Compliance · Article 11.4
10-year retention: GoBD §147 AO and its EU equivalents
Tax-relevant documents — invoices, receipts, signed agreements, payment records — must be available to a tax-office inspector for ten years. Clozo enforces this server-side across every EU jurisdiction.
"Keep your invoices for ten years." Most EU freelancers know that rule but not the legal source. The German formulation — Grundsätze zur ordnungsmäßigen Führung und Aufbewahrung von Büchern, Aufzeichnungen und Unterlagen in elektronischer Form (GoBD), implementing §147 of the Abgabenordnung (AO) — is the strictest in the EU and the one Clozo applies uniformly. This article explains what "retention" actually means under the rule, what your obligations are, and how Clozo implements it without you having to think about it.
Why this works this way
§147 AO — the German rule. Under §147 Abs. 3 AO, the following documents must be retained for ten years (Aufbewahrungspflicht):
- Books, records, opening balances, annual financial statements - Inventories - Trading letters received and copies of trading letters sent - Booking vouchers and invoices - Customs documents - Other documents relevant for taxation
The retention period starts at the end of the calendar year in which the last entry was made or the document was issued. So a 2026-04-15 invoice's retention runs to 2036-12-31, not 2036-04-15.
The GoBD ("Grundsätze zur ordnungsmäßigen Führung und Aufbewahrung von Büchern, Aufzeichnungen und Unterlagen in elektronischer Form sowie zum Datenzugriff", in force 2020-01-01, last revised 2022-09-28 by BMF) operationalises §147 for electronic records. Five core principles:
1. Nachvollziehbarkeit + Nachprüfbarkeit (traceability + verifiability) — every entry must be reconstructable from source data. 2. Wahrheit + Klarheit + Fortlaufende Aufzeichnung (truth + clarity + continuous recording) — documents must reflect reality, be legible, and not have gaps. 3. Vollständigkeit (completeness) — no document may be omitted from the record. 4. Richtigkeit (correctness) — entries are correct as recorded. 5. Unveränderbarkeit (immutability) — once recorded, an entry cannot be silently modified. Corrections must be made via clearly-marked corrective entries (Stornobuchungen).
The immutability requirement is what drives Clozo's "no edit after send" rule: once a proposal is sent and an invoice issued, the document can't be silently rewritten — only corrected via a Storno (STR-) or amendment chain. See article 5.10 (editing after sending) and Section 7 (amendments).
EU country equivalents. GoBD is German law, but Clozo uses 10 years uniformly because nearly every EU member state has a parallel rule and 10 years is the longest typical window:
| Country | Statute | Retention |
|---|---|---|
| Germany | §147 Abs. 3 AO | 10 years |
| Netherlands | Algemene wet inzake rijksbelastingen Art. 52 Lid 4 (general books); Wet OB 1968 Art. 35a (VAT-specific invoices) | 7 years general, 7 years VAT, 10 years for immovable-property records |
| France | LPF Art. L102 B | 6 years for tax authority access; commercial code Art. L123-22 separately requires 10 years for accounting books |
| Spain | LGT 58/2003 Art. 70 | 4 years for tax assessment + 6 years under Código de Comercio Art. 30 |
| Italy | DPR 600/1973 Art. 22 + DPR 633/1972 (VAT) | 10 years (civil code) + 5–10 years (tax depending on activity) |
| Austria | §132 BAO | 7 years (general) — extended to 10 years for specific cases |
| Poland | Ordynacja podatkowa Art. 86 §1 + Ustawa o VAT Art. 112 | 5 years (tax) + longer for specific activities |
| EU (VAT-specific) | Directive 2006/112/EC Art. 244 | Member states set the period; minimum effective ~6 years |
Clozo applies 10 years because: (a) it's the German requirement and most German freelancers use the platform; (b) it's harmless to be longer than the local minimum; (c) it preserves the eIDAS audit trail for the same window. If your national rule is shorter (e.g. Spain 6 years), Clozo's longer retention does not violate it — you simply have the documents available longer than required.
What "retained" means under GoBD. Three operational requirements:
1. Legibility — the document must remain readable in its original visual form. PDF/A and PDF (with embedded fonts) both satisfy this; proprietary formats that lock the file to one app do not. Clozo emits PDF with embedded fonts.
2. Machine searchability — the tax inspector ("GoBD-Datenzugriff" under §147 Abs. 6 AO) can request the documents in machine-readable form for their audit tools. Clozo can export the full set per user as JSON + PDF bundle on request.
3. Immutability — the file you store must be identical to the file you originally created. Clozo uses Cloudflare R2's legal_hold flag on every signed agreement, every invoice, every receipt; even Clozo's own admins cannot delete a flagged object within the retention window.
Interaction with GDPR Art. 17 (right to erasure). Art. 17(3)(b) GDPR explicitly carves out erasure obligations where processing is necessary "for compliance with a legal obligation [...] which requires processing by Union or Member State law to which the controller is subject". Tax-retention obligations under §147 AO and equivalents are exactly that. So if you request erasure of your account, Clozo: - Erases your personal account data (name, email, password hash, contact info) — data covered by 6(1)(b) and (a). - Retains invoices, receipts, signed agreements, audit logs — data covered by 6(1)(c) tax obligation — until the retention window expires. After the window, erasure proceeds. - Maintains the audit log of the erasure request itself under Art. 5(2) accountability.
This is documented in our Privacy Policy s4 and the GDPR self-service flow surfaces the carve-out clearly before you confirm.
Troubleshooting
Keep reading
Compliance
GDPR: what Clozo stores about you, why, and for how long
Clozo runs 13 distinct processing activities under GDPR Art. 30. Each one has a documented purpose, a lawful basis under Art. 6(1), a recipient list, and a retention window. This article is the user-facing summary of our Records of Processing Activities.
Compliance
eIDAS: what makes a Clozo signature legally binding in the EU
EU Regulation 910/2014 (eIDAS) defines three signature levels and gives each a clear legal weight. Clozo issues an Advanced Electronic Signature (AES) under Art. 3(11) — equivalent to a handwritten signature for almost all freelancer contracts.
Proposals & Invoices
The three documents: Proposal, Service Agreement, and the signed PDF
A signed Clozo proposal produces three legal artefacts: the Proposal PDF (the offer), the Service Agreement (the binding contract), and a stored audit trail. Each plays a different legal role under EU contract law and eIDAS Reg. 910/2014.
Compliance
Data-subject requests: how clients exercise GDPR rights and what you must do
Articles 15–22 GDPR give your clients the right to access, correct, port, or erase the personal data you hold about them. As a controller of *your* clients' data, you have one month to respond. Clozo's tooling helps you answer each request efficiently.