Troubleshooting & Reference · Article 7.1
Glossary
Every domain term in the Clozo wiki, with a plain-language definition, the native-language reference where relevant, and links to the articles that use the term.
Most terms in this glossary appear as <Glossary> tooltips throughout the wiki — hover or tap and you get a 1-2 sentence definition inline. This page is the canonical long-form: every term defined, every term searchable with Cmd+F, every term anchor-linked so you can share /help/glossary#term-eidas directly with someone who needs it.
Terms are listed strictly alphabetically. Acronyms appear at their letter (eIDAS at E, GDPR at G). Where multiple national-language terms map to one concept, the entry lives at the most-recognised English form with cross-references.
Lifecycle & Status10Documents9Identifiers & Numbering10Compliance & Legal16VAT & Tax10Payments & Banking10E-invoicing Formats6Interface4
Lifecycle & Status(10)
Proposal lifecycle states, status enums, and timeline events.
- Δ (delta) plus / minus / zero / refund
- The four amendment scenarios. **Δ+** (delta-plus): scope up, price up — additional work added to the signed agreement. **Δ-** (delta-minus): scope down, price down — work removed from the signed agreement. **Δ=0**: administrative-only correction with no gross-amount change (e.g. fix a typo in the project description). **Δ_REFUND**: refund-only with no scope change. Each branch produces a different document chain.
- Draft
- The proposal status before send. Fully editable, no PDF until preview, no email sent, no audit obligation. Only state where you can freely change anything. Auto-saves every 10 seconds. Hard-deletes on `Delete` (no soft-delete because there's no audit obligation pre-send). After `Send`, transitions to **Sent** and most fields lock.
- Effective total
- The cumulative gross amount of a proposal *plus* all signed amendments. After Δ+ amendments, effective total > original total. After Δ- amendments, effective total < original total. After Δ=0 amendments, effective total unchanged. The effective total is the amount the final invoice + receipt should reflect; Clozo computes it from the amendment chain.
- Idempotency
- The property that an operation produces the same result no matter how many times it's executed. Clozo applies idempotency keys to email sends (preventing duplicate notifications [D-070]), Stripe charges (preventing double-billing), and refund operations. The pattern is implemented in `tasks.py:_claim_email_field()`.
- Multi-amendment chain
- A sequence of two or more signed amendments on the same proposal. Each amendment uses the *current effective baseline* (post-prior-amendments) as its starting point, not the original proposal. Only one open (non-terminal) amendment is allowed at a time per proposal — enforced by `unique_together = ('proposal', 'status')` in `apps/proposals/models.py:Amendment`. Effective total tracks across the chain.
- Refund status enum
- The state machine for a Clozo refund. Five values: **pending** (refund initiated, not yet processed), **requested** (sent to Stripe or marked manual, awaiting confirmation), **succeeded** (Stripe confirmed refund settled or manual refund recorded with proof), **failed** (Stripe returned a failure; recovery via retry or manual mark), **manual** (refund executed out-of-band by the freelancer with note + proof). Drives the refund-stages timeline in the UI.
- Retry refund
- The action to re-attempt a failed Stripe refund. Surfaces in the Refund banner when status is `failed`. Re-fires the same refund creation against Stripe; backend uses the same Stripe refund_id idempotency key so a retry doesn't create a duplicate. Recovery path when the first attempt failed for transient reasons (rate limiting, momentary Stripe API error).
- Sync status
- The Refresh-status mechanism — pull-based payment-state sync from Stripe via API call. Used when a webhook is delayed or missed: click `Refresh status` on the invoice or refund banner and Clozo queries Stripe directly for the current PaymentIntent or Refund state, then updates the local record. See also: [Stripe webhook](#term-stripe-webhook).
- Timeline event
- An audit-log entry on a proposal recording a state-changing event. 21+ event types: `CREATED`, `SENT`, `VIEWED`, `DEPOSIT_PAID`, `FINAL_INVOICE_ISSUED`, `FINAL_PAYMENT_RECEIVED`, `COMPLETED`, `DECLINED`, `EXPIRED`, `ARCHIVED`, `AMENDMENT_CREATED`, `AMENDMENT_SENT`, `AMENDMENT_VIEWED`, `AMENDMENT_SIGNED`, `AMENDMENT_DECLINED`, `AMENDMENT_EXPIRED`, `AMENDMENT_CANCELLED`, `REFUND_INITIATED`, `REFUND_COMPLETED`, `AMENDMENT_SIGNATURE_AUDIT`, plus reminder/email events. Stored in `apps/proposals/models.py:ProposalTimelineEvent`.
- Withdraw
- The action to invalidate a sent-but-not-yet-signed proposal. Click `Actions → Withdraw` on the proposal detail page. Effect: original public link 404s ("This proposal has been withdrawn by the sender"), original PDF stays under `legal_hold`, original proposal status becomes `Withdrawn` (terminal). Use case: sent to wrong client, scope error pre-signing, pricing change. Not available after signing — use Amendment (Section 7) instead.
Documents(9)
Document types and corrections (proposal, invoice, credit note, storno).
- Addendum
- The signed amendment PDF, generated when an amendment is signed. References the original Service Agreement, captures the same eIDAS evidence stack, and is retained for 10 years alongside the original. See also: [Amendment](#term-amendment).
- Amendment
- A formal change-order to a signed proposal. The only legitimate way to alter scope, price, or timeline after the client has signed (because the original Service Agreement is sealed by the eIDAS hash and cannot be silently rewritten). Amendments produce their own document chain — addendum + storno + new final invoice or credit note depending on the delta. Four delta branches: Δ+ (scope up), Δ- (scope down), Δ=0 (admin-only fix), Δ_REFUND (refund-only).
- Anzahlungsrechnung
- German term for **deposit invoice** (literally "advance payment invoice"). Specifically referenced in §14 UStG; documents the chargeable event when a customer pays in advance of full performance, triggering VAT liability under EU VAT Directive Art. 65. See also: [Deposit invoice](#term-dep), [Schlussrechnung](#term-schlussrechnung).
- Berichtigung
- German term for **invoice correction** — a corrective entry that adjusts a previously issued invoice. Under §14c UStG, a Berichtigung is the way to fix VAT errors on a sent invoice; it doesn't reverse the original (a Storno does that), it amends it. In Clozo, Berichtigungen surface as Δ=0 amendments (administrative-only changes that don't alter the gross). See also: [Storno](#term-storno).
- Final invoice (Schlussrechnung)
- The closing invoice issued when work is complete and final payment is due. Document number prefix `INV-`. Under §14 UStG (Germany) + parallel rules (NL Wet OB Art. 35a, FR CGI Art. 289, etc.), the final invoice **must reference the deposit invoice and deduct the deposit amount + deposit VAT** so the customer doesn't pay tax twice. In German, **Schlussrechnung**; in French, **facture de solde**; in Dutch, **eindfactuur**.
- Gutschrift
- German term that has two distinct legal meanings: (1) **credit note** (a corrective document reducing or refunding an invoice); (2) **self-billing invoice** (a document the customer issues to the supplier under §14(2) UStG). Context determines which. In Clozo, Gutschrift refers to the credit-note meaning (CRN- documents). See also: [Storno](#term-storno), [Berichtigung](#term-berichtigung).
- Schlussrechnung
- German term for **final invoice** (literally "closing invoice"). Under §14 UStG, the Schlussrechnung must reference the prior Anzahlungsrechnung (deposit invoice) and deduct the deposit amount + deposit VAT. See also: [Final invoice](#term-final-invoice), [Anzahlungsrechnung](#term-anzahlungsrechnung).
- Service Agreement
- Clozo's binding contract artefact, generated when the client signs. Document number prefix `AGR-`. Quotes the proposal verbatim, attaches the signature block (typed name + timestamp), and embeds the SHA-256 hash of the original proposal PDF as a tamper seal. Eligible as Advanced Electronic Signature evidence under eIDAS Art. 3(11). Retained 10 years with `legal_hold`.
- Storno (STR)
- A reversal document — fully cancels a previously issued invoice. Document number prefix `STR-`. Under German GoBD, a Storno is the only legitimate way to fully unwind a sent invoice; you cannot silently delete an invoice. The Storno references the original by number and effectively zeros it out for tax purposes. Distinct from a Berichtigung (which corrects without reversing) and a Gutschrift (credit note for partial refund).
Identifiers & Numbering(10)
Document number prefixes (PRO/INV/DEP/REC/CRN) and banking IDs (IBAN/BIC).
- AGR (Agreement number)
- Document number prefix for the Service Agreement PDF — the binding contract artefact generated when the client signs. Format: `AGR-{year}-{NNNN}`, sequentially numbered against your year counter. Distinct from the Proposal PDF (`PRO-`) which is the offer artefact. See also: [Service Agreement](#term-service-agreement).
- BIC (Business Identifier Code)
- The 8- or 11-character SWIFT code that identifies a specific bank — e.g. `COBADEFFXXX` for Commerzbank Frankfurt. Used alongside IBAN for SEPA Credit Transfers. Required by some receiving banks for cross-border SEPA; harmless to include even when not strictly required. Auto-derived from IBAN for most EU countries.
- CON (Contract number)
- Reserved document number prefix for explicit-contract documents (planned for v2). Currently unused — the Service Agreement (AGR-) is Clozo's binding contract artefact for v1.
- CRN (Credit note number)
- Document number prefix for credit notes — the document issued when a refund occurs or when a previously issued invoice is partially or fully reversed. Format: `CRN-{year}-{NNNN}`. References the original invoice it corrects.
- DEP (Deposit invoice number)
- Document number prefix for the deposit invoice — the legal artefact recording the upfront-payment chargeable event under EU VAT Directive Art. 65 and §14 UStG. Format: `DEP-{year}-{NNNN}`. In German, **Anzahlungsrechnung**; in French, **facture d'acompte**.
- DCR (Deposit correction)
- Document number prefix for deposit-correction documents — issued when an amendment changes the deposit amount on an already-paid deposit. Format: `DCR-{year}-{NNNN}`. Either tops up the deposit (Δ+ branch) or refunds part of it (Δ_REFUND branch). References the original DEP- it corrects.
- IBAN
- International Bank Account Number — the standardised format identifying bank accounts in 80+ countries. EU IBANs vary in length (DE 22, FR 27, NL 18, ES 24, IT 27, PL 28). Required for SEPA Credit Transfer. Clozo encrypts stored IBANs at rest with Fernet symmetric encryption (django-encrypted-model-fields); the unmasked value is only ever rendered into your invoice PDFs.
- INV (Invoice number prefix)
- Document number prefix for the final invoice (Schlussrechnung). Format: `INV-{year}-{NNNN}`. Sequentially numbered against your year counter, atomic per `apps/proposals/models.py:DocumentCounter`. Distinct from `DEP-` (deposit invoice) and `STR-` (storno).
- PRO (Proposal number prefix)
- Document number prefix for the proposal PDF — the offer artefact. Format: `PRO-{year}-{NNNN}`. Sequentially numbered against your year counter, reserved at `Send` time. Distinct from `AGR-` (Service Agreement) which is the contract artefact generated when the client signs.
- REC (Receipt number)
- Document number prefix for the receipt PDF — generated automatically when a payment is recorded (deposit or final). Format: `REC-{year}-{NNNN}`. References the invoice it confirms payment on. Emailed to the client + freelancer; permanent record of the cleared payment.
Used in:glossary
Compliance & Legal(16)
GDPR, eIDAS, GoBD, EU directives, and B2B/B2C distinction.
- Article 226 (EU VAT Directive)
- Article 226 of Council Directive 2006/112/EC lists the 15 mandatory fields every EU invoice must contain — date of issue, sequential number, supplier name and address, customer name and address, VAT identification numbers, taxable amount, VAT rate, VAT amount, and the legal note where exemptions or reverse charge apply. Clozo fills all 15 automatically.
- B2B
- Business-to-business — your client is acting in a trade, business, or profession. Under EU VAT, B2B services across borders use reverse charge (Art. 196). Under EU consumer law, B2B contracts have no cooling-off period. The B2B/B2C flag on the client record drives both behaviours.
- B2C
- Business-to-consumer — your client is a natural person acting outside their trade, business, or profession (CRD Art. 2(1)). Triggers the 14-day cooling-off period under EU Consumer Rights Directive 2011/83/EU Art. 9, plus consumer-side OSS rules for cross-border digital services. See also: [Cooling-off](#term-cooling-off).
- CSRD
- Corporate Sustainability Reporting Directive (Directive (EU) 2022/2464). Mandates ESG disclosures for large EU companies and listed SMEs from financial year 2024 onwards. Currently outside Clozo's freelancer scope but referenced because some freelancer clients (large corporates) ask suppliers for sustainability data — typically not required for invoices below corporate-procurement thresholds.
- DPA (Data Processing Agreement)
- The contract under GDPR Art. 28 between a data controller and a data processor that defines the scope, duration, purpose, types of personal data, and security obligations of the processing. Clozo signs DPAs with every sub-processor (Stripe, Resend, Cloudflare, etc.) and exposes them in our Privacy Policy.
- DSR (Data Subject Request)
- A request from a data subject to exercise their GDPR rights under Art. 15-22 (access, rectification, erasure, restriction, portability, objection). Clozo provides self-service tooling at `/settings/privacy` for your own data and `/clients/{id}` → "Privacy Actions" for client data you control as the controller. Response deadline: one month under Art. 12(3).
- eIDAS (Reg. 910/2014)
- EU Regulation (EU) No 910/2014 on electronic identification and trust services for electronic transactions in the internal market. Defines three signature levels: Simple (SES, Art. 3(10)), Advanced (AES, Art. 3(11) + Art. 26), and Qualified (QES, Art. 3(12) + Art. 28). Under Art. 25(2), AES "shall not be denied legal effect" — what Clozo issues. Amended by Reg. (EU) 2024/1183 (eIDAS 2.0) introducing the EU Digital Identity Wallet from 2026.
- EU VAT Directive 2006/112/EC
- The master EU VAT statute. 414 articles covering scope, taxable persons, taxable transactions, place of supply, chargeable event, taxable amount, rates, exemptions, deductions, special schemes, and invoicing rules. Each member state implements it via national VAT law (UStG in DE, CGI in FR, OB 1968 in NL, Ley 37/1992 in ES, DPR 633/72 in IT, etc.). Amended periodically — most recently by ViDA Directive (EU) 2025/516 with phased changes from 2030.
- GDPR
- General Data Protection Regulation — Regulation (EU) 2016/679, applicable since 25 May 2018. The EU's master data-protection statute. 99 articles covering principles (Art. 5), lawful bases (Art. 6), special categories (Art. 9), data-subject rights (Art. 12-22), controller obligations (Art. 24-43), supervisory authorities (Art. 51-59), remedies (Art. 77-84), and international transfers (Art. 44-50). National supervisory authorities: AEPD (ES), CNIL (FR), BfDI (DE federal), AP (NL), Garante (IT).
- GoBD §147 AO
- *Grundsätze zur ordnungsmäßigen Führung und Aufbewahrung von Büchern, Aufzeichnungen und Unterlagen in elektronischer Form sowie zum Datenzugriff* — Germany's electronic-records principles, last revised 2022-09-28 by the BMF. Operationalises §147 Abgabenordnung (AO), the 10-year retention rule for tax-relevant documents. Five core principles: traceability, completeness, correctness, immutability, machine-searchability. Clozo applies 10-year retention uniformly across all EU jurisdictions because it's the strictest typical window.
- Late Payment Directive 2011/7/EU
- Directive (EU) 2011/7/EU on combating late payment in commercial transactions. For B2B: default 30-day payment term, automatic interest at the European Central Bank reference rate + 8 percentage points from the day after the due date, plus a flat €40 recovery fee (Art. 6) without proof. Transposed nationally: §288 BGB (DE), Art. L. 441-10 Code de commerce (FR), Art. 6:119a BW (NL), etc. Clozo's third overdue reminder cites the directive.
- Legal hold
- A flag on Cloudflare R2 objects that prevents deletion within the retention window. Clozo applies `legal_hold=true` to every signed agreement, every invoice, every receipt — even Clozo administrators cannot delete a flagged object until the hold expires (10 years from issue). Implements the immutability requirement of GoBD + eIDAS retention.
- QES (Qualified Electronic Signature)
- The top tier of electronic signature under eIDAS Art. 3(12). Requires (1) a qualified certificate from an EU-recognised Trust Service Provider, (2) a qualified signature creation device (typically a hardware token or smart card), and (3) all the conditions of Advanced Electronic Signature. Under Art. 25(2), QES has the same legal effect as a handwritten signature in any EU member state, with cross-border recognition under Art. 25(3). **Clozo does not issue QES** — Clozo issues AES, which is sufficient for almost all freelancer commercial work.
- RoPA
- Records of Processing Activities — the register every GDPR controller must maintain under Art. 30. Documents purpose, lawful basis, data categories, recipients, retention, security measures, and international transfers for every processing activity. Clozo's RoPA lives at `docs/compliance/RoPA.md` and mirrors the `compliance_processingactivity` PostgreSQL table. 13 active processing activities as of the document version date.
- R2 storage
- Cloudflare R2 — the S3-compatible object storage service Clozo uses for PDFs (proposals, invoices, receipts, signed agreements), e-invoice XML, and user logos. EU region. Signed agreements + invoices carry the `legal_hold` flag preventing deletion within the 10-year retention window. R2 file ledger (`apps/compliance/models.py:FileLedger`) records every object lifecycle event.
- TIA (Transfer Impact Assessment)
- The controller-side documented assessment required after Schrems II (CJEU C-311/18) for personal-data transfers to non-EU countries. Six steps per EDPB Recommendations 01/2020: know the transfers, identify the transfer tool, assess effectiveness, adopt supplementary measures, document procedural steps, re-evaluate. Clozo's TIA covers 5 US sub-processors (Stripe, Resend, Google, PostHog, Cloudflare) at `docs/compliance/TIA_us_subprocessors.md`.
Used in:glossary
Used in:sub processors and tia
VAT & Tax(10)
VAT rules, small-business regimes, OSS, reverse charge.
- Currency conversion
- The FX-rate snapshot Clozo records when an invoice is issued in a non-EUR currency. Per EU VAT Directive Art. 91, the rate must come from a recognised source — Clozo uses the European Central Bank reference rate published on the issue date. The rate is locked at issue time and prints on the invoice as a footnote.
- Intra-community supply
- A supply of goods or services from one EU member state to another. For B2B services with a valid recipient VAT number, intra-community supply is taxed in the customer's country via reverse charge (Art. 196 of the VAT Directive). For goods, the supply is exempt at origin and the customer accounts for acquisition VAT in their country. Clozo's `reverse_charge` VAT rule applies to intra-community B2B services.
- Kleinunternehmer §19 UStG (DE)
- Germany's small-business VAT regime under §19 Umsatzsteuergesetz. Available to businesses with prior-year turnover ≤ €25,000 and current-year turnover ≤ €100,000 (thresholds raised 2025-01-01 by JStG 2024). Effect: no VAT charged on invoices, no input-VAT deduction. Statutory invoice note: "Gemäß § 19 UStG wird keine Umsatzsteuer berechnet."
- Kleinunternehmer §6 Abs. 1 Z 27 UStG (AT)
- Austria's small-business VAT regime. Threshold: €55,000 turnover (raised from €35,000 by Abgabenänderungsgesetz 2024, effective 2025-01-01). Statutory invoice note: "Kleinunternehmer gemäß § 6 Abs. 1 Z 27 UStG — Umsatzsteuerbefreiung." Distinct from the German Kleinunternehmer regime — different threshold, different statute.
- KOR (Kleineondernemersregeling, NL)
- The Netherlands' small-business VAT regime under Wet OB 1968 Art. 25. Threshold: €20,000 turnover. Effect: no VAT charged, no input-VAT deduction. Statutory invoice note: "Vrijgesteld op grond van de Kleineondernemersregeling (KOR)." Opt-in for at least 3 years once chosen.
- Margin scheme
- A special EU VAT scheme under Articles 311-343 of the VAT Directive — for second-hand goods, art, antiques, collectors' items, and certain travel-agent services. VAT is calculated on the *margin* (your selling price minus your purchase price), not the full price. Invoice must include the legal note "Margin scheme — second-hand goods" or equivalent. Currently outside Clozo's automated handling — set `vat_rate_override=0` and add the note manually if needed.
- OSS (One-Stop-Shop)
- EU simplification scheme for cross-border B2C digital services and B2C distance sales of goods (Council Implementing Regulation (EU) 2019/2026, in force 2021-07-01). Register once with your home tax authority's OSS portal; charge the consumer's country VAT rate; file one quarterly OSS return that distributes VAT across all destination member states. Threshold below which OSS is not required: €10,000/year of total cross-border B2C sales.
- Reverse charge
- The EU VAT mechanism under Art. 196 of the VAT Directive. For B2B services across EU borders with a valid recipient VAT number, the customer accounts for VAT in their country — the supplier issues at 0% with the legal note "Reverse charge — VAT to be accounted for by the recipient" in the recipient's language. National transpositions: §13b UStG (DE), Art. 283-2 CGI (FR), Art. 12 lid 2 OB 1968 (NL), Ley 37/1992 Art. 84 (ES), Art. 17 DPR 633/72 (IT).
- VAT
- Value-Added Tax — the EU's harmonised consumption tax. National rates vary: DE 19%, FR 20%, NL 21%, ES 21%, IT 22%, AT 20%, PL 23% (standard rates as of the document version date). Reduced rates and zero rates apply to specific categories. Master statute: EU VAT Directive 2006/112/EC. Each member state implements with national VAT law.
- VIES
- VAT Information Exchange System — the European Commission's SOAP service for validating EU VAT numbers. Operates as a relay across member-state tax-authority databases (Spain queries Spanish AEAT, Germany queries the Bundeszentralamt, etc.). Required for the 0% reverse-charge rate on intra-community B2B services. Clozo validates VAT numbers at proposal-issue time; result cached 24 hours. Occasional outages — Clozo distinguishes "VIES says invalid" from "VIES is unreachable" with separate UI states.
Payments & Banking(10)
Stripe, SEPA, webhooks, idempotency, and reminders.
- Auto-reminder
- Scheduled reminder emails sent automatically when an invoice goes overdue. Default cadence: 3, 7, and 14 days after the due date, with escalating tone — friendly nudge, firmer reminder, formal notice citing the EU Late Payment Directive 2011/7/EU. Configurable per user; reminders pause automatically when the invoice is paid.
- Connect (Stripe Connect)
- Stripe's platform-multi-merchant architecture. Clozo uses Connect with **Direct Charges** — money flows to the freelancer's connected Stripe account, not Clozo's. Clozo takes no platform fee on payments; you pay only Stripe's standard processing fees. See also: [Direct Charge](#term-direct-charge), [PaymentIntent](#term-paymentintent).
- Direct Charge
- The Stripe Connect architecture Clozo uses [D-012]. The PaymentIntent is created on the freelancer's connected account (`stripe_account=acct_...`), so money flows directly to that account and refunds/disputes belong to that account. Clozo never holds the funds. No platform fee deduction. Contrast: Destination Charges (money flows through platform first), Separate Charges and Transfers (split funds programmatically).
- EPC QR
- European Payments Council Quick Response code (EPC069-12 standard). A ~140-byte QR encoding for SEPA Credit Transfer — beneficiary, IBAN, BIC, amount, reference. Recognised by ~95% of EU bank apps; client scans, app pre-fills the SEPA transfer, client confirms with PIN/biometric. No retyping, no transposition errors.
- HMAC (webhook signature)
- Hash-based Message Authentication Code — a cryptographic signature using a shared secret. Stripe signs every webhook with HMAC-SHA-256 and Clozo verifies the signature in `apps/webhooks/views.py` before processing. Prevents an attacker from forging webhook calls. The secret rotates periodically; secrets live in Railway environment variables.
- PaymentIntent
- A Stripe object representing the lifecycle of a single payment from creation through confirmation. ID format: `pi_xxxxxxxx`. Clozo creates PaymentIntents on the freelancer's connected Stripe account (Direct Charge) with `automatic_payment_methods={'enabled': True}` to opt into Stripe's optimised 3DS routing. Webhook events: `payment_intent.created`, `payment_intent.requires_action`, `payment_intent.succeeded`, `payment_intent.payment_failed`.
- QR code (EPC)
- See [EPC QR](#term-epc-qr).
- SEPA
- Single Euro Payments Area — the EU's harmonised bank-transfer network. 36 countries (all 27 EU members + Iceland, Liechtenstein, Norway, Switzerland, UK, Andorra, Monaco, San Marino, Vatican). Standard SEPA Credit Transfer (SCT) settles in 1 business day; SEPA Instant Credit Transfer (SCT Inst) settles in <10 seconds 24/7/365. Clozo prints IBAN + BIC + EPC QR on every invoice for SEPA payment.
- Stripe webhook
- An HTTP POST from Stripe to Clozo informing of an event — payment succeeded, refund completed, dispute filed, account updated, etc. Signed with HMAC-SHA-256 using a webhook signing secret. Clozo verifies the signature in `apps/webhooks/views.py` before processing. Typical lag: ~2 seconds; can be minutes during Stripe queue backlogs. `Refresh status` button as fallback for delayed/missed webhooks.
- Webhook
- An HTTP POST sent by an external service to a Clozo endpoint to notify of an event. Clozo receives webhooks from Stripe (payment events), Resend (email delivery events), and self-emits webhooks to user-configured URLs (planned for v2). Webhook signatures are verified via HMAC-SHA-256 before processing. See also: [HMAC](#term-hmac), [Stripe webhook](#term-stripe-webhook).
E-invoicing Formats(6)
Peppol, Factur-X, FatturaPA, KSeF, FacturaE.
- E-invoicing
- Sending invoices in a structured machine-readable format over a regulated network instead of (or in addition to) a PDF over email. EU formats include Peppol BIS Billing 3.0 (UBL), Factur-X (FR hybrid PDF+XML), FatturaPA (IT), KSeF (PL), FacturaE (ES). Mandatory for EU public-sector buyers since 2019 (Directive 2014/55/EU); mandatory B2B in some countries already (IT 2019), rolling out in others (PL 2026, FR 2026, BE 2026, DE 2027).
- FacturaE
- Spain's national XML e-invoicing format. Primary use: B2G (business-to-government) — mandatory for invoices to Spanish public bodies via the FACe portal. Schema published by the Spanish Tax Agency. Clozo supports email-only with FacturaE XML attached for B2B; full FACe integration for public-body sending is in development.
- Factur-X
- France's hybrid PDF+XML e-invoicing format — a PDF/A-3 file with embedded XML structured data (UBL or CII). Identical specification to Germany's ZUGFeRD format. Routed via accredited Plateformes de Dématérialisation Partenaires (PDPs) that connect to the French Portail Public de Facturation (PPF) annuaire. Mandatory B2B receiving from 2026-09 (large companies) and 2026-09 onwards rolling to all sizes for issuing.
- FatturaPA
- Italy's mandatory national XML e-invoicing format. Routed via the Sistema di Interscambio (SdI) hub operated by the Agenzia delle Entrate. Mandatory B2B in Italy since 2019; foreign suppliers selling to Italian customers must also issue via SdI for transactions in Italian VAT scope. Clozo currently exposes this via email-only with FatturaPA XML; full SdI integration in development.
- KSeF
- *Krajowy System e-Faktur* — Poland's mandatory national e-invoicing platform, operated by the Ministry of Finance. Format: FA(2) XML. Routing identifier: NIP (Polish tax ID). Mandatory B2B rollout from 2026 (phased). Once received in KSeF, invoices have a unique KSeF number and are considered legally issued; sender's email transmission is no longer required.
- Peppol
- Pan-European Public Procurement Online — a structured e-invoicing network operated by OpenPeppol. Documents are exchanged in Peppol BIS Billing 3.0 UBL format via accredited Access Points. Mandatory for EU public-sector receiving since 2019 (Directive 2014/55/EU). Routing identifier: Peppol participant ID (e.g. `0208:0123456789` for a Belgian VAT number). Mandatory B2B in Belgium from 2026-01.
Interface(4)
User-facing concepts: client portal, PIN gate, signing viewport.
- Access code
- A 4-digit PIN that gates every Clozo public proposal page. Sent inline in the email to your client; required to view, sign, or pay. Five wrong attempts trigger a 24-hour per-IP lockout. The PIN is reissued any time you click `Resend` or `Send fresh link`.
- Client portal
- The PIN-gated public page at `app.useclozo.com/p/{slug}` where your client views, signs, pays, and (after signing) downloads documents. Persistent — they can return to it any time with their PIN. Different from the freelancer dashboard at `app.useclozo.com/dashboard`.
- PIN gate
- The 4-digit access code Clozo prints in the email and requires before the public proposal page can be viewed or signed. Five wrong attempts in 24 hours triggers a per-IP lockout. Lightweight second factor — stealing the email isn't enough; you also need the four digits printed inside it. PIN regenerates on `Resend`. See also: [Access code](#term-access-code).
- Viewport (signing)
- The browser viewport dimensions captured at signing time as part of the eIDAS technical context. Stored alongside IP, User-Agent, and country in the signature audit row. Provides additional fingerprint evidence for dispute defence (a desktop-viewport sign followed by a mobile-viewport sign would suggest different actors).
Keep reading
Compliance
GDPR: what Clozo stores about you, why, and for how long
Clozo runs 13 distinct processing activities under GDPR Art. 30. Each one has a documented purpose, a lawful basis under Art. 6(1), a recipient list, and a retention window. This article is the user-facing summary of our Records of Processing Activities.
Compliance
eIDAS: what makes a Clozo signature legally binding in the EU
EU Regulation 910/2014 (eIDAS) defines three signature levels and gives each a clear legal weight. Clozo issues an Advanced Electronic Signature (AES) under Art. 3(11) — equivalent to a handwritten signature for almost all freelancer contracts.
Compliance
EU VAT compliance: Art. 226, OSS, reverse charge, B2C distance sales
The EU VAT Directive (2006/112/EC) sets the rules every Clozo invoice meets by design — mandatory fields under Art. 226, place-of-supply under Art. 44–58, OSS for cross-border B2C, and reverse charge for B2B intra-community services.
Compliance
10-year retention: GoBD §147 AO and its EU equivalents
Tax-relevant documents — invoices, receipts, signed agreements, payment records — must be available to a tax-office inspector for ten years. Clozo enforces this server-side across every EU jurisdiction.
Proposals & Invoices
The three documents: Proposal, Service Agreement, and the signed PDF
A signed Clozo proposal produces three legal artefacts: the Proposal PDF (the offer), the Service Agreement (the binding contract), and a stored audit trail. Each plays a different legal role under EU contract law and eIDAS Reg. 910/2014.