A taxpayer’s provision of portal and trusted identity framework services are subject to New York sales tax under Tax Law §1105(c)(8) as protective services and should be sourced based on the location where the protected data resides, but its messaging and supplier connection services are not subject to sales tax. The taxpayer’s portal and trusted identity framework services perform a gatekeeper function for customers by ensuring that only authorized users gain access to the customer’s on-line resources. Thus, the crux of these services is the security function of verifying that persons seeking access to on-line resources are authorized to have that access. These electronic gatekeeper services qualify as protective services for purposes of Tax Law §1105(c)(8) because they prevent unauthorized persons from gaining access to its customers’ confidential data. Protective services are provided in New York (i.e., “sourced” to New York) if the property being protected is located in New York. Thus, to the extent that the data being protected is located in New York (e.g., resides on servers in New York), then the taxpayer is providing a protective service in New York. If the protected data is located both inside New York and outside New York, the taxpayer should collect tax only with respect to the data located in New York. In making the determination of where its protective services are being provided, the taxpayer may rely on a letter from the customer indicating the taxing jurisdiction(s) where the protected data is located, absent a showing of fraud or knowledge on the part of the taxpayer that the contents of the letter are untrue. Such a letter must be signed by the customer (or the appropriate employee or officer) and contain a statement acknowledging that it is being furnished for the purpose of allowing the taxpayer to determine the appropriate amount of New York state and local sales and use taxes due. The taxpayer must keep the letters furnished by its customers as part of its sales tax records, and be able to associate each letter with related sales, for at least three years after the date of the last sale to which the letter relates. The customer is required to update the letter if there is a change in where the services are being provided.
However, the taxpayer’s messaging and supplier connection services are not subject to sales tax. The messaging and supplier connection services provide a central data messaging hub that routes business messages or data between business partner members of the service, who must provide their own telecommunication connections to the hub. These services are nontaxable bridging services. Thus, the taxpayer’s fees for setting up the relationship between trading partners and maintaining those relationships, as well as its mailbox set up and maintenance fees, are not taxable. In addition, the taxpayer’s charges for its mapping services are not taxable, as they constitute data processing charges.
TSB-A-16(20)S, New York Commissioner of Taxation and Finance, May 27, 2016, ¶408-782