Certificate Policy (CP) for Public API mTLS

Table of Contents

1. Introduction
2. Publication and Repository Responsibilities
3. Identification and Authentication
4. Certificate Life-Cycle Operational Requirements
5. Facility, Management, and Operational Controls
6. Technical Security Controls
7. Certificate, CRL, and OCSP Profiles
8. Compliance Audit and Other Assessments
9. Other Business and Legal Matters

1. Introduction

1.1 Overview

This Certificate Policy (CP) governs the issuance and management of X.509 client certificates by the Public API Client Certs Intermediate CA operated by Qualtrics Technologies, Inc. These certificates are used exclusively for Mutual Transport Layer Security (mTLS) authentication on the Qualtrics Public API.

The CP defines the requirements that Subscribers and Qualtrics must satisfy in relation to the lifecycle of these certificates. It establishes the rules under which the Certification Authority (CA) operates and the obligations placed on all PKI participants.

This CA is a private, non-publicly-trusted CA. Its certificate chain does not appear in any browser or operating system root store. Trust is established exclusively within Qualtrics' API infrastructure.

This document is structured in accordance with the IETF RFC 3647 framework.

1.2 Document Name and Identification

Attribute	Value
Document name	Certificate Policy — Public API Client Certificates
Applicable CA	Public Api Client Certs Intermediate Authority '{dc}.qualtrics.com'
Policy identifier	This CP is identified by URL. No certificate policy OID is asserted in issued certificates. The CP is published at https://api.qualtrics.com/93f3527791b03-certificate-policy-cp-for-public-api-m-tls.
Applicable standard	RFC 3647

1.3 PKI Participants

1.3.1 Certification Authorities

Root CA — Qualtrics Production Root CA 2019
The root of trust for this PKI. Operated by Qualtrics Internal Engineering team. Issues certificates only to Intermediate CAs. The Root CA certificate is distributed in the trust bundles of Qualtrics-managed hosts and containers.

Intermediate CA — Public Api Client Certs Intermediate Authority
Subject CN: Public Api Client Certs Intermediate Authority '{dc}.qualtrics.com'
One instance is deployed per datacenter (DC). This CA issues all certificates governed by this CP. It operates under the authority of the Qualtrics Internal Engineering team.

1.3.2 Registration Authorities

There is no separate Registration Authority (RA). The Qualtrics Public API platform performs automated validation and registration functions at the time of certificate application, acting on behalf of the CA.

1.3.3 Subscribers

Subscribers are external organizations (customers) that have been granted access to the Qualtrics Public API mTLS feature following approval by their Qualtrics Account Representative. Subscribers must hold a valid Qualtrics organizational account and must have a user with the Brand Admin role.

Each Subscriber is identified by their Qualtrics brandID (organization ID), which must appear as the Organization Name (O) field in the Subject of all certificates issued under this CP.

1.3.4 Relying Parties

The sole Relying Party is Qualtrics itself. Qualtrics Public API infrastructure — specifically the mutualtls.{dc}.qualtrics.com endpoints — validates client certificates presented during TLS handshakes before processing API requests. No external parties act as Relying Parties under this CP.

1.3.5 Other Participants

Qualtrics Account Representatives are responsible for approving customer eligibility before mTLS enablement is provisioned for a Subscriber's organization.

1.4 Certificate Usage

1.4.1 Appropriate Certificate Uses

Certificates issued under this CP are issued exclusively for:

• Mutual TLS (mTLS) client authentication to Qualtrics Public API endpoints at https://mutualtls.{dc}.qualtrics.com.

The Extended Key Usage value id-kp-clientAuth (OID 1.3.6.1.5.5.7.3.2) is asserted in all issued certificates to enforce this restriction technically.

mTLS is an additional authentication layer. It does not replace the requirement for API Token or OAuth credentials, which must still be presented on every request.

1.4.2 Prohibited Certificate Uses

Certificates issued under this CP must not be used for:

• TLS server authentication
• Code signing
• Email encryption or signing
• Any purpose other than mTLS client authentication to Qualtrics Public API endpoints
• Any endpoint other than mutualtls.{dc}.qualtrics.com

1.5 Policy Administration

1.5.1 Organization Administering the Document

Qualtrics, LLC
333 W. River Park Drive, Provo, UT 84604, USA

1.5.2 Contact Person

support@qualtrics.com or your Qualtrics account team

1.5.3 Person Determining CP Suitability for the Policy

The Qualtrics Internal Engineering team is responsible for reviewing this CP and determining its suitability. This CP must be reviewed and updated at least annually.

1.5.4 CP Approval Procedures

Changes to this CP require approval by the Qualtrics Internal Engineering team lead.

1.6 Definitions and Acronyms

Term	Definition
BrandID	Qualtrics organization identifier, also referred to as OrganizationID
CA	Certification Authority
CDP	CRL Distribution Point
CP	Certificate Policy
CPS	Certification Practice Statement
CRL	Certificate Revocation List
CSR	Certificate Signing Request (PKCS#10 format)
DC	Datacenter
EKU	Extended Key Usage
KU	Key Usage
mTLS	Mutual Transport Layer Security
PKCS#10	Public Key Cryptography Standards #10 — certificate request format
PKI	Public Key Infrastructure
RA	Registration Authority
RFC	Request for Comments
RSA	Rivest–Shamir–Adleman (asymmetric key algorithm)
SHA-256	Secure Hash Algorithm 256-bit
TLS	Transport Layer Security
Vault	HashiCorp Vault — secrets management platform used as the CA backend

2. Publication and Repository Responsibilities

2.1 Repositories

Qualtrics shall make this CP available at a publicly accessible URL: https://api.qualtrics.com/93f3527791b03-certificate-policy-cp-for-public-api-m-tls.

The accompanying Certification Practice Statement (CPS) shall be published at: https://api.qualtrics.com/a0004e731f379-certification-practice-statement-cps-for-public-api-m-tls.

The CA certificate for each DC instance of the Intermediate CA is available to authorized Qualtrics infrastructure via the internal CA management platform.

2.2 Publication of Certification Information

Qualtrics shall publish this CP and the accompanying CPS. The documents shall be versioned and dated. Previous versions shall be retained for audit purposes.

No CRL Distribution Point URL is embedded in issued end-entity certificates (see Section 4.9 and Section 7.2). The CRL is maintained by Vault at an internal endpoint accessible to Qualtrics infrastructure.

2.3 Time or Frequency of Publication

This CP shall be reviewed and updated at least annually. A new version number and date shall be applied even if no substantive changes are made.

2.4 Access Controls on Repositories

This CP is intended to be publicly readable. No access controls shall restrict a Subscriber or Relying Party from reading this document. Write access to the repository is restricted to the Internal Engineering team.

3. Identification and Authentication

3.1 Naming

3.1.1 Types of Names

End-entity certificates issued under this CP use X.501 Distinguished Names. The Subject DN must contain, at minimum:

Field	OID	Required value
Common Name (CN)	2.5.4.3	mutualtls.{dc}.qualtrics.com exactly (e.g. mutualtls.iad1.qualtrics.com)
Organization Name (O)	2.5.4.10	The Subscriber's Qualtrics brandID

No other Subject fields are required. Certificates that do not conform to this Subject DN format will be rejected at signing time by the PKI service (error MSS_1.0 / VC_0.1).

3.1.2 Need for Names to be Meaningful

The Common Name mutualtls.{dc}.qualtrics.com identifies the specific datacenter endpoint for which the certificate is valid. The Organization Name (brandID) identifies the Subscriber organization. Together they provide meaningful identity for audit and revocation purposes.

3.1.3 Anonymity or Pseudonymity of Subscribers

Not applicable. Subscribers are identified by their brandID (a Qualtrics-issued organizational identifier). Anonymity is not permitted.

3.1.4 Rules for Interpreting Various Name Forms

The CN value must match mutualtls.{dc}.qualtrics.com exactly. DC-specific values must correspond to an active Qualtrics datacenter. Wildcards are not permitted in the CN.

3.1.5 Uniqueness of Names

Each certificate is uniquely identified by its SHA-256 thumbprint, which is returned as the id field at issuance. An organization may hold up to 10 simultaneously active certificates. The same Subject DN may appear on multiple certificates for the same organization.

3.1.6 Recognition, Authentication, and Role of Trademarks

No Stipulation.

3.2 Initial Identity Validation

3.2.1 Method to Prove Possession of Private Key

The Subscriber submits a PKCS#10 Certificate Signing Request (CSR). A validly signed CSR cryptographically demonstrates possession of the private key corresponding to the public key in the request without disclosing the private key itself.

3.2.2 Authentication of Organization Identity

Subscriber identity is validated through Qualtrics' existing account authentication infrastructure:

1. API Token authentication — the request must include a valid Qualtrics X-API-TOKEN header.
2. Brand Admin role — the authenticated user must hold the Brand Admin role within their organization.
3. Organization ID match — the organizationId in the API request path must match the brand ID of the authenticated user's organization. This ensures a Subscriber can only obtain certificates for their own organization.
4. CSR Organization Name validation — the O field in the CSR must match the Subscriber's brandID.
5. CSR Common Name validation — the CN in the CSR must be exactly mutualtls.{dc}.qualtrics.com for a valid Qualtrics datacenter.

All five checks must pass before a certificate is issued. This constitutes implicit organizational identity validation via possession of valid credentials for the named organization.

3.2.3 Authentication of Individual Identity

No individual (person) identity is validated. Authentication is at the organizational level (see Section 3.2.2). The Brand Admin role requirement establishes that the requesting user has administrative authority within the organization.

3.2.4 Non-Verified Subscriber Information

No Stipulation.

3.2.5 Validation of Authority

The Brand Admin role serves as the authorization control. Only users holding this role within the correct organization are permitted to submit certificate requests.

3.2.6 Criteria for Interoperation

No Stipulation. This is a closed PKI with a single Relying Party (Qualtrics).

3.3 Identification and Authentication for Re-Key Requests

Certificate renewal and re-key follow the same procedure as initial issuance (Section 3.2). The Subscriber generates a new key pair and CSR and submits it via the same API endpoint. The existing certificate remains valid until the Subscriber explicitly deletes it. The recommended practice is to issue the new certificate, validate it, update systems to use it, then delete the old certificate.

3.4 Identification and Authentication for Revocation Requests

Revocation is performed through the certificate deletion endpoint (DELETE /API/v3/organizations/{organizationId}/clientcertificates/{certificateId}). The same Brand Admin and organization ID constraints that apply to certificate issuance apply to revocation. Only the Brand Admin of the certificate's issuing organization may revoke it. Qualtrics Internal Engineering may revoke certificates unilaterally in the event of a security incident.

4. Certificate Life-Cycle Operational Requirements

4.1 Certificate Application

A Subscriber applies for a certificate by:

1. Generating an RSA key pair locally (recommended minimum 2048-bit). The private key must never be transmitted to Qualtrics.
2. Generating a PKCS#10 CSR with:
   • O (Organization Name) set to their Qualtrics brandID.
   • CN (Common Name) set to mutualtls.{dc}.qualtrics.com for the target datacenter.
3. Submitting the CSR as a PEM-encoded string to POST /API/v3/organizations/{organizationId}/clientcertificates with a valid API token and Brand Admin authorization.

The Subscriber must contact their Qualtrics Account Representative and receive approval before making a certificate application. Enablement of the mTLS feature is a multi-step process that can take several months.

4.2 Certificate Application Processing

Upon receipt of a certificate request, the Qualtrics API platform:

1. Validates that the calling user holds the Brand Admin role.
2. Validates that the organizationId in the request path matches the authenticated user's organization.
3. Verifies that the organization does not already hold 10 active certificates.
4. Forwards the CSR to the Vault PKI signing service.
5. The PKI service validates the CSR (PKCS#10 format, CN format, O field match).
6. On validation failure, the request is rejected with error MSS_1.0 / VC_0.1.
7. On validation success, the CA signs the certificate and returns it.

This process is fully automated. No manual approval is required for individual certificate requests (subject to the initial mTLS enablement approval having been granted).

4.3 Certificate Issuance

Certificates are issued by the Vault PKI backend for the target datacenter, signed by the appropriate instance of the Intermediate CA. The certificate is returned immediately in PEM format in the API response, along with its SHA-256 thumbprint (id). Qualtrics does not issue a separate notification of issuance.

Certificate validity period: 1 year (365 days) from the time of signing.

4.4 Certificate Acceptance

There is no explicit acceptance step. The Subscriber is deemed to have accepted the certificate by saving and deploying it. The Subscriber is responsible for:

• Verifying the certificate contents (including expiry date) upon receipt.
• Protecting the private key corresponding to the certificate.
• Using the certificate only for its intended purpose.

4.5 Key Pair and Certificate Usage

The Subscriber must use the certificate and corresponding private key exclusively for mTLS client authentication to https://mutualtls.{dc}.qualtrics.com API endpoints. Any other use is prohibited (see Section 1.4.2). The certificate must not be shared between systems in a way that could expose the private key beyond the Subscriber's control.

4.6 Certificate Renewal

Subscribers are responsible for proactively renewing their certificates before expiry. Qualtrics provides a 60-day advance warning: when a certificate that will expire within 60 days is used in an API call, the response meta object will include a notice field advising the Subscriber to regenerate the certificate.

Renewal follows the same issuance process (Section 4.1). The Subscriber should:

1. Generate a new key pair and CSR.
2. Submit the new CSR and receive the new certificate.
3. Validate the new certificate against the mutualtls.{dc}.qualtrics.com endpoint (see pre-enablement validation in the mTLS setup documentation).
4. Update all systems to present the new certificate.
5. Delete the old certificate via the DELETE endpoint.

4.7 Certificate Re-Key

Certificate re-key is equivalent to renewal under this CP. The Subscriber must generate a new key pair for every new certificate. There is no mechanism for issuing a new certificate to an existing key pair.

4.8 Certificate Modification

No Stipulation. Certificate modification is not supported. To change any Subject field or key, the Subscriber must delete the existing certificate and issue a new one.

4.9 Certificate Revocation and Suspension

4.9.1 Circumstances for Revocation

A certificate must be revoked (deleted) in any of the following circumstances:

• The Subscriber's private key has been or is suspected to have been compromised.
• The certificate is no longer required (e.g. decommissioning of an integration).
• The Subscriber's Qualtrics account is closed or mTLS access is withdrawn.
• The certificate information is inaccurate.
• Qualtrics determines that revocation is required for security reasons.

4.9.2 Who Can Request Revocation

• The Subscriber's Brand Admin may delete (revoke) any certificate belonging to their organization.
• Qualtrics Internal Engineering may revoke certificates without Subscriber action in the event of a security incident or policy violation.

4.9.3 Procedure for Revocation Request

Subscribers request revocation by calling DELETE /API/v3/organizations/{organizationId}/clientcertificates/{certificateId}. Deletion is permanent and cannot be undone. Upon deletion, the certificate is added to the Vault-maintained CRL and will no longer be accepted for mTLS.

4.9.4 Revocation Request Grace Period

In the event of suspected private key compromise, the Subscriber must revoke the affected certificate immediately without delay.

4.9.5 Time Within Which CA Must Process the Revocation Request

Revocation is processed in real time. The DELETE endpoint immediately removes the certificate from the active store and updates the CRL. There is no processing delay.

4.9.6 Revocation Checking Requirements for Relying Parties

Qualtrics' API infrastructure (the Relying Party) is responsible for checking the current certificate status via the internally accessible CRL before accepting a client certificate. External parties are not Relying Parties under this CP.

4.9.7 CRL Issuance Frequency

The CRL is updated in real time upon each revocation (deletion) event. The CRL is maintained internally by HashiCorp Vault.

4.9.8 Maximum Latency for CRLs

Revocations take effect immediately upon the DELETE API call. Infrastructure propagation may introduce up to 60 minutes of latency, consistent with the propagation window for other mTLS configuration changes.

4.9.9 On-Line Revocation/Status Checking Availability

No OCSP service is provided. CRL is the only revocation mechanism.

4.9.10 On-Line Revocation Checking Requirements

No Stipulation.

4.9.11 Other Forms of Revocation Advertisements Available

No Stipulation.

4.9.12 Special Requirements Regarding Key Compromise

In the event of private key compromise, the Subscriber must notify Qualtrics immediately via their Account Representative or by contacting Qualtrics Support, and must delete the affected certificate without delay.

4.9.13 Circumstances for Suspension

Certificate suspension is not supported under this CP. Certificates may only be permanently revoked (deleted).

4.9.14 Who Can Request Suspension

Not applicable.

4.9.15 Procedure for Suspension Request

Not applicable.

4.9.16 Limits on Suspension Period

Not applicable.

4.10 Certificate Status Services

No CRL Distribution Point (CDP) extension is embedded in issued end-entity certificates (see Section 2.2 and Section 7.1). The CRL is available directly at a Vault PKI endpoint for the issuing Intermediate CA instance, accessible within Qualtrics' internal network. OCSP is not offered.

4.11 End of Subscription

When a Subscriber's mTLS access is terminated, the Subscriber must delete all active certificates. Qualtrics may delete all certificates for an organization upon account closure or withdrawal of mTLS access. Deleted certificates are permanently revoked.

4.12 Key Escrow and Recovery

No Stipulation. Subscriber private keys are generated and stored exclusively by the Subscriber. Qualtrics never has access to Subscriber private keys and provides no key escrow or recovery service.

5. Facility, Management, and Operational Controls

5.1 Physical Controls

The Vault PKI infrastructure for this CA is hosted in Qualtrics-operated datacenters. Physical access to these facilities is restricted to authorized Qualtrics personnel.

5.2 Procedural Controls

CA operations must be performed by authorized Qualtrics Internal Engineering personnel. All significant operations on the CA (creation of CA backends, signing of CA certificates, role configuration changes) must be performed by at minimum one authorized operator and must be logged.

5.3 Personnel Controls

Qualtrics Internal Engineering personnel with access to CA operations must be vetted employees subject to Qualtrics' employment screening process. Access to CA operations is limited to personnel with a business need. Access must be reviewed at least annually.

5.4 Audit Logging Procedures

Audit logging must be enabled for all CA operations including certificate issuance, revocation (deletion), and CA configuration changes. Audit log records must be retained for a minimum of 18 months and protected from unauthorized modification.

5.5 Records Archival

Records pertaining to certificate issuance and revocation must be archived for a period sufficient to support post-incident investigation and compliance review. Retention period: 18 months minimum.

5.6 Key Changeover

When the Intermediate CA certificate approaches expiry, a new CA instance must be created and its certificate signed by the Root CA before the existing one expires. The transition period must ensure continuity of service for active Subscribers.

5.7 Compromise and Disaster Recovery

In the event of compromise of the Intermediate CA private key, Qualtrics must:

1. Immediately revoke all certificates issued by the compromised CA.
2. Notify affected Subscribers.
3. Create a new Intermediate CA instance.
4. Require all Subscribers to re-issue certificates under the new CA.

Business continuity and disaster recovery procedures for the CA infrastructure are documented in the CPS.

5.8 CA Termination

If the CA is decommissioned, Qualtrics must:

1. Notify all active Subscribers with sufficient advance notice.
2. Revoke all outstanding certificates.
3. Securely destroy or archive all CA keying material in accordance with Qualtrics' key management policy.

6. Technical Security Controls

6.1 Key Pair Generation and Installation

6.1.1 Key Pair Generation

CA key pairs are generated by HashiCorp Vault during CA backend initialization. The Intermediate CA key pair is generated internally within Vault, ensuring the private key is never exported.

Subscriber key pairs must be generated by the Subscriber on their own systems. Qualtrics does not generate Subscriber key pairs. The private key must remain under the Subscriber's exclusive control and must never be transmitted to Qualtrics.

6.1.2 Private Key Delivery to Subscriber

Not applicable. Qualtrics does not generate or deliver private keys to Subscribers.

6.1.3 Public Key Delivery to Certificate Issuer

The Subscriber's public key is delivered to Qualtrics embedded in the PKCS#10 CSR submitted via the API.

6.1.4 CA Public Key Delivery to Relying Parties

The Intermediate CA certificate is available at the internal Vault endpoint. The Root CA certificate is distributed in Qualtrics' internal trust bundles.

6.1.5 Key Sizes

Key	Algorithm	Minimum size
Intermediate CA private key	RSA	2048-bit
Subscriber private key	RSA	2048-bit (recommended 4096-bit)

6.1.6 Public Key Parameters Generation and Quality Checking

Vault performs key quality validation for CA key generation. Subscriber CSR public keys are validated as part of CSR processing by the Vault PKI service.

6.1.7 Key Usage Purposes

CA key: Certificate signing and CRL signing only.
Subscriber key: Client authentication (mTLS) only — enforced by id-kp-clientAuth EKU.

6.2 Private Key Protection and Cryptographic Module Engineering Controls

6.2.1 Cryptographic Module Standards and Controls

The Intermediate CA private key is stored in HashiCorp Vault using software key storage. An HSM is not used. Vault access is protected by Qualtrics' access control policies.

6.2.2 Private Key Multi-Person Control

CA private key operations require authorized Vault credentials. Multiple authorized operators must be involved in any Vault unseal operations.

6.2.3 Private Key Escrow

The Intermediate CA private key is stored within Vault and is not escrowed to any external system. Vault backup and recovery procedures as documented in the CPS provide the only recovery mechanism.

6.2.4 Private Key Backup

Vault's configured backup mechanisms provide protection for the CA private key. The CA key is generated as internal and is not exportable outside of Vault backup procedures.

6.2.5 Private Key Archival

No Stipulation. CA keys are not separately archived outside Vault.

6.2.6 Private Key Transfer into or from a Cryptographic Module

The Intermediate CA private key is generated within Vault and is not exported. It does not leave the Vault instance.

6.2.7 Private Key Storage on Cryptographic Module

The CA private key is stored in Vault's encrypted storage backend.

6.2.8 Method of Activating Private Key

CA operations (signing) are performed by the Vault PKI service upon receipt of authorized API requests. Vault must be unsealed to perform signing operations.

6.2.9 Method of Deactivating Private Key

The Vault instance can be sealed, which prevents any CA private key operations until unsealing.

6.2.10 Method of Destroying Private Key

CA backend decommissioning must include secure deletion of all keying material from Vault storage as part of the CA Termination procedure (Section 5.8).

6.2.11 Cryptographic Module Rating

No Stipulation. No HSM is used.

6.3 Other Aspects of Key Pair Management

6.3.1 Public Key Archival

No Stipulation.

6.3.2 Certificate Operational Periods and Key Pair Usage Periods

Certificate	Validity period
Root CA	10 years (87,600h)
Intermediate CA	3 years (26,280h)
End-entity (Subscriber)	1 year (8,760h)

6.4 Activation Data

No Stipulation for end-entity certificates. CA operations require Vault authentication credentials.

6.5 Computer Security Controls

Vault infrastructure is operated within Qualtrics' hardened production environment. Access is restricted via network controls, and Qualtrics' access management policies. Specific controls are documented in the CPS.

6.6 Life Cycle Technical Controls

CA software (HashiCorp Vault) is maintained and patched in accordance with Qualtrics' security patching policies.

6.7 Network Security Controls

The CA infrastructure is accessible only within Qualtrics' internal network. No direct internet access to CA hosts is permitted.

6.8 Time-Stamping

Certificate validity periods use the system time of the Vault host at the time of signing. Qualtrics infrastructure uses NTP-synchronized time.

7. Certificate, CRL, and OCSP Profiles

7.1 Certificate Profile

All end-entity certificates issued under this CP conform to the following profile:

Field	Value
Version	X.509 v3
Serial number	Unique value assigned by Vault
Signature algorithm	SHA-256 with RSA (sha256WithRSAEncryption)
Issuer	CN=Public Api Client Certs Intermediate Authority '{dc}.qualtrics.com'
Subject CN	mutualtls.{dc}.qualtrics.com
Subject O	Subscriber's Qualtrics brandID
Validity	1 year from issuance

X.509 v3 Extensions:

Extension	Critical	Value
Key Usage	Yes	digitalSignature, keyAgreement, keyEncipherment
Extended Key Usage	No	id-kp-clientAuth (1.3.6.1.5.5.7.3.2)
Subject Key Identifier	No	Hash of the Subscriber public key
Authority Key Identifier	No	Key identifier of the signing Intermediate CA
Basic Constraints	Yes	CA:FALSE

No Certificate Policies OID extension is included. The CP is referenced by URL in this document.

No Subject Alternative Name extension is required.
No CRL Distribution Point (CDP) extension is included (see Section 7.2 of the CPS).

7.2 CRL Profile

The Intermediate CA maintains a Certificate Revocation List (CRL) within the internal CA management platform. The CRL is updated in real time upon each revocation event. It is accessible to Qualtrics' API infrastructure directly at the Vault-hosted CRL endpoint for the issuing Intermediate CA instance; this endpoint is not embedded in issued certificates via a CDP extension (see Section 2.2).

Field	Value
Version	X.509 v2 CRL
Signature algorithm	SHA-256 with RSA
Issuer	Intermediate CA DN
Update frequency	Real-time (updated on each revocation)

7.3 OCSP Profile

No Stipulation. An OCSP service is not operated for this CA.

8. Compliance Audit and Other Assessments

8.1 Frequency or Circumstances of Assessment

This CA is a private, non-publicly-trusted CA and is not subject to external audit requirements (e.g. WebTrust, CA/Browser Forum). An internal compliance review of CA operations against this CP must be conducted at least annually by the Qualtrics Internal Engineering team.

8.2 Identity/Qualifications of Assessor

Internal assessments are performed by the Qualtrics Internal Engineering team. External assessments, if required, must be performed by qualified security auditors.

8.3 Assessor's Relationship to Assessed Entity

Internal Engineering assessors are Qualtrics employees separate from the CA operations function.

8.4 Topics Covered by Assessment

Annual assessments must cover, at minimum:

• Compliance of CA operations with this CP and the CPS
• Review of access controls to the CA infrastructure
• Review of certificate issuance and revocation audit logs
• Review of Vault configuration and patch level
• Any security incidents related to the CA

8.5 Actions Taken as a Result of Deficiency

Deficiencies identified during assessment must be remediated within a timeframe commensurate with their severity. Critical deficiencies must be escalated to Qualtrics Internal Engineering leadership immediately.

8.6 Communication of Results

Assessment results are reported to the Qualtrics Internal Engineering team lead and relevant stakeholders. Significant findings are escalated to Qualtrics' information security governance function.

9. Other Business and Legal Matters

9.1 Fees

See existing agreement between Qualtrics and Subscriber.

9.2 Financial Responsibility

See existing agreement between Qualtrics and Subscriber.

9.3 Confidentiality of Business Information

Information submitted in CSRs (including the organization name/brandID) is treated as Subscriber data. Qualtrics does not disclose this information to third parties.

9.4 Privacy of Personal Information

No personal data is required in certificate Subject fields. The Organization Name field (O) contains an organizational identifier (brandID), not a natural person's name.

9.5 Intellectual Property Rights

See existing agreement between Qualtrics and Subscriber.

9.6 Representations and Warranties

Qualtrics obligations:

• Certificates issued under this CP conform to the certificate profile specified in Section 7.1.
• The CA will operate in accordance with the CPS.
• Revocation services will be available to Qualtrics' own infrastructure.

Subscriber obligations:

• All information provided in the CSR is accurate.
• The Subscriber holds the Brand Admin role and is authorized to request certificates for the named organization.
• The private key is generated by the Subscriber on secure systems and is kept confidential.
• The certificate will be used only for the purposes specified in Section 1.4.1.
• Any certificate whose corresponding private key is compromised must be promptly revoked.

9.7 Disclaimers of Warranties

See existing agreement between Qualtrics and Subscriber.

9.8 Limitations of Liability

See existing agreement between Qualtrics and Subscriber.

9.9 Indemnities

See existing agreement between Qualtrics and Subscriber.

9.10 Term and Termination

This CP takes effect upon publication and remains in effect until superseded by a subsequent version or formally withdrawn. Withdrawal of this CP will be accompanied by decommissioning of the CA per Section 5.8.

9.11 Individual Notices and Communications with Participants

Notices to Subscribers regarding material changes to this CP or the CPS are provided through Qualtrics customer communication channels or via the Subscriber's Account Representative.

9.12 Amendments

Qualtrics may amend this CP at any time. Amendments are effective upon publication of the new version. The version number and date in the document header are updated on each revision.

9.13 Dispute Resolution Provisions

See existing agreement between Qualtrics and Subscriber.

9.14 Governing Law

See existing agreement between Qualtrics and Subscriber.

9.15 Compliance with Applicable Law

See existing agreement between Qualtrics and Subscriber.

9.16 Miscellaneous Provisions

No Stipulation.

9.17 Other Provisions

No Stipulation.