Is an SSL certificate subscription — which authenticates a website owner's identity and lets browsers verify the certificate is valid — subject to Texas sales and use tax as tangible personal property, data processing, an information service, or a telecommunications service?

Plain-English summary

A web-security company sells "SSL Certificates" by subscription: it authenticates that an applicant business really is who it claims to be, then issues a digital certificate (a flat text file containing a public key and identifying metadata — not executable software), and provides an ongoing "resolution service" so end users' browsers can verify the certificate is still valid and hasn't been revoked. The company asked the Comptroller to rule on two things: whether the digital certificate itself is taxable tangible personal property or software, and whether the authentication/resolution services are taxable data processing, information, or telecommunications services.

The Comptroller ruled no tax applies to any of it:

• The digital certificate isn't a computer program or tangible personal property. It's a flat file of plain-text data (expiration date, owner name, issuer, serial number, signature) with no coded instructions to process data or perform a task — it represents an intangible (trust confirmation), not a Section 151.0031 computer program.
• Not data processing. The initial authentication (verifying who the applicant is) isn't compiling/producing records, maintaining information, or entering/retrieving information under Rule 3.330(a)(1). And although encrypting data for a client has previously been treated as data processing, here the actual encryption/decryption is performed by software built into the end user's browser and the customer's own server — not by the taxpayer — so the taxpayer isn't providing that function either. The resolution (validity-check) service likewise doesn't involve compiling/producing/maintaining/retrieving records.
• Not an information service. Rule 3.342(a)(2) requires furnishing general or specialized news or current information; there's no charge to the end user for accessing the public key or checking certificate validity, and the customer's subscription fee isn't for "information" in that sense.
• Not a telecommunications service. The services don't involve electronic transmission/conveyance/routing/reception of sounds, signals, data, or information within Rule 3.344(a)(13)'s definition.

Since the certificates aren't taxable items (tangible personal property) and none of the enumerated taxable services (data processing, information, telecommunications) apply, the whole SSL Certificate product — certificate, authentication, and resolution service together — is outside Texas sales and use tax under Sections 151.051(a) and 151.101(a).

What this means for you

SSL/TLS certificate authorities and web-security vendors

This ruling supports treating SSL/TLS certificate subscription fees as non-taxable in Texas, provided your service matches this fact pattern: the certificate is a static data file (no embedded executable code), you don't perform the actual encryption/decryption (that's done by browser/server software), and there's no separate charge to end users for information or validity checks.

SaaS and software vendors more broadly

The ruling is a useful illustration of how the Comptroller distinguishes "representing" a fact (here, a trust confirmation) from actually processing data. If your product's output is metadata or a static credential rather than the result of compiling/manipulating/storing customer records, it may fall outside the data-processing definition even if it resembles a digital product.

Accountants and tax professionals

Note the ruling's careful handling of the encryption issue: prior Comptroller guidance (STAR Accession No. 9911887L) held that encrypting data for a client is data processing, but this ruling distinguishes that precedent because the taxpayer here doesn't perform the encryption itself — it's baked into third-party browser/server software. That distinction (who actually performs the function) is doing the real work in the analysis.

Common questions

Q: Are all digital certificates non-taxable in Texas?
A: This ruling addresses this specific fact pattern (a flat, non-executable data file with no separate information or telecommunications charge). A certificate bundled with software the vendor itself operates, or a service where the vendor charges specifically for information delivery, could come out differently.

Q: Does it matter that the company is out-of-state (Arizona)?
A: The ruling doesn't turn on the vendor's location — Texas use tax would apply the same nexus/sourcing analysis to an out-of-state seller's Texas customers regardless, but taxability here was decided on the nature of the product/service, not situs.

Q: Can another SSL vendor rely on this ruling?
A: No. This is a private letter ruling binding only on the Comptroller as to this taxpayer and these facts, and cannot be relied upon by any other taxpayer.

Citations and references

Statutes and rules:

• Tex. Tax Code § 151.009 (tangible personal property definition)
• Tex. Tax Code § 151.0031 (computer program definition)
• Tex. Tax Code § 151.010 (taxable item definition)
• Tex. Tax Code § 151.0035; 34 Tex. Admin. Code Rule 3.330(a)(1) (data processing services)
• Tex. Tax Code § 151.0038; 34 Tex. Admin. Code Rule 3.342(a)(2) (information services)
• Tex. Tax Code § 151.0101(a)(6), (10), (12) (enumerated taxable services)
• 34 Tex. Admin. Code Rule 3.344(a)(13) (telecommunications services definition)
• Tex. Tax Code §§ 151.051(a), 151.101(a) (imposition of sales/use tax)
• 34 Tex. Admin. Code Rule 3.1 (Private Letter Rulings and General Information Letters)
• 34 Tex. Admin. Code Rule 3.10 (Taxpayer Bill of Rights; detrimental reliance)

Prior STAR guidance discussed:

• STAR Accession No. 9911887L (Nov. 18, 1999) (encrypting data for a client is data processing — distinguished because taxpayer here doesn't perform the encryption itself)

Source

• STAR search: https://star.comptroller.texas.gov/search?doc_type_code=L&tax_type_code=SST
• Opinion: https://star.comptroller.texas.gov/view/201608960L

Original ruling text

August 19, 2016

Re: Private Letter Ruling # 152600379

Dear **:

We issue this private letter ruling in accordance with Rule 3.1, Private Letter
Rulings and General Information Letters [ENDNOTE 1], in response to your
request dated September 8, 2015. Detrimental reliance relief is provided in
accordance with Rule 3.10, the Taxpayer Bill of Rights. You request guidance on
the taxability of authentication and resolution services, which includes the
provision of a digital certificate.

Requested Rulings:

Taxpayer requests a ruling that the digital certificate that Taxpayer provides
a customer is not computer software or other tangible personal property.

Taxpayer requests a ruling that the authentication and resolution services
Taxpayer provides to customers do not fall within the definitions of data
processing services, information services, or telecommunication services and
are not taxable.

Facts Presented:

Taxpayer is a limited liability company based in CITY, Arizona. Among
other products and services, Taxpayer sells web security solutions that allow
its customers to establish secure, encrypted connections over the internet
between end users’ web browsers and its customers’ own servers.

Taxpayer’s authentication services, provision of a digital certificate, and
resolution services are advertised to its customers in bundle form as “SSL
Certificates” [ENDNOTE 2]. Taxpayer sells the SSL Certificates for a lump-sum
subscription charge that must be periodically renewed.

To purchase an SSL Certificate, a customer accesses Taxpayer’s online portal to
complete a registration form. As part of the registration process, a public key
(a string of alpha and numeric characters up to 2048 bits long) is generated by
the customer’s web server using an algorithm protocol. The public key is sent
from the customer’s web server to Taxpayer.

Taxpayer then authenticates that the customer, usually a business, is who they
purport to be. Taxpayer states that it “performs all due diligence necessary to
authenticate the identity of the applicant, the related website and business,
and the information presented by the customer during the registration process.”

Once Taxpayer authenticates the customer’s identity, Taxpayer issues a digital
certificate that is sent electronically to the customer. A digital certificate
is a flat file containing the customer’s public key, which can be viewed by any
web browser, and metadata that includes the certificate expiration date; the
certificate owner’s name; the name of the issuer (in this case, Taxpayer); the
serial number of the certificate; and Taxpayer’s electronic signature. The flat
file does not contain computer code or any kind of software program. It stores
data in plain text. Each line of the text file holds one record, with fields
separated by delimiters, such as commas and tabs. Flat files are not executable
and must be read by a computer program to access the data.

The customer puts the digital certificate containing the public key on its web
server. When a person (the “end user”) uses a web browser to connect to the
customer’s website over the internet, the browser establishes the authenticity
of the digital certificate and the website. In addition, the end user’s browser
communicates with Taxpayer’s servers to verify that the digital certificate is
valid and has not been revoked. Taxpayer describes the verification it provides
on its customers’ behalf as a resolution service.

The end user will know that the customer’s website is not a fraudulent site
because the address will begin with “https,” the address bar will contain a
padlock symbol, or the address bar will change color, usually to green. The end
user’s web browser will use the public key on the digital certificate to
encrypt the transmission between the customer’s server and the browser. The
encryption and decryption is performed by the cryptographic software built into
the web browser and the customer’s server. The software is not provided by
Taxpayer as part of the SSL Certificate.

Analysis and Response:

Texas sales tax applies to the sale of each taxable item in Texas. [ENDNOTE 3]
A corresponding use tax is imposed on the use in Texas of a taxable item
purchased outside of the state. [ENDNOTE 4] Section 151.010 defines a “taxable
item” as “tangible personal property and taxable services.” The definition also
states, “Except as otherwise provided by this chapter, the sale or use of a
taxable item in electronic form instead of on physical media does not alter the
item's tax status.”

Digital Certificates

Tangible personal property is defined in Section 151.009 as "personal property
that can be seen, weighed, measured, felt, or touched, or that is perceptible
to the senses in any other manner and the term includes a computer program and
telephone prepaid calling card."

Section 151.0031 defines a computer program as "a series of instructions that
are coded for acceptance or use by a computer system and that are designed to
permit the computer system to process data and provide results and information.
The series of instructions may be contained in or on magnetic tapes, punched
cards, printed instructions, or other tangible or electronic media."

The digital certificates provided by Taxpayer do not fall within the definition
of a computer program. The digital certificates do not provide a set of coded
instructions designed to process data or perform a task. The certificate is a
flat file containing only information, such as certificate expiration date, the
certificate owner’s name, and the name of the issuer. The digital certificates
represent an intangible – confirmation that a website can be trusted by web
browsers. [ENDNOTE 5] Accordingly, Taxpayer’s sale of SSL Certificates does
not include the sale or other transfer of tangible personal property.

SSL Certificate Services

1) Data Processing Services

Texas imposes tax on the sale or use of data processing services. [ENDNOTE 6]
Data processing services are defined, in relevant part, as “the processing of
information for the purpose of compiling and producing records of transactions,
maintaining information, and entering and retrieving information. It
specifically includes word processing, payroll and business accounting, and
computerized data and information storage or manipulation.” [ENDNOTE 7]

Here, Taxpayer is providing its customers a process wherein they are first
authenticated to ensure they are the company or individual they purport to be
upon application and then provided a digital certificate that allows end users’
web browsers to authenticate, and establish secure connections with, the
customers’ website. In addition to providing the digital certificate,
Taxpayer’s servers communicate with an end user’s web browser to verify that a
customer’s digital certificate is valid and has not been revoked.

The initial authentication service is provided to verify the identity of the
business or individual who has applied for an SSL Certificate. The service of
verifying the identity of a business or individual in order to provide them a
digital certificate does not fall within the meaning of data processing
services in Section 151.0035 and Rule 3.330(a)(1), as Taxpayer is not compiling
and producing records of transactions, maintaining information, and entering
and retrieving information. The digital certificate Taxpayer provides to
customers represents the results of this authentication service.

An end user’s web browser can use the public key contained in a customer’s
digital certificate to encrypt communications with the customer’s server. Prior
Comptroller guidance has stated that encrypting data for a client falls within
the meaning of data processing. [ENDNOTE 8] Here, however, the encryption and
decryption is not being performed by Taxpayer. The encryption and decryptions
being performed entirely by software built into end users’ web browsers and the
customers’ servers. Taxpayer is not encrypting or decrypting data on its
customers’ behalf.

Finally, the resolution services provided allow the end user’s web browser to
verify that a customer’s digital certificate is valid and do not constitute
data processing because Taxpayer is not “compiling and producing records of
transactions, maintaining information, [or] entering and retrieving
information” for its customer.

Taxpayer’s sale of authentication and resolution services, including the provision
of a digital certificate, does not fall within the definition of data processing.

2) Information Services

Texas imposes tax on information services. [ENDNOTE 9] Information services
are defined in part as “Furnishing general or specialized news or other current
information, including financial information, by printed, mimeographed,
electronic, or electrical transmission, or by utilizing wires, cable, radio waves,
microwaves, satellites, fiber optics, or any other method now in existence or
which may be devised, and electronic data retrieval or research.”[ENDNOTE 10]

Providing authentication and resolution services does not fall within
“furnishing general or specialized news or other current information.” Taxpayer
does not charge the end user when the user’s web browser accesses a customer’s
public key. Similarly, there is no charge to the end user when Taxpayer
verifies that a customer’s digital certificate is valid. Customers who pay a
subscription fee for authentication and resolution services, wherein a digital
certificate is provided, are not purchasing an information service within the
meaning of Rule 3.342(a)(2).

3) Telecommunication Services

Texas imposes tax on telecommunication services. [ENDNOTE 11]
Telecommunications services are defined as “electronic or electrical
transmission, conveyance, routing, or reception of sounds, signals, data, or
information utilizing wires, cable, radio waves, microwaves, satellites, fiber
optics, Voice over Internet Protocol (VoIP), or any other method now in
existence or that may be devised, including but not limited to long-distance
telephone service. The term includes mobile telecommunications services and
prepaid telecommunications services.” [ENDNOTE 12] The initial authentication
services, provision of a digital certificate, and resolution services do not
fall within this definition.

Summary:

The SSL Certificates provided by Taxpayer are not subject to Texas sales or use tax.

The authentication and resolution services provided by Taxpayer do not fall
within the enumerated taxable services found in Section 151.0101. The digital
certificates provided by Taxpayer are not tangible personal property under
Section 151.009. Accordingly, the services provided, including the provision of
a digital certificate, are not taxable items under Section 151.010 and
therefore not taxable under Sections 151.051(a) and 151.101(a).

If you have any questions about this private letter ruling, please email us
through our website at https://www.comptroller.texas.gov/taxhelp/ and
reference Private Letter Ruling #152600379.

Regards,

Indirect Tax Section
Tax Policy Division
Comptroller of Public Accounts

ENDNOTES

1. Unless otherwise noted, all references herein to “Section” are to Tex. Tax
   Code Ann. (Vernon 2008 and Supp. 2015) and all references to “Rule” are to 34
   Tex. Admin. Code (2015).

2. https://www.Taxpayer.com/web-security/ssl-certificate (last visited April 1, 2016)

3. Section 151.051(a).

4. Section 151.101(a).

5. Under Section 1.04(6), "Intangible personal property" means a claim,
   interest (other than an interest in tangible property), right, or other thing
   that has value but cannot be seen, felt, weighed, measured, or otherwise
   perceived by the senses, although its existence may be evidenced by a document.
   It includes a stock, bond, note or account receivable, franchise, license or
   permit, demand or time deposit, certificate of deposit, share account, share
   certificate account, share deposit account, insurance policy, annuity, pension,
   cause of action, contract, and goodwill.

6. Section 151.0101(a)(12).

7. Rule 3.330(a)(1)

8. Star Accession No. 9911887L (November 18, 1999).

9. Section 151.0101(a)(10).

10. Rule 3.342(a)(2).

11. Section 151.0101(a)(6).

12. Rule 3.344(a)(13).