Certificate Practice Statement

Certification Practice Statement

Updated: Oct 27, 2023

Version: 1.0

Acknowledgments

This Ztamp CA CPS endorses in whole or in part the following industry standards:

RFC 3647: Internet X.509 Public Key Infrastructure – Certificate Policies and Certification Practices Framework (obsoletes RFC 2527)
RFC 2459: Internet X.509 Public Key Infrastructure – Certificate and CRL Profile
RFC 3279: Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and CRI Profile
The ISO 1-7799 standard on security and infrastructure

1.0 Introduction

This Certification Practice Statement (CPS) of the Ztamp Certification Authority (hereinafter, Ztamp CA) applies to the services of the Ztamp CA that are associated with the issuance of and management of digital certificates. This CPS can be found on the Ztamp CA repository at https://ztamp.io/repo. This CPS may be updated from time to time.

This CPS addresses the technical, procedural personnel policies and practices of the CA in all services and during the complete life cycle of certificates as issued by Ztamp CA. Ztamp CA is operated and owned by Ztamp.

Inquiries on this Ztamp CA CPS can be addressed to Melvin Wong at [email protected]

This CPS is final and binding between Ztamp (operating and owning the Ztamp CA), a company under public law, with registered office at 10 Anson Road, #11-20 International Plaza, Singapore 079903 (Hereinafter referred to as “Ztamp”) and the subscriber and/or relying parties, who use rely or attempt to rely upon certification services made available by the Ztamp CA.

For subscribers, this CPS becomes effective and binding by accepting a subscriber agreement. For relying parties, this CPS becomes binding by merely addressing a certificate-related request on a Ztamp certificate to a Ztamp directory. The subscriber agreement forfeits the consent of the relying party with regard to accepting the conditions laid out in this CPS.

1.1 Overview

This CPS applies to the specific domain of the Ztamp CA. The purpose of this CPS is to present the Ztamp practices and procedures in managing certificates and to demonstrate compliance with requirements pertaining to the issuance of digital certificates according to Ztamp’s own and industry requirements pursuant to the standards set out above. The certificate type addressed in this CPS is smart contract certificate

This certificate:

Can be used for electronic signatures in order to replace handwritten signatures where transacting parties choose for them
Can be used to authenticate web resources, such as servers and other devices

This CPS identifies the roles, responsibilities and practices of all entities involved in the life cycle, use, reliance upon and management of Ztamp certificates. The provisions of this CPS with regard to practices, level of services, responsibilities and liability bind all parties involved including the Ztamp CA, Ztamp RA, subscribers and relying parties. Certain provisions might also apply to other entities such as the certification service provider, application providers etc.

This CPS describes the requirements to issue, manage and use certificates issued by the Ztamp CA under a managed Brand Root. This Brand Root is the Ztamp Root CA (Hereinafter referred to as “Brand Root”) which is managed according to practices described in the Ztamp Certificate Policy published under https://ztamp.io/repo. This CPS does not address the Brand Root policies, but relies exclusively on the practices described in the Ztamp Certificate Policy.

A subscriber or relying party of a Ztamp CA certificate must refer to the Ztamp CPS in order to establish Trust. It is also essential to establish the trustworthiness of the entire certificate chain of the Ztamp certificate hierarchy, including the Brand Root.

This CPS is made available online at https://ztamp.io/repo.

The Ztamp CA accepts comments regarding this CPS addressed to the address mentioned above in the introduction of this document.

1.2 Ztamp Certificate Types

1.2.1 Smart Contract Certificates

Ztamp smart contract certificates can be used to authenticate and verify ownership of smart contracts. It is meant for entities that wish to verify who the actual owner of a particular smart contract is. These certificates are essential to build trust on a blockchain network and to prevent incidents such as smart contact phishing. The identity of the certificate-holder is fully authenticated by Ztamp CA.

1.2.2 Acceptable Subscriber Names

For publication in its certificates Ztamp CA accepts subscriber names that are meaningful and can be authenticated as required.

1.2.3 Pseudonyms

Ztamp CA may allow the use of pseudonyms, reserving its right to disclose the identity of the subscriber as may be required by law or following a reasoned and legitimate request.

1.2.4 Registration Procedures

Ztamp CA reserves the right to update registration procedures and subscriber submitted data to improve the identification and registration process.

1.3 Ztamp Smart Contract Certificates

1.3.1 General

Ztamp certificates are meant to authenticate and verify the ownership of smart contracts.

The applicant is an individual or organization that owns or does not own a website. Ztamp certificates validity period is between one and three years. Ztamp certificates are issued to entities and individuals who own a smart contract, or have the right to request a Ztamp certificate for a smart contract.

1.3.2 Certificate Request

A certificate request can be made in the following way:

The certificate applicant submits an application following a procedure provided by Ztamp CA. Additional documentation in support of the application may be required so that Ztamp CA verifies that the smart contract and/or website belongs to the applicant, or that the applicant is authorized to request a certificate for that smart contract. The applicant submits to Ztamp CA the additional documentation. Upon verification of ownership or right to use of the domain name, Ztamp CA issues the certificate and sends a notice to the applicant. The applicant downloads and installs the certificate on the smart contract. The applicant must notify Ztamp CA of any inaccuracy or defect in a certificate promptly after receipt of the certificate or earlier notice of changes to the information to be included in the certificate.

1.3.3 Content

Typical information published on a Ztamp certificate includes the following elements

Applicant’s individual or organization name
Applicant’s website address
Applicant’s wallet address
Applicant’s public key
Issuing certification authority (Ztamp CA)
Ztamp electronic signature
Type of algorithm
Validity period of the digital certificate
Serial number of the digital certificate

1.3.4 Information Submitted to Verify Ownership of the Smart Contract

The applicant must provide contact details to Ztamp CA. Ztamp CA has the right to request a signed registration form or a signed subscriber agreement. Ztamp CA has the right to request proof of the ownership of smart contract, proof of ownership of wallet address that is associated to the smart contract, proof of ownership of website, proof of identity, proof of address, proof of ownership of organization and more.

1.3.5 Issuing Procedure

The issuing procedure for a Ztamp smart contract certificate is as follows:

The applicant creates Certificate Signing Request (CSR) and a key pair using appropriate software.
The applicant follows the registration procedure.
The applicant submits the required information including technical contact and smart contract information.
The applicant accepts the subscriber agreement.
Ztamp CA verifies the submitted information by checking domain ownership or domain right to use and any other information as it sees fit.
Ztamp CA may positively verify the applicant.
Ztamp CA may issue the certificate to the applicant.
Ztamp CA may publish the issued certificate in an online database.

Ztamp might apply variations of this procedure in order to meet service, standards or legal requirements.

1.3.6 Limited Warranty

Ztamp accepts no liability per loss due to a false smart contract (lack of ownership or lack of right to use smart contract) in a certificate issued according to the CPS.

1.3.7 Relevant Ztamp Documents

The applicant must take notice and is bound by the following documents available at https://ztamp.io/repo.

Ztamp CPS
Subscriber Agreement

1.4 Document Name and Identification

Ztamp ensures compliance of its certificates with the requirements and assertions of this CPS.

1.5 PKI Participants

The Ztamp CA makes its services available to Ztamp certificate subscribers. These subscribers include without limitation entities that uses the Ztamp certificates for the purposes of:

Authentication
Encryption

1.5.1 Ztamp Certification Authority

A Certification Authority, such as Ztamp CA, is an organization that issues digital certificates to be used in public or private domains, within a business framework, a transaction context, etc. A certification authority is also referred to as the Issuing Authority to denote the purpose of issuing certificates.

The Ztamp CA drafts and implements the policy prevailing in issuing a certain type or class of digital certificates.

The Ztamp CA ensures the availability of all services pertaining to the management of Ztamp certificates, including without limitation the issuing, revocation, status verification of a certificate, as they may become available or required in specific applications.

Appropriate publication is necessary to ensure that relying parties obtain notice or knowledge of functions associated with the revoked and/or suspended certificates. Publication is manifested by including a revoked or suspended certificate in a certificate revocation list that is published in an online directory.

The domain of responsibility of the Ztamp CA’s comprises the overall management of the certificate lifecycle including the following actions:

Issuance
Revocation
Renewal
Status validation

1.5.1.1 Role of Ztamp CA

Ztamp CA operates as a Trust Service Provider to deliver Trust Services to a user community.

1.5.2 Subscribers
Subscribers of Ztamp services are natural persons who successfully apply for a certificate. Subscribers are parties that have ultimate authority over the private key corresponding to the public key that is listed in a subject certificate.

Natural persons who are subscribers typically hold a valid identification document, which might be used as a credential in order to issue Ztamp certificates.

Additional credentials are required as explained in the process for the application for a certificate.

1.5.3 Relying Parties

Relying parties are natural or legal persons who rely on a certificate and/or a digital signature verifiable with reference to a public key listed in a subscriber’s certificate.

To verify the validity of a digital certificate, relying parties must always refer to Ztamp CA revocation information such as a Certificate Revocation List (CRL). Certificate validation takes place prior to relying on information featured in a certificate. Relying parties meet specific obligations as described in this CPS.

1.6 Certificate Use

Certain limitations apply to the use of Ztamp CA certificates.

1.6.1 Appropriate Certificate Usage

Ztamp certificates can be used for public domain transactions that require:

Authentication and
Verification

Additional uses are specifically designated once they become available to end entities.

1.6.2 Prohibited Certificate Usage

End entity certificate use is restricted by using certificate extensions on key usage and extended key usage. Any usage of the certificate inconsistent with these extensions is not authorized.

1.6.3 Certificate Extensions

Ztamp CA issues certificates that might contain extensions defined by the X.509 v3 standard as well as any other formats.

1.6.4 Critical Extensions

Ztamp CA uses certain critical extensions in the certificates it issues such as:

A basic constraint in the certificate to show whether a certificate is meant for a CA or not.
To show the intended usage of the key.

1.7 Policy Administration

The Policy Managing Authority of the Ztamp CA manages this Ztamp CPS. The Ztamp CA registers, observes the maintenance, and interprets this CPS. The Ztamp CA makes available the operational conditions prevailing in the life-cycle management of Ztamp certificates.

1.7.1 Scope

Ztamp may make revisions and updates to its policies as it sees fit or as required by the circumstances. Such updates become binding for all certificates that have been issued or are to be issued 30 days after the date of the publication of the updated version of the CPS.

1.7.2 Ztamp Policy Management Authority

New versions and publicized updates of Ztamp policies are approved by the Ztamp Policy Management Authority. The Ztamp Policy Management Authority in its present organizational structure comprises of members as indicated below:

At least one member of the management of Ztamp CA.
At least one authorized agents directly involved in the drafting and development of Ztamp practices and policies.

1.7.3 Acceptance of Updated Versions of the CPS

Upon approval of a CPS update by the Ztamp Policy Management Authority, that CPS is published in the Ztamp online repository at https://ztamp.io/repo.

The updated version is binding against all existing and future subscribers unless notice is received within 30 days after communication of the notice. After such period the updated version of the CPS is binding against all parties including the subscribers and parties relying on certificates that have been issued under a previous version of the Ztamp CPS.

1.7.4 Version Management and Denoting Changes

Changes are denoted through new version numbers for the CPS. New versions are indicated with an integer number followed by one decimal that is zero. Minor changes are indicated through one decimal number that is larger than zero. Minor changes include:

Minor editorial corrections
Changes to contact details

1.8 Definitions and Acronyms

A list of definitions can be found at the end of this CPS.

2.0 Publication and Repository Responsibilities

Ztamp CA publishes information about the digital certificates that it issues in an online repository. Ztamp CA reserves its right to publish certificate status information on third-party repositories.

Ztamp CA retains an online repository of documents where it makes certain disclosures about its practices, procedures and the content of certain policies including this CPS. Ztamp CA reserves its right to make available and publish information on its policies by any appropriate means within the Ztamp repository.

All parties who are associated with the issuance, use or management of Ztamp certificates are hereby notified that Ztamp CA may publish submitted information on publicly accessible directories in association with the provision of electronic certificate status information.

Ztamp CA refrains from making publicly available certain elements of documents including security controls, procedures, internal security policies, etc.

3.0 Identification and Authentication

Ztamp CA maintains appropriate procedures to address naming practices, including the recognition of trademark rights in certain names.

Ztamp CA authenticates the requests of parties wishing to revoke certificates under this policy.

3.1 Initial Identity Validation

The identification of the applicant for a certificate is carried out according to a documented procedure.

For the identification and authentication procedures of the initial subscriber registration, Ztamp CA might rely on such resources as third-party databases.

3.2 Subscriber Registration Process

Ztamp CA ensures that:

Subscribers of certificates are properly identified and authenticated
Subscriber certificate requests are complete, accurate and duly authorized.

3.2.1 Documents Used for Subscriber Registration

Ztamp CA typically verifies certificate request by appropriate means and on the basis of a documented procedure: the applicant must submit to Ztamp CA a Subscriber Agreement, both accepted and agreed to.

Ztamp CA may prescribe additional identification proof in support of the verification of the applicant’s ownership or right to use of the smart contract.

3.2.2 Records for Subscriber Registration

Ztamp CA maintains records of the executed subscriber agreement and any material or documents that support the application which also include but are not limited to:

Ztamp CA subscriber agreement as approved of, and executed by, the applicant.
Consent to the keeping of a record by Ztamp of information used in registration and any subsequent certificate status change and passing of this information to third parties under the same conditions as required by this CPS in the case of the CA terminating its services.
That information held in the certificate is correct and accurate.
A specifically designed attribute that uniquely identifies the applicant within the context of the Ztamp CA.

The records identified above shall be kept for a period of no less than 2 years following the expiration of a certificate.

3.2.3 Identification and Authentication for Revocation Requests

For the identification and authentication procedures of revocation requests, Ztamp CA requires using an online authentication mechanism and/or a request addressed to Ztamp CA.

4.0 Certificate Life-Cycle Operational Requirements

The following operational requirements apply to Certificate Life-Cycle.

All entities within the Ztamp domain including subscribers or other participants have a continuous duty to inform the Ztamp CA of all changes in the information featured in a certificate during the operational period of such certificate and until it expires or revoked.

To carry out its tasks Ztamp may use third-party agents for which Ztamp CA assumes responsibility.

Subscribers undergo an enrollment process that requires:

Generating a key pair.
Delivering the generated public key corresponding to a private key to Ztamp CA.
Accepting the subscriber agreement.

The subscriber is required to accept the issuance terms by a subscriber agreement that will be executed with the Ztamp CA. The subscriber agreement incorporates by reference this CPS.

4.1 Certificate Application Processing and Issuance

Ztamp CA acts upon a Ztamp certificate application to validate the submitted information. Subsequently, the application is either approved or rejected. Such approval or rejection does not necessarily have to be justified to the applicant or any other party.

For rejected applications of certificate requests, Ztamp CA notes the reason for rejecting the application.

Following issuance of the approved certificate, the Ztamp CA delivers the issued certificate to the subscriber.

4.2 Certificate Generation

With reference to the issuance and renewal of certificates, Ztamp CA represents towards all parties that certificates are issued securely according to the conditions set below:

The procedure to issue a certificate is securely linked to the associated registration, including the provision of any subscriber generated public key.
The confidentiality and integrity of registration data is ensured at all times through appropriate SSL (Secure Socket layer) links.
Certificate requests and generation are also supported by robust and tested procedures that have been scrutinized for compliance with the prevailing standards.

4.3 Certificate Acceptance

An issued Ztamp certificate is deemed accepted by the subscriber when no objection is received by Ztamp from the subscriber within three (3) working day after it being received. Any objection to accepting an issued certificate must explicitly be notified to the Ztamp CA. The reasoning for rejection including any fields in the certificate that contain erroneous information must also be submitted.

The Ztamp CA might post the issued certificate on a repository. The Ztamp CA also reserves its right to notify the certificate issuance by the Ztamp CA to other entities.

4.4 Key Pair and Certificate Usage

The responsibilities relating to the use of keys and certificates include the ones addressed below:

4.4.1 Subscriber

The obligations of the subscriber include the following ones

4.4.1.1 Subscriber Duties

Unless otherwise stated in this CPS, the duties of subscribers include the following:

Accepting all applicable terms and conditions in the CPS of Ztamp CA published in the Ztamp repository.
Notifying the Ztamp CA of any changes in the information submitted that might materially affect the trustworthiness of that certificate.
Ceasing to use a Ztamp certificate when it becomes invalid.
Using a Ztamp certificate, as it may be reasonable under the circumstance.
Preventing the compromise, loss, disclosure, modification, or otherwise unauthorized use of their private key.
Using secure devices and products that provide appropriate protection to their keys.
Refraining from submitting to Ztamp CA or any Ztamp directory any material that contains statements that violate any law or the rights of any party.
Requesting the revocation of a certificate in case of an occurrence that materially affects the integrity of a Ztamp certificate.
Refraining from tampering with a certificate.
Only using certificates for legal and authorized purposes in accordance with the CPS.
Refrain from using a certificate outside possible license restrictions imposed by Ztamp CA.

The Subscriber has all above stated duties towards the CA at all times.

4.4.1.2 Subscriber Duty Towards Relying Parties

Without limiting other subscriber obligations stated elsewhere in this CPS, subscribers have a duty to refrain from any misrepresentations they make in certificates to third parties that reasonably rely on the representations contained therein.

4.4.1.3 Reliance at Own Risk

It is the sole responsibility of the parties accessing information featured in the Ztamp CA repositories and website to assess and rely on information featured therein. Parties acknowledge that they have received adequate information to decide whether to rely upon any information provided in a certificate. The Ztamp CA takes steps necessary to update its records and directories concerning the status of the certificates. Failure to comply with the conditions of usage of the Ztamp CA repositories and website may result in terminating the relationship between the Ztamp CA and the party.

4.4.2 Relying Party

The duties of a relying party are as follows:

4.4.2.1 Relying Party Duties

A party relying on a Ztamp certificate will:

Validate a Ztamp certificate by using certificate status information (e.g. CRL) published by Ztamp CA.
Trust a Ztamp CA certificate only if all information featured on such a certificate can be verified via such a validation procedure as being correct and up to date.
Rely on a Ztamp certificate, only as it may be reasonable under the circumstances.
Trust a certificate only if it has not been revoked.

4.4.2.2 Ztamp CA Repository and Website Conditions

Parties, including subscribers and relying parties, accessing the Ztamp CA repository and website agree with the provisions of this CPS and any other conditions of use that the Ztamp CA may make available. Parties demonstrate acceptance of the conditions of usage of the CPS by submitting a query with regard to the status of a digital certificate or by using or relying upon any such information or services provided:

Obtaining information as a result of the search for a digital certificate.
Validating the status of a digital certificate before encrypting data using the public key included in a certificate
Obtaining information published on the Ztamp CA website.

4.5 Certificate Renewal

Subscribers may request the renewal of Ztamp certificates. To request the renewal of a Ztamp certificate, an end user lodges a request.

Requirements for renewal of certificates, where available, may vary from those originally required for subscribing to the service.

4.6 Certificate Revocation

Ztamp CA shall use reasonable efforts to publish clear guidelines for revoking certificates, and maintain a 24/7 ability to accept and respond to revocation requests.

The identification of the subscriber who applies for a revocation or suspension of a certificate is carried out according to an internal documented procedure.

The Ztamp CA revokes a Ztamp certificate if:

There has been loss, theft, modification, unauthorized disclosure, or other compromise of the private key of the certificate’s subject.
The certificate’s subscriber has breached a material obligation under this CPS.
The performance of a person’s obligations under this CPS is delayed or prevented by a natural disaster, computer or communications failure, or other cause beyond the person’s reasonable control, and as a result, another person’s information is materially threatened or compromised.
There has been a modification of the information contained in the certificate of the certificate’s subject.

4.7 Certificate Status Services

The Ztamp CA makes available certificate status checking services including CRLs, and appropriate Web interfaces.

CRL

A CRL lists all revoked and suspended certificates during the application period. CRLs for the different products are pointed to from within the certificate through the CDP extension.

4.8 End of Subscription

Subscriber subscription ends when a certificate is revoked, expired or the service is terminated.

4.9 Certificates Problem Reporting and Response Capability

In addition to certificate revocation, Ztamp CA provides subscribers, relying parties, and other third parties with clear instructions for reporting complaints or suspected Private Key compromise, certificate misuse, or other types of fraud, compromise, misuse, or inappropriate conduct related to certificates. Ztamp CA shall use reasonable efforts to provide a timely capability to accept and acknowledge and respond to such reports.

5.0 Management, Operational, And Physical Controls

This section describes non-technical security controls used by Ztamp CA to perform the functions of key generation, subject authentication, certificate issuance, certificate revocation, audit, and archival.

5.1 Physical Security Controls

The Ztamp CA implements physical controls on its own, leased or rented premises.

The Ztamp CA infrastructure is logically separated from any other certificate management infrastructure, used for other purposes.

The Ztamp CA secure premises are located in an area appropriate for high-security operations.

Physical access is restricted by implementing mechanisms to control access from one area of the facility to another or access into high-security zones.

The Ztamp CA implements prevention and protection as well as measures against fire exposures.

Media are stored securely. Backup media are also stored in a separate location that is physically secure and protected from fire and water damages.

The sites of the Ztamp CA host the infrastructure to provide the Ztamp CA services. The Ztamp CA sites implement proper security controls, including access control, intrusion detection and monitoring. Access to the sites is limited to authorized personnel listed on an access list.

5.2 Procedural Controls

The Ztamp CA follows personnel and management practices that provide reasonable assurance of the trustworthiness and competence of the members of the staff and of the satisfactory performance of their duties in the fields of the electronic signature-related technologies.

The Ztamp CA obtains a signed statement from each member of the staff on not having conflicting interests, maintaining confidentiality and protecting personal data.

All members of the staff operating the key management operations administrators, security officers, and system auditors or any other operations that materially affect such operations are considered as serving in a trusted position.

The Ztamp CA conducts an initial investigation of all members of staff who are candidates to serve in trusted roles to make a reasonable attempt to determine their trustworthiness and competence.

Where dual control is required at least two trusted members of the Ztamp CA staff need to bring their respective and split knowledge in order to be able to proceed with an ongoing operation.

The Ztamp CA ensures that all actions with respect to the Ztamp CA can be attributed to the system and the person of the CA that has performed the action.

The Ztamp CA implements dual control for critical CA functions.

5.3 Personnel Security Controls

5.3.1 Qualifications, Experience, Clearances

The Ztamp CA performs checks to establish the background, qualifications, and experience needed to perform within the competence context of the specific job.

5.3.2 Training Requirements and Procedures

The Ztamp CA makes available training for their personnel to carry out their functions.

5.3.3 Retraining Period and Retraining Procedures

Periodic training updates might also be performed to establish continuity and updates in the knowledge of the personnel and procedures.

5.3.4 Sanctions Against Personnel

Ztamp CA sanctions personnel for unauthorized actions, unauthorized use of authority, and unauthorized use of systems for the purpose of imposing accountability on a participant’s personnel, as it might be appropriate under the circumstances.

5.3.5 Controls of Independent Contractors

Independent contractors and their personnel are subject to the same privacy protection and confidentiality conditions as Ztamp CA personnel.

5.3.6 Documentation for Initial Training and Retraining

The Ztamp CA makes available documentation to personnel, during initial training, retraining, or otherwise.

5.4 Audit Logging Procedures

Audit logging procedures include event logging and audit systems, implemented for the purpose of maintaining a secure environment.

Ztamp CA implements the following controls:

Ztamp CA audit records events that include but are not limited to

Issuance of a certificate
Revocation of a certificate
Publishing of a CRL

Audit trail records contain:

The identification of the operation
The data and time of the operation
The identification of the certificate, involved in the operation
The identification of the person that performed the operation
A reference to the request of the operation.

Documents available include:

Infrastructure plans and descriptions.
Physical site plans and descriptions.
Configuration of hardware and software.
Personnel access lists.

Ztamp CA ensures that designated personnel review log files at regular intervals and detect and report anomalous events.

Log files and audit trails are archived for inspection by the authorized personnel of Ztamp CA. The log files should be properly protected by an access control mechanism. Log files and audit trails are backed up and must be available to independent auditors upon request.

5.5 Records Archival

Ztamp CA keeps archives in a retrievable format.

Ztamp CA ensures the integrity of the physical storage media and implements proper copying mechanisms to prevent data loss.

Archives are accessible to authorized personnel of Ztamp CA as appropriate. The Ztamp CA keeps internal records of the following items:

All certificates for a period of a minimum of 2 years after the expiration of the certificate.
Audit trails on the issuance of certificates for a period of a minimum of 2 years after issuance of a certificate.
Audit trail of the revocation of a certificate for a period of a minimum of 2 years following the revocation of a certificate.
CRLs for a minimum of 1 years after expiration or revocation of a certificate.
Support documents on the issuance of certificates for a period of 2 years after expiration of a certificate. Support documents can be electronically stored.

5.5.1 Types of Records

Ztamp CA retains in a trustworthy manner records of Ztamp CA digital certificates, audit data, certificate application information, log files and documentation supporting certificate applications.

5.5.2 Retention Period

Ztamp CA retains in a trustworthy manner records of certificates for at least 2 years.

5.5.3 Protection of Archive

Conditions for the protection of archives include:

Only the records administrator (member of staff assigned with the records retention duty) may view the archive:

Protection against modification of archive, such as storing the data on a write once medium.
Protection against deletion of archive.
Protection against deterioration of the media on which the archive is stored, such as a requirement for data to be migrated periodically to fresh media.

5.5.4 Archive Collection

The Ztamp CA archive collection system is internal.

5.5.5 Procedures to Obtain and Verify Archive Information

To obtain and verify archive information Ztamp CA maintains records under clear hierarchical control.

The Ztamp CA retains records in electronic or in paper-based format. The Ztamp CA may require subscribers, or their agents to submit documents appropriately in support of this requirement.

Filing terms begin on the date of expiration or revocation. Such records may be retained in electronic or in paper-based format or any other format that the Ztamp CA may see fit.

5.6 Compromise and Disaster Recovery

In a separate internal document, the Ztamp CA documents applicable incident, compromise reporting and handling procedures. The Ztamp CA documents the recovery procedures used if computing resources, software, and/or data are corrupted or suspected of being corrupted.

The Ztamp CA establishes the necessary measures to ensure full recovery of the service, in an appropriate time frame depending on the type of disruption, in case of a disaster, corrupted servers, software or data.

6.0 Certificate and CRL Profiles

This section specifies the certificate format and CRL formats.

6.1 Certificate Profile

Ztamp certificate profiles are available upon request.

6.2 CRL Profile

The Ztamp CA maintains a record of the CRL profile it uses in an independent technical document. This will be made available at the discretion of the Ztamp CA, on request from parties explaining their interest.

7.0 Compliance Audit And Other Assessment

Ztamp CA accepts under condition the auditing of practices and procedures it does not publicly disclose. Ztamp CA gives further consideration and evaluates the results of such audits before possibly implementing them.

Following its own approval with regard to the scope and content, Ztamp CA accepts compliance audits to ensure it meets requirements, standards, procedures and service levels according to this CPS and accreditation schemes it publicly claims compliance with.

8.0 Other Business and Legal Matters

Certain legal conditions apply to the issuance of the Ztamp certificates under this CPS as described in this section.

8.1 Financial Responsibility

Ztamp CA maintains sufficient resources to meet its perceived obligations under this CPS. The Ztamp CA makes this service available on an “as is” basis.

8.2 Confidentiality of Business Information

Ztamp CA observes personal data privacy rules and confidentiality rules as described in the Ztamp CPS. Confidential information includes:

Any personal identifiable information on subscribers, other than that contained in a certificate.
Reason for the revocation of a certificate, other than that contained in published certificate status information.
Audit trails.
Correspondence regarding CA services.
CA private key(s).

The following items are not confidential information:

Certificate and their content.
Status of a certificate.

Ztamp CA does not release nor is it required to release any confidential information without an authenticated and justified request specifying either:

The party to whom the Ztamp CA owes a duty to keep information confidential is the party requesting such information.
A court order.

Parties requesting and receiving confidential information are granted permission on the assumption that they use it for the requested purposes, secure it from compromise, and refrain from using it or disclosing it to third parties.

8.2.1 Disclosure Conditions

Non-confidential information can be disclosed to any subscriber and relying party under the conditions below:

Only a single certificate is delivered per inquiry by subscriber or relying party.
The status of a single certificate is provided per inquiry by a subscriber or relying party.
Subscribers can consult the information the CA holds about them.

Confidential information may not be disclosed to subscribers nor does relying party. Ztamp CA properly manages the disclosure of information to the CA personnel.

To incorporate information by reference, Ztamp CA might use computer-based and text-based pointers that include URLs, etc.

8.3 Privacy of Personal Information

Ztamp CA has an internal policy for the protection of personal data of the applicant applying for an Ztamp certificate.

8.4 Intellectual Property Rights

Ztamp CA owns and reserves all intellectual property rights associated with its databases, websites, Ztamp certificates and any other publication whatsoever originating from Ztamp CA including this CPS.

The distinguished names in use across Ztamp CA, remain the sole property of Ztamp CA, which enforces these rights.

Certificates are and remain property of Ztamp CA. Ztamp CA permits the reproduction and distribution of certificates on a non-exclusive, royalty-free basis, provided that they are reproduced and distributed in full, except that certificates are not published in any publicly accessible repository or directory without the express written permission of Ztamp CA. The scope of this restriction is also intended to protect subscribers against the unauthorized re-publication of their personal data featured on a certificate.

Ztamp CA owns and reserves all intellectual property rights associated with its own products and services that it has not explicitly transferred or released to another party.

8.5 Representations and Warranties

Ztamp CA uses this CPS and a subscriber agreement to convey legal conditions of usage of Ztamp certificates to subscribers and relying parties.

Participants that may make representations and warranties include Ztamp CA, subscribers, relying parties, and any other participants as it might become necessary.

All parties of the Ztamp domain, including the Ztamp CA and subscribers warrant the integrity of their respective private key(s). If any such party suspects that a private key has been compromised they will immediately notify Ztamp CA.

8.5.1 Ztamp CA Repository and Website Conditions

Parties (including subscribers and relying parties) accessing the Ztamp CA repository and website agree with the provisions of this CPS and any other conditions of usage that Ztamp may make available. Parties demonstrate acceptance of the conditions of usage of the CPS by submitting a query with regard to the status of a digital certificate or by any way using or relying upon any such information or services provided. The Ztamp CA repositories include or contain:

Information provided as a result of the search for a digital certificate.
Information to verify the status of a Ztamp certificate.
Information published on the Ztamp CA website.
Any other services that Ztamp CA might advertise or provide through its website.
If a repository becomes aware of or suspects the compromise of a private key, it will immediately notify Ztamp CA.

The Ztamp CA maintains a certificate repository during the application period and for a minimum of two years after the expiration or revocation of a certificate.

8.5.1.1 Reliance at Own Risk

It is the sole responsibility of the parties accessing information published on the Ztamp CA repositories and website to assess and rely on information featured therein. Parties acknowledge that they have received adequate information to decide whether to rely upon any information provided in a certificate. Ztamp CA takes steps necessary to update its records and directories concerning the status of the certificates and issue warnings about. Failure to comply with the conditions of usage of the Ztamp repositories and website may result in terminating the relationship between the Ztamp CA and the party.

8.5.1.2 Accuracy of Information

Ztamp CA makes every effort to ensure that parties accessing its repositories receive accurate, updated and correct information. Ztamp CA, however, cannot accept any liability beyond the limits set in this CPS and the Ztamp CA insurance policy.

8.5.2 Information Incorporated by Reference into a Digital Certificate

Ztamp CA incorporates by reference the following information in every digital certificate it issues:

Terms and conditions of the Ztamp CA CPS.
Any other applicable certificate policy as may be stated on an issued Ztamp certificate.
The mandatory elements of the standard X.509.
Any non-mandatory but customized elements of the standard X.509.
Content of extensions and enhanced naming that are not fully expressed within a certificate.
Any other information that is indicated to be so in a field of a certificate.

8.5.3 Pointers to Incorporate by Reference

To incorporate information by reference Ztamp uses computer-based and text-based pointers. Ztamp may use URLs, OIDs, etc.

8.6 Disclaimers of Warranties

This section includes disclaimers of express warranties.

8.6.1 Limitation for Other Warranties

Ztamp CA does not warrant:

The accuracy of any unverifiable piece of information contained in certificates.
The accuracy, authenticity, completeness or fitness of any information contained in, free, test or demo certificates.

8.6.2 Exclusion of Certain Elements of Damages

In no event is Ztamp CA liable for:

Any loss of profits.
Any loss of data.
Any indirect, consequential or punitive damages arising from or in connection with the use, delivery, license, and performance or non-performance of certificates or digital signatures.
Any transactions or services offered or within the framework of this CPS.
Any other damages except for those due to reliance on the verified information in a certificate, except for information featured on, free, test or demo certificates.
Any liability incurred in any case if the error in such verified information is the result of fraud or willful misconduct of the applicant.

8.7 Indemnities

This section contains the applicable indemnities.

To the extent permitted by law, the subscriber agrees to indemnify and hold Ztamp CA harmless from any acts or omissions resulting in liability, any loss or damage, and any suits and expenses of any kind, including reasonable attorneys’ fees that Ztamp may incur as a result of:

Failure to protect the subscriber’s private key,
Use a trustworthy system as required
Taking precautions necessary to prevent the compromise, loss, disclosure, modification, or unauthorized use of the subscriber’s private key
Attend to the integrity of the managed Branded Root.

8.8 Term and Termination

This CPS remains in force until notice of the opposite is communicated by Ztamp CA on its website or repository.

Notified changes are appropriately marked by an indicated version. Following publications, changes become applicable 30 days thereafter.

8.9 Individual Notices and Communications with Participants

Ztamp CA accepts notices related to this CPS by means of digitally signed messages or in paper form. Upon receipt of a valid, digitally signed acknowledgment of receipt from Ztamp CA the sender of the notice deems its communication effective. The sender must receive such acknowledgment within twenty (20) business days, or else written notice must then be sent in paper form through a courier service that confirms delivery or via certified or registered mail, postage prepaid, return receipt requested, addressed as follows. Individuals communications made to Ztamp CA must be addressed to [email protected] or by post to the Ztamp in the address mentioned in the introduction of this document.

8.10 Amendments

Changes to this CPS are indicated by appropriate numbering.

8.11 Dispute Resolution Procedures

Before resorting to any dispute resolution mechanism including adjudication or any type of Alternative Dispute Resolution (including without exception mini-trial, arbitration, binding expert’s advice, co-operation monitoring and normal expert’s advice) parties agree to notify Ztamp CA of the dispute with a view to seek dispute resolution.

Upon receipt of a Dispute Notice, Ztamp CA convenes a Dispute Committee that advises Ztamp management on how to proceed with the dispute. The Dispute Committee convenes within twenty (20) business days from receipt of a Dispute Notice. The Dispute Committee is composed by a counsel, a member of Ztamp CA operational management and a security officer. The counsel or data protection officer chair the meeting. In its resolutions the Dispute Committee proposes a settlement to Ztamp CA executive management. Ztamp CA executive management may subsequently communicate the proposed settlement to the resting party.

8.12 Governing Law

This CPS is governed, construed and interpreted in accordance with the laws of the Republic of Singapore. This choice of law is made to ensure uniform interpretation of this CPS, regardless of the place of residence or place of use of Ztamp certificates or other products and services. The law of the Republic of Singapore apply to all Ztamp CA commercial or contractual relationships in which this CPS may apply or quoted implicitly or explicitly in relation to Ztamp CA products and services where Ztamp CA acts as a provider, supplier, beneficiary receiver or otherwise.

8.13 Compliance with Applicable Law

Ztamp CA complies with applicable laws of the Republic of Singapore.

8.14 Miscellaneous Provisions

8.14.1 Survival

The obligations and restrictions contained under section 8 Other Business and Legal Matters survive the termination of this CPS.

8.14.2 Severability

If any provision of this CPS, including limitation of liability clauses, is found to be invalid or unenforceable, the remainder of this CPS should be interpreted in such manner as to effect the original intention of the parties.

9.0 List of definitions

ACCEPT (A CERTIFICATE)

To approve of a digital certificate by a certificate applicant within a transactional framework.

ACCREDITATION

A formal declaration by an approving authority that a certain function/entity meets specific formal requirements

APPLICATION FOR A CERTIFICATE

A request sent by a certificate applicant to a CA to issue a digital certificate

APPLICATION SOFTWARE VENDOR: A developer of Internet browser software or other software that displays or uses certificates and distributes root certificates, such as KDE, Microsoft Corporation, Mozilla Corporation, Opera Software ASA, and Red Hat, Inc.

10.0 List of acronyms

CA: Certification Authority RA: Registration Authority CP: Certificate Policy

CPS: Certification Practice Statement IETF: Internet Engineering Task Force ISO: International Standards organization

ITU: International Telecommunications Union PKI: Public Key Infrastructure

RFC: Request for Comments

SSCD: Secure Signature Creation Device