Most freelancers eventually hear some version of: “I never approved that direction.” Sometimes the client genuinely forgot. Sometimes a new stakeholder has joined mid-project and is pushing back on a decision made before they arrived, without realizing it was already settled. Either way, the freelancer is left trying to prove something happened using an email thread, a Slack scroll, or a fuzzy memory of a call from three weeks ago — none of which hold up especially well under real disagreement.
A decision log solves this specific problem, but only if it's built correctly, which most freelancers' informal systems aren't.
What actually makes a log “immutable”
The word is doing real work here, not just sounding official. A status field in a spreadsheet that reads “Approved” is not a decision log — it's a note that anyone with edit access can change, at any time, with no trace left behind. A genuine decision log needs three properties together:
- 1Append-only. Entries can be added, but never edited or deleted — not by the client, and not by the freelancer either. That second half matters more than people initially assume: a log that only the client can't edit still isn't neutral if the freelancer can quietly adjust it later.
- 2Timestamped and attributed. Every entry records who took the action and precisely when — not just “approved,” but “approved by [client email] at [specific time].”
- 3Tied to a specific, unambiguous action. Not “the client seemed fine with it on the call,” but “client clicked Approve on Milestone 2, version 3, at 2:14pm on March 3rd.”
Missing any one of the three, what exists isn't a record — it's a claim, which is exactly the situation a decision log is supposed to prevent needing in the first place. Records-management professionals dealing with this problem at a larger scale — legal discovery, healthcare records, financial audits — generally describe reliable documentation in similar terms: authentic, accurate, complete, and reliably preserved. It's the same four-part standard, whether the record is a hospital's patient chart or a freelancer's approval log; only the stakes differ.
Why an automated entry is worth more than a note you typed yourself
Here's a distinction most freelance advice on this topic never gets into, and it's worth understanding even at a general, non-legal level: there's a real difference in how a human-written statement and a computer-generated record tend to be treated as evidence.
A statement someone writes — even a contemporaneous one, even one that's completely honest — is a human assertion offered to prove something happened, which is the category evidence law generally calls hearsay, and hearsay comes with restrictions. A record a system generates automatically, as a normal function of software doing what it reliably does every time — logging a timestamp the moment a button is clicked, for instance — isn't a person testifying to anything. Courts evaluating this kind of record have generally focused on whether the system itself is reliable and functioning normally, rather than treating the record as testimony that needs the same scrutiny a human statement would. In the US, business records generated and kept in the ordinary course of business also have a specific, named exception to the general hearsay rule — Federal Rule of Evidence 803(6) — built for exactly this situation.
None of this is legal advice, and admissibility ultimately turns on the specific facts and jurisdiction. But it points at something practically useful regardless of any actual dispute reaching a courtroom: a log entry generated automatically the instant a client clicks “Approve” is a fundamentally different, and generally stronger, kind of record than a note the freelancer typed afterward saying “client approved this,” even when both describe the exact same true fact.
What's actually worth logging
Not everything that happens on a project — just the moments where “what was agreed” could later become a genuine dispute:
- Every approval, along with which specific version of the deliverable was approved
- Every revision request, with the client's stated reason attached
- Any time a milestone's due date shifts, and the reason for the shift
- Any formal change to scope — a new deliverable, an extended deadline, an adjusted price
The goal is capturing decision points, not creating a comprehensive transcript of the whole project.
A privacy consideration worth understanding, not just a legal one
There's a second regulatory dimension worth knowing, separate from the evidence-law discussion above, and it's easy to miss because it cuts in a slightly different direction: a genuinely useful decision log typically records more than just “who approved what” — it often captures the actor's IP address and browser/device information (user agent) alongside the timestamp, both of which strengthen the record's evidentiary value. For any client based in the EU or UK, this matters, because IP addresses are generally treated as personal data under GDPR, regardless of whether the address is static or dynamic — meaning a decision log entry capturing a UK client's IP address brings that entry within GDPR's scope, the same as any other personal data your business handles.
This doesn't mean logging IP addresses for audit-trail purposes is prohibited — it generally isn't. “Legitimate interest” (documenting approvals to protect against disputes) is the lawful basis most commonly relied on for exactly this kind of security- and accountability-oriented logging. But relying on it properly involves more than just picking it as a label: it requires a genuine balancing test weighing the freelancer's interest in the record against the client's privacy rights, adherence to data minimization (collecting only what's actually needed for the stated purpose, not logging everything simply because it's technically possible), and a defined, reasonable retention period rather than keeping the data indefinitely by default. Individuals whose IP addresses are logged also retain rights under GDPR — including, in principle, a right to access what's been recorded about them — which a freelancer relying on a decision log for dispute protection should be prepared to honor, balanced against their own legitimate interest in retaining records relevant to an active or reasonably anticipated dispute.
None of this is a compliance guarantee, and the right approach depends on specifics (where the freelancer is based, where clients are based, what's actually being logged and why) that are worth a real conversation with a privacy professional rather than a blog post's general summary. It's raised here mainly so the tradeoff is visible: the same IP-and-device metadata that makes a decision log entry more evidentially convincing also brings a real, separate compliance dimension along with it, and a freelancer relying on this kind of logging for international client work is worth knowing that going in, not discovering it after a client asks what's actually being recorded about them.
Building this manually vs. using a system
A manual approximation is possible: a shared document where timestamped notes get pasted in after every client interaction, or a habit of confirming decisions over email (“per our call, confirming you've approved direction X as of [date]”). It works, to a point — but it depends entirely on remembering to do it consistently, every single time, without exception. And even done perfectly, it's still the human-authored kind of record described above, not the automatically-generated kind — a client can dispute an email's authenticity, or claim they never actually sent the confirming reply that supposedly closes the loop.
A structured decision log removes the discipline requirement from the equation entirely. SwiftSignoff writes an entry automatically the moment a client takes an action inside the portal — approving, requesting a revision, even just viewing a deliverable — capturing their email, a timestamp, and where available, their IP address and device. Critically, none of these entries can be edited or deleted afterward by anyone, including the freelancer's own account — the immutability is enforced at the database level rather than relying on good intentions or careful habits. Once a milestone is approved, a one-page “Certificate of Approval” PDF can be generated directly from the log, ready to attach to an invoice or settle a dispute in minutes rather than days of digging.
For the invoice-specific angle on this — turning a logged approval into the receipt that backs up your invoicing — see the companion guide:
Related guideYour Decision Log Is the Receipt Your Invoicing Needed
What a real dispute looks like with and without one
- Without a log: Client says “we never signed off on this direction.” Freelancer scrolls back through six weeks of email, finds a reply that says “looks good!” to a message with three attachments, none individually named, and has to reconstruct — and then argue for — which attachment that reply was actually responding to.
- With a log: Freelancer opens the decision log, filters to the milestone in question, and points to a single entry: “Approved by [client email], [specific version], [exact timestamp].” The conversation moves directly to what happens next, rather than spending time re-litigating what already happened.
One broken link is enough to weaken the whole thing
It's worth being honest about a real limitation: a decision log is only as strong as its least reliable entry. If nine approvals are cleanly timestamped and automated, but a tenth, critical one was handled as a verbal “sounds good” on a phone call with nothing written down afterward, that tenth decision is exactly as disputable as if no log existed at all for that project. Consistency matters more than most freelancers initially assume — the log needs to be the default path for every decision that matters, not a system that's used when convenient and skipped when a conversation happens to occur informally.
FAQ
Does a decision log hold up as actual legal proof?
It significantly strengthens a freelancer's position in a dispute by providing clear, contemporaneous documentation, though it isn't a substitute for a proper contract — the two work together, with the contract defining the terms and the log demonstrating what actually happened against them. This isn't legal advice; consult an attorney for your specific situation.
Should the client be able to see the decision log, or is it just for the freelancer?
Client visibility is actually part of what makes it effective — a log only the freelancer can see is easier to dispute than one the client has been looking at throughout the project and never objected to in real time.
What's the difference between a decision log and just saving email confirmations?
Primarily reliability and completeness. Email confirmations depend on someone remembering to send them every time, and can be about anything (“looks good!” replying to what, exactly), while a structured log ties every entry to a specific, unambiguous action on a specific version.
Is a decision log overkill for small, short projects?
For a single-week, low-dollar project, probably. It becomes clearly worth it as project length, revision count, and dollar value increase — which is exactly when disputes get more expensive to leave unresolved.
Why would an automatically generated log entry be treated differently from a note I typed myself?
Courts generally distinguish a human statement offered to prove something happened (which can run into hearsay rules) from a record a computer system generates automatically as part of its normal, reliable operation — the latter is often evaluated based on the reliability of the system itself rather than treated as testimony. This is general information, not legal advice, and the details vary by jurisdiction.
If a decision log stores a client's IP address, does that raise GDPR concerns?
Potentially, yes — IP addresses are generally treated as personal data under GDPR, so logging one for an EU/UK-based client brings that entry into scope. Legitimate interest (documenting approvals for dispute protection) is the lawful basis most commonly relied on for this kind of logging, but it requires a genuine balancing test, data minimization, and a defined retention period rather than indefinite storage. This is general information, not a compliance guarantee — consult a privacy professional for your specific situation.
“I never approved that” only works against a freelancer who can't prove otherwise.
PricingSee what the decision log includes on the pricing page