C2PA Subscriber Certificate Agreement

This Agreement governs application, issuance, use, and revocation of C2PA claim-signing X.509 certificates (Certificates) issued by the XenLook C2PA Certification Authority (CA) operated by XenLook Inc. (CA Operator) and the subscriber organization (Subscriber).

Acceptance is required when applying via c2pa.xenlook.com. This Agreement is separate from xenlook.com Terms of Service and Privacy Policy. The legal entity is the same; the contractual purpose differs.

Subscribers must separately comply with any Generator Product Company Agreement or CPL. This Agreement does not replace those instruments.

CA certificate and RA services are offered only to organizations in the Republic of Korea (from 1 Mar 2027) and Japan (from 1 Jun 2027).

Portal UI may be available in 12 languages; legal bodies are Korean, English, and Japanese.

Model law is Republic of Korea law. Korean law and Seoul Central District Court prevail for Japan subscribers as well.

Korea production service: 1 Mar 2027 (planned). Japan production service: 1 Jun 2027 (planned).

During C2PA Trust List review and pilot, applications may be accepted with limited issuance. Schedule may change with program progress.

The CA is currently in a pre–Trust List pilot and readiness phase. Certificates are issued for technical C2PA claim-signing; automatic trust via Adobe or the C2PA Trust List is not guaranteed.

Subscriber acknowledges the pilot status and determines its own verification and disclosure policies for products and content.

Subscriber must submit accurate legal name, contact, CPL snapshot, country code, and CSR. The CSR Organization (O=) field must match the applying entity.

The CA Operator may verify identity, CPL, and policy fit under RA procedures and may approve, deny, or request further evidence. APAC applications may follow manual RA.

False or misleading information may result in denial, revocation, and audit logging.

Subscriber generates and protects claim-signing private keys. The CA never requests, receives, stores, or backs up private keys.

Subscriber is responsible for compromise, loss, or unauthorized use. Suspected compromise must be reported promptly to [email protected] for revocation.

Certificates may be used only to sign C2PA manifests within the approved CPL and product scope. Use for other entities, products, or purposes is prohibited.

The CA does not warrant content truthfulness, legality, copyright, or ethics. C2PA signing describes provenance, not quality or factual accuracy.

The CA may revoke certificates for key compromise, breach, CPL mismatch, law, or C2PA direction. Revocation is published via CRL and status APIs.

Subscriber must not sign with revoked certificates until underlying issues are resolved.

The CA, certificates, CRL, OCSP, and portal are provided AS IS. Implied warranties of merchantability and fitness are disclaimed.

Direct liability of the CA Operator is capped at fees paid for the certificate (or zero if none), excluding indirect or consequential damages to the extent permitted by law.

If the C2PA Certification Authority Agreement conflicts, the C2PA agreement and Certificate Policy may prevail.

Personal data collected in RA workflows is processed per the CA Privacy Policy (/legal/privacy).

This Agreement and CA portal services are governed by the laws of the Republic of Korea. Korean law prevails for all disputes, including subscribers in Korea and Japan, with exclusive first-instance jurisdiction at Seoul Central District Court.

Legal bodies are provided in Korean and Japanese where applicable; Korean text and law prevail if inconsistent.

The CA Operator may amend the CPS and this Agreement. Material changes will be noticed on c2pa.xenlook.com and by email. Amendments apply to new applications after notice.