Sales and Use Tax – Digital Certificates and Related Services
A company ("Taxpayer") is seeking an opinion as to whether Taxpayer's sales of authentication services via the provision of a digital certificate to the Taxpayer's customers for consideration are subject to the Indiana sales and use tax when provided to customers located in Indiana.
Authority: IC 6-2.5-1-14 ; IC 6-2.5-1-16.2 ; IC 6-2.5-1-16.3 ; IC 6-2.5-1-16.4 ; IC 6-2.5-1-24 ; IC 6-2.5-1-26.5 ; IC 6-2.5-1-27 ; IC 6-2.5-1-27.5 (c)(8); IC 6-2.5-1-28.5 ; IC 6-2.5-2-1 (a); IC 6-2.5-2-2 (a); IC 6-2.5-4-1 (b); IC 6-2.5-4-6 ; IC 6-2.5-4-16.4 (b); Streamlined Sales and Use Tax Agreement (Sept. 20, 2009)
Taxpayer provides the following facts regarding its request for a revenue ruling:
The Taxpayer is a provider of authentication solutions for businesses and individuals seeking to perform secure electronic commerce and communications over the internet. One such solution is the provision of a digital certificate and authentication and resolution services on a subscription basis.
Digital certificates are commonly used to facilitate the secure transmissions between end user browsers and the Taxpayer's customers' ("customers") servers. A digital certificate allows an end user to recognize that they are, indeed, accessing the customers' server. For illustration purposes, assume "InternetRetailer.com" is a customer of the Taxpayer. An end user of "InternetRetailer.com" will access the website and know that they are accessing the real "InternetRetailer.com" site and not a false site, because a check mark will appear on the real "InternetRetailer.com" site, indicating that the website is authenticated by the Taxpayer. This check mark, trademarked by the Taxpayer and recognized throughout the world, serves as the visible indication on the end user's screen that the customer's site is who it purports to be.
A digital certificate is provided through an online process, and the first step in this process is the customer's access of the Taxpayer's online portal to complete a registration form. As part of the customer's request of a certificate through registration, a private and public key pair is generated by the customer's web server. The private key is retained by the customer on its web server. The public key is part of the information sent to the Taxpayer in the registration process.
The Taxpayer performs all due diligence necessary to authenticate the identity of the applicant, the related website and business, and the information presented by the customer during the registration process, including the public key. Once the Taxpayer authenticates the identity of the applicant, a digital certificate is electronically sent to the customer. A digital certificate is a flat file containing: the customer's public key, metadata with information such as certificate expiration date, the certificate owners' name, the name of the issuer (certification authority, i.e. the Taxpayer), serial number of the certificate, and an electronic signature of the issuer[.] The flat file does not contain binary code.
The digital certificate is installed by the customer on a customer's web server. When end users connect to the customer's server through a web browser, the browser establishes the authenticity of the digital certificate (and thus the authenticity of the web site) by mathematically proving that the certificate presented by the customer's web server was digitally signed by the Taxpayer. The digital certificate also contains the aforementioned public key. It is described as a "public" key because the digital certificate (and key contained therein) is readily viewable by any browser.
The end user's web browser creates a session key that is used to encrypt the transmission between the customer's server and the end user's browser. However, the end user's browser must first use the public key to encrypt the session key and then transmit the session key to the web server. The web server will use the private key to decrypt the session key so that both the web server and browser can begin using the session key for the encrypted transmissions. After the initial handshake between the browser and web server, the session key is used for the encryption of the transmissions. The encryption strength of the transmission is directly related to the bit length of the session key. The encryption/decryption is performed by the cryptographic software built into the web browser and customer's server. This software is not provided by the Taxpayer.
In addition to authenticating the digital certificate and website, the end user's browser communicates with the Taxpayer's servers to verify that the digital certificate is valid and not revoked (resolution service). If the certificate is valid, the end user's browser will show the end user a notification that the certificate is valid and has not been revoked. The charges for the authentication service, digital certificate, and resolution service are part of a lump sum subscription charge and must be renewed periodically.
Based on the foregoing facts, Taxpayer requests guidance as to whether Taxpayer's sales of authentication services via the provision of a digital certificate to the Taxpayer's customers for consideration are subject to the Indiana sales and use tax when provided to customers located in Indiana.
Pursuant to IC 6-2.5-2-1 (a) and IC 6-2.5-2-2 (a), sales tax is imposed on retail transactions made in Indiana. Except for certain enumerated services (none of which are at issue in this ruling), sales of services generally are not retail transactions and are not subject to sales or use tax. A retail transaction is defined in IC 6-2.5-4-1 (b) as the transfer, in the ordinary course of business, of tangible personal property for consideration. Pursuant to IC 6-2.5-1-27 , the term "tangible personal property" includes prewritten computer software.
Sales of specified digital products are also included in the definition of retail transactions. IC 6-2.5-4-16.4 (b) provides that a person engages in making a retail transaction when the person (1) electronically transfers specified digital products to an end user; and (2) grants to the end user the right of permanent use of the specified digital products that is not conditioned upon continued payment by the purchaser.
Pursuant to Section 333 ("Use of Specified Digital Products," effective Jan. 1, 2010) of the Streamlined Sales and Use Tax Agreement ("SSUTA," effective Sept. 20, 2009), of which Indiana is a signatory, "A member state shall not include any product transferred electronically in its definition of 'tangible personal property.'" Pursuant to the same section of the SSUTA, "ancillary services," "computer software," and "telecommunication services" are excluded from the term "products transferred electronically." However, IC 6-2.5-1-27.5 (c)(8) explicitly excludes ancillary services from the definition of telecommunication services, which are taxable under IC 6-2.5-4-6 . Accordingly, ancillary services are not subject to sales tax in Indiana.
Based on the foregoing, Indiana imposes sales and use tax on products transferred electronically only if the products meet the definition of specified digital products, prewritten computer software, or telecommunication services. Telecommunication services are not at issue in this ruling, meaning that Taxpayer's sales of authentication services via the provision of a digital certificate to the Taxpayer's Indiana customers are subject to the Indiana sales and use tax only if such sales represent sales of specified digital products or prewritten computer software.
Taxpayer maintains that its provision of digital certificates are neither specified digital products nor prewritten computer software.
The digital certificates provided by the Taxpayer do not constitute computer software as they do not provide a set of coded instructions designed to perform a task. Likewise, the digital certificates do not constitute digital property subject to tax under the state's SSUTA taxability matrix. The certificate is a flat file containing only information (a public key, metadata with information such as certificate expiration date, the certificate owners name, name of the issuer, serial number, electronic signature, etc.). The flat file does not contain binary code and does not dictate statements, data or instructions that is used directly or indirectly to bring about a certain result. The digital certificates are akin to information conveyed digitally.
Specified digital products, as defined by IC 6-2.5-1-26.5 , IC 6-2.5-1-16.2 , IC 6-2.5-1-16.3 , and IC 6-2.5-1-16.4 , currently includes only digital audio works (e.g., songs, spoken word recordings, and ringtones), digital audiovisual works (e.g., movies), and digital books. Products transferred electronically are defined in IC 6-2.5-1-28.5 to mean products that are "obtained by a purchaser by means other than tangible storage media."
Taxpayer maintains and, for the purposes of this ruling, the Department agrees that Taxpayer's authentication services via the provision of digital certificates to Taxpayer's Indiana customers do not represent the provision of specified digital products. Accordingly, Taxpayer's sales of such services are not subject to the Indiana sales and use tax on that basis.
Pursuant to IC 6-2.5-1-14 , "computer software" means a set of coded instructions designed to cause a computer or automatic data processing equipment to perform a task. Pursuant to IC 6-2.5-1-24 , "prewritten computer software" is defined to mean, among other things, computer software, including prewritten upgrades, that is not designed and developed by the author or other creator to the specifications of a specific purchaser[.]
Based on Taxpayer's descriptions, the Department agrees that Taxpayer's provision of digital certificates does not represent the provision of computer software. Taxpayer's digital certificates do not represent a set of coded instructions designed to cause a computer or automatic data processing equipment to perform a task. Because the certificates are not computer software, they also cannot be determined to be prewritten computer software. Accordingly, Taxpayer's sales of such services are not subject to Indiana sales and use tax on that basis.
Taxpayer's sales of authentication services via the provision of a digital certificate to the Taxpayer's customers for consideration are not subject to the Indiana sales and use tax when provided to customers located in Indiana.
This ruling is issued to the taxpayer requesting it on the assumption that the taxpayer's facts and circumstances as stated herein are correct. If the facts and circumstances given are not correct, or if they change, then the taxpayer requesting this ruling may not rely on it. However, other taxpayers with substantially identical factual situations may rely on this ruling for informational purposes in preparing returns and making tax decisions. If a taxpayer relies on this ruling and the Department discovers, upon examination, that the fact situation of the taxpayer is different in any material respect from the facts and circumstances given in this ruling, then the ruling will not afford the taxpayer any protection. It should be noted that subsequent to the publication of this ruling a change in statute, regulation, or case law could void the ruling. If this occurs, the ruling will not afford the taxpayer any protection.
