany), Wet OB Art. 52 (Netherlands), CGI Art. L102 B (France), Codice Civile Art. 2220 (Italy), and parallel rules in other EU states. Clozo enforces this server-side via R2's legal_hold flag; you cannot delete a signed agreement, even if you delete the client record. Right-to-erasure requests under GDPR Art. 17 are honoured within the bounds of Art. 17(3)(b), which preserves retention required for compliance with a legal obligation.
Troubleshooting
Keep reading
Proposals & Invoices
The e-signature flow — what happens when your client clicks Sign
A single click triggers a four-part evidence capture, generates the Service Agreement, fires confirmation emails, and queues the deposit invoice — all in one atomic transaction under 200ms.
Compliance
eIDAS: what makes a Clozo signature legally binding in the EU
EU Regulation 910/2014 (eIDAS) defines three signature levels and gives each a clear legal weight. Clozo issues an Advanced Electronic Signature (AES) under Art. 3(11) — equivalent to a handwritten signature for almost all freelancer contracts.
Proposals & Invoices
The final invoice (INV-) — Schlussrechnung, facture de solde
The final invoice closes the project. It states the full work value, then explicitly references the deposit invoice and **deducts both the deposit amount and the deposit VAT**, so you don't pay tax twice. This deduction is mandated by §14 UStG and parallel rules across the EU.
Lifecycle
Status: Signed — legally binding, audit trail captured
The client clicked Sign. Clozo collects an eIDAS-compliant evidence stack, generates the signed Service Agreement PDF, fires confirmation emails to both parties, and queues the deposit invoice. The proposal is now a contract.