Audit Phase: V-DIG Domain Audit
Subject Company: Toolstation Ltd (a Travis Perkins plc group company)
Audit Date: 2025-05-01
Toolstation has migrated its on-site product search to Google Vertex AI Search for Retail, Google Cloud’s managed AI-powered search product.12 The deployment is publicly referenced in Google Cloud’s generative AI case study library2 and reported in trade press, with stated outcomes including a reduction in zero-results search queries from approximately 2% to approximately 0.1%, and a 5.5% uplift in search-attributed revenue.18 Toolstation has appeared in Google Cloud retail marketing materials, including content relating to “Store of Tomorrow” and agentic AI concepts.219
Google Cloud (Google LLC, a subsidiary of Alphabet Inc., NASDAQ: GOOGL) is a party to Project Nimbus, a contract awarded jointly to Google and Amazon Web Services in 2021 valued at approximately $1.2 billion to provide cloud infrastructure, AI, and machine learning services to the Israeli government and military.16 The contract attracted significant public controversy; Google employees staged protests and walkouts in April 2024 over the company’s obligations under it.17 Toolstation and Travis Perkins are not parties to Project Nimbus and have no direct contractual relationship with the Israeli government through this vehicle. The relationship is structural: the Vertex AI models (PaLM/Gemini family) deployed for Toolstation’s retail search are the same product suite offered to Israeli government clients under Project Nimbus. There is no public evidence that Toolstation’s data is processed under or co-mingled with Project Nimbus tenancies.
Toolstation uses Confluent, a managed Apache Kafka service, deployed on Google Cloud, for real-time data streaming — integrating stock management systems with its website and customer-facing app.1 Confluent is a US-headquartered company (Mountain View, CA; NASDAQ: CFLT) and holds Google Cloud Technology Partner of the Year status.15 No Israeli-origin link to Confluent has been identified.
Travis Perkins Group recruitment postings have listed Check Point Firewalls as a required or preferred skill for Network Security Engineer roles.14 Check Point Software Technologies is headquartered in Tel Aviv, Israel, and was founded in 1993 by Gil Shwed, who served in Israeli military intelligence units prior to founding the company (NASDAQ: CHKP).16 The evidence basis for an active deployment is job advertisement keyword analysis, which is indicative but not conclusive. No press release, procurement record, or official Check Point reference customer listing confirming a current, active Travis Perkins Group or Toolstation contract has been independently identified. This deployment claim remains unconfirmed.
Bal Dhillon, Head of Information Security at Travis Perkins, appeared as a speaker at the Security First London 2025 conference hosted by Integrity360,14 a managed security services provider with a documented SentinelOne partnership. Conference co-appearance with a vendor’s partners does not confirm a procurement relationship. SentinelOne is headquartered in Mountain View, CA (NYSE: S), was co-founded by Tomer Weingarten and Almog Cohen — both with Israeli military backgrounds — and maintains R&D operations centred in Tel Aviv.16 No press release, official vendor case study, or procurement record confirming a current Travis Perkins Group or Toolstation SentinelOne endpoint security contract has been independently identified. This deployment claim remains unconfirmed.
The existence of “Cyber Security Analyst (CyberArk)” job postings in the Midlands region has been cited as indicative of potential CyberArk deployment within Travis Perkins Group.14 The cited source is a broad regional aggregator search result, not a Travis Perkins-specific vacancy listing. CyberArk is headquartered in Petah Tikva, Israel, with US operations in Newton, MA (NASDAQ: CYBR).16 No official CyberArk customer reference, press release, or procurement record naming Travis Perkins or Toolstation has been independently identified. This deployment claim remains unconfirmed.
Valtech is credited with building Toolstation’s mobile commerce app and digital commerce architecture, including integration with the Google Cloud backend.3 Valtech is a French-origin global digital consultancy (headquartered in Paris), acquired by Publicis Groupe in 2023. No Israeli-origin technology has been identified as mandated or deployed by Valtech specifically within its Toolstation engagement, beyond the Google Cloud platform relationship described above.
Toolstation selected Slimstock‘s Slim4 platform for inventory optimisation, deployed across its 550+ UK store estate.5 Slimstock is headquartered in Hengelo, Netherlands. No Israeli-origin link identified.
Travis Perkins Group (parent) implemented UiPath robotic process automation via partner Robiquity for credit-check and trade-account-creation workflows; the automation bot was internally named “Dave.”4 UiPath is a Romanian-origin company (NYSE: PATH), headquartered in New York. No Israeli-origin link identified.
Nasstar, a UK-based Microsoft partner, provides Microsoft Copilot-related managed services to Toolstation’s retail operations.12 Microsoft is a US company; its Azure AI and OpenAI partnership infrastructure is legally and contractually distinct from Project Nimbus (a Google/AWS vehicle). No Israeli-origin link to the Nasstar/Microsoft vector has been identified.
A Toolstation employee (Email Marketing Executive) posted a verified review on OMR Reviews citing Movable Ink for dynamic content in email marketing campaigns.20 Movable Ink is a US company headquartered in New York. No Israeli-origin link identified.
The prior intelligence memo asserts a Toolstation–Bringg delivery orchestration relationship on the basis of “sitemap data and industry reports.” Bringg is an Israeli-founded company (Tel Aviv; NASDAQ-listed US operations).16 No named publication, Bringg press release, or official customer reference confirming a Toolstation–Bringg contract has been independently identified. This claim is unconfirmed.
Toolstation partnered with TradeKart for rapid urban delivery services under its Fast Track proposition.67 TradeKart is a UK logistics company. The Fast Track delivery service is available through the Toolstation app.7 No Israeli-origin technology has been identified in this logistics partnership.
The prior intelligence memo assessed Wiz, Orca Security, and Tufin as having a “high likelihood of evaluation or pilot usage” based on co-appearance in a pension fund equity portfolio. This inference is discarded. Shared appearance in a diversified institutional equity portfolio (e.g., the NY State Common Retirement Fund) does not indicate any procurement, technology, or commercial relationship. No public evidence of Toolstation or Travis Perkins Group using any of these vendors has been identified.
AP Mitchell, a physical security installer, has documented installations of Advanced IP CCTV systems and intruder alarm systems at Travis Perkins branch locations, specifically the Oldham8 and Evesham9 sites. These installations are at Travis Perkins-branded branches; Toolstation operates as a distinct brand within the group. The AP Mitchell project portfolio pages confirm IP CCTV deployment but do not specify camera hardware manufacturer. No evidence has been identified confirming whether Hikvision (Chinese), Axis, Bosch, or any other camera brand is in use at Travis Perkins Group or Toolstation sites specifically.
Quadrant Security Group / Xtralis ADPRO remote monitoring services have been referenced in connection with Travis Perkins sites via trade publication SourceSecurity.com.10 Xtralis (ADPRO product line) is an Australian company, acquired by Honeywell in 2016. No Israeli-origin link identified in the CCTV/remote monitoring supply chain.
The prior intelligence memo asserted Toolstation is an Auror customer, citing a RetailWit article that purportedly listed Toolstation alongside Sainsbury’s and Next as Auror clients. The cited source URL resolves to content concerning Simbe Tally robots — an unrelated topic — representing an apparent citation error in the prior memo. Auror is a New Zealand–headquartered retail crime intelligence platform with a documented UK retail customer base.16 The specific claim that Toolstation is an Auror customer cannot be confirmed from any identified source. This claim is unverified.
No public evidence has been identified of Toolstation or Travis Perkins Group deploying facial recognition technology from any vendor — Israeli-origin or otherwise — for loss prevention, staff monitoring, or customer analytics purposes. Vendors including Trigo, AnyVision/Oosto, BriefCam, and Trax have been specifically checked against available trade press (Retail Technology Innovation Hub, Retail Gazette, The Grocer) and civil society reporting (Big Brother Watch, Privacy International, BFAWU). None of these sources name Toolstation or Travis Perkins as a deployment site.
Toolstation’s customer-facing mobile app employs device-native biometric authentication (Face ID / fingerprint unlock) via standard iOS and Android platform APIs.11 This is a standard consumer authentication mechanism using Apple and Google hardware biometric frameworks — not a proprietary identification or facial recognition system. The Toolstation Privacy Policy documents this feature.11 Thredd (formerly GPS) payment processing 3DS biometric documentation has been cited in this context,21 though it has not been confirmed that Thredd is Toolstation’s payment processor (versus the Thredd documentation serving as a generic industry reference). No Israeli-origin vendor is involved in the app biometric authentication layer.
No public evidence has been identified of Toolstation or Travis Perkins Group deploying Israeli-origin predictive policing tools, workforce sentiment monitoring platforms, social media monitoring systems, or employee surveillance technologies.
Toolstation’s cloud infrastructure is documented as Google Cloud Platform, with UK retail operations subject to GDPR obligations implying UK or EU region data residency as the operational default.12 No public evidence has been identified of Toolstation or Travis Perkins Group operating, leasing, or co-locating data centre infrastructure within Israel.
Project Nimbus is a direct contractual relationship between the Government of Israel and Google LLC / Amazon Web Services, awarded in 2021 and valued at approximately $1.2 billion for cloud infrastructure, AI, and machine learning services to Israeli government and military bodies.1617 Toolstation’s position relative to Project Nimbus is that of a commercial Google Cloud customer. Toolstation is not a provider, sub-contractor, or named party under Project Nimbus. The structural connection is that Vertex AI’s underlying foundation models (the Gemini/PaLM family) are the same models offered commercially to Toolstation and offered to Israeli government clients under Project Nimbus — a characteristic of Google Cloud’s multi-tenant architecture. No public evidence exists that Toolstation’s workloads are hosted in Israeli data centre regions or that Toolstation’s data is routed through or accessible within Project Nimbus tenancies.
No public evidence has been identified of Toolstation or Travis Perkins Group participating in any sovereign cloud programme, data-sharing arrangement, or digital infrastructure initiative involving the Israeli state, Israeli public sector entities, or Israeli-state-adjacent technology programmes.
No public evidence has been identified of any contract, partnership, service agreement, or documented relationship between Toolstation, Travis Perkins plc, or any Travis Perkins Group subsidiary and the Israeli Ministry of Defence, Israel Defense Forces, Mossad, Shin Bet, Unit 8200, or any other Israeli state security or intelligence body.
No public evidence has been identified of Toolstation’s commercially available products or technology being reported as procured for, adapted for, or deployed in military, intelligence, or law enforcement surveillance applications within Israel or the Occupied Palestinian Territories.
No public evidence has been identified. Toolstation is a building materials and tool retailing business with no publicly documented involvement in cybersecurity product development, offensive cyber capabilities, signals intelligence technology, or weapons systems of any kind.
Where Israeli-origin vendor deployments have been asserted (Check Point, SentinelOne, CyberArk), the founding histories of those companies include Israeli military intelligence unit connections (notably Unit 8200 alumni networks, documented for SentinelOne’s founders;16 and Shin Bet-adjacent founding for Check Point16). However, as noted in the Enterprise Technology Stack section, none of these vendor deployments has been confirmed at Toolstation or Travis Perkins Group level from primary evidence. The defence-linked founding histories are documented facts about those vendors; they cannot be attributed to Toolstation without confirmed deployment evidence.
Toolstation’s confirmed AI deployment centres on Google Vertex AI Search for Retail for product search and discovery.218 The platform applies machine learning to query understanding, product ranking, and zero-results reduction. User interaction data (search queries, click-through and conversion patterns) is processed within Google Cloud infrastructure under Google’s standard commercial terms of service.13
Toolstation appears in Google Cloud’s published “101 Real-World Generative AI Use Cases” reference library,2 placing it within Google’s public generative AI customer roster for retail. Google Cloud Summit London 2025 featured Toolstation in retail AI marketing contexts.19
There is no public evidence that Toolstation’s interaction or behavioural data is used to train models specifically designated for Israeli government or military purposes. Google’s commercial data processing terms govern Toolstation’s data under standard enterprise agreements; these are legally distinct from the data obligations under Project Nimbus. No public evidence has been identified of Toolstation data contributing to Israeli state AI systems.
No public evidence has been identified of Toolstation deploying autonomous systems, unmanned vehicle technology, drone-based logistics, or any technology with dual civilian/military autonomous capability in connection with Israeli-origin vendors or Israeli state programmes.
Travis Perkins Group’s UiPath RPA deployment (the “Dave” bot for credit and account automation)4 constitutes the group’s documented process automation footprint. UiPath is of Romanian origin with no identified Israeli-origin technology component.
The Slimstock Slim4 deployment provides algorithmic demand forecasting and inventory optimisation across the Toolstation store estate.5 Slimstock is a Dutch company; no Israeli-origin component has been identified.
No public evidence has been identified of Toolstation or Travis Perkins Group operating any research and development facility, engineering innovation centre, technology accelerator participation, or strategic partnership with universities or technology institutes within Israel.
No public evidence has been identified of Toolstation or Travis Perkins Group acquiring an Israeli-origin technology company or making a direct strategic investment in an Israeli technology startup, venture fund, or innovation vehicle. The Travis Perkins 2024 Annual Report13 and investor relations disclosures22 do not reference any such transaction.
No public evidence has been identified of patent portfolio sharing, IP licensing agreements, or co-development arrangements between Toolstation or Travis Perkins Group and Israeli-domiciled technology entities or Israeli academic research institutions.
Confirmed technology integrators are Valtech (digital commerce and app build),3 Robiquity (UiPath RPA implementation),4 and Nasstar (Microsoft Copilot managed services).12 These are, respectively, a French-origin global agency, a UK RPA implementation partner, and a UK Microsoft managed service provider. None have been identified as mandating or deploying Israeli-origin technology specifically within their Toolstation or Travis Perkins Group engagements, beyond the Google Cloud platform relationship described throughout this audit.
No public evidence has been identified of any published NGO investigation, academic study, or international body report specifically addressing Toolstation’s or Travis Perkins Group’s technology supply chain relationships with the Israeli state, Israeli-origin vendors, or operations in the Occupied Palestinian Territories. Source classes reviewed in training knowledge include: Who Profits (Israeli NGO), Stop the Wall, War on Want UK, Palestine Solidarity Campaign UK, BFAWU, the Union of Road Transport Unions (URTU), Big Brother Watch, Privacy International, and Global Witness. None have published Toolstation- or Travis Perkins-specific technology audit reports as of the training cutoff (April 2026).
No public evidence has been identified of an organised BDS campaign specifically targeting Toolstation or Travis Perkins Group on grounds of technology provision to Israeli state entities, revenue flows to Israeli-origin technology companies, or operations in Israel or the Occupied Palestinian Territories. As of training cutoff, neither Toolstation nor Travis Perkins appears as a named target in the BDS Movement’s international database or in the Palestine Solidarity Campaign UK’s corporate campaign materials.
No public evidence has been identified of regulatory inquiries, export control reviews, sanctions-related investigations, financial penalties, or legal challenges involving Toolstation’s or Travis Perkins Group’s technology procurement, vendor relationships, or commercial activities in relation to Israeli state entities or Israeli-origin technology companies.
Toolstation’s published Privacy Policy11 documents standard GDPR-compliant data handling for UK customers, including app biometric authentication (device-native only), marketing preferences, and third-party data sharing with logistics partners. No public evidence has been identified of ICO enforcement action, data breach notification, or subject access request litigation involving Toolstation’s technology vendor relationships.
No public evidence has been identified of trade union complaints, employment tribunal proceedings, or published investigative journalism concerning surveillance or monitoring of Toolstation or Travis Perkins Group workers using Israeli-origin technology tools.
https://cloud.google.com/transform/101-real-world-generative-ai-use-cases-from-industry-leaders ↩↩↩↩↩↩
https://www.valtech.com/work/toolstation-business-growth/ ↩↩↩
https://www.uipath.com/resources/automation-case-studies/travis-perkins-boosts-retail-efficiency-with-intelligent-automation ↩↩↩
https://www.slimstock.com/about-us/news/toolstation-selects-slimstock-to-improve-customer-experience/ ↩↩
https://internetretailing.net/toolstation-partners-with-tradekart-for-rapid-delivery-service/ ↩
https://www.ggpmag.com/news/toolstations-fast-track-delivery-now-available-on-app ↩↩
https://www.apmitchell.com/projects/travis-perkins-oldham-cutting-edge-ip-cctv-and-intruder-alarm-system ↩
https://www.apmitchell.com/projects/travis-perkins-evesham-installation-of-advanced-ip-cctv-system ↩
https://www.sourcesecurity.com/news/co/quadrant-security-group-limited.html ↩
https://www.travisperkinsplc.co.uk/media/uc0oz433/travis-perkins-plc-2024-annual-report.pdf ↩
https://info.integrity360.com/security-first-london-2025-cyber-security-conference-agenda ↩↩↩
https://investors.confluent.io/news-releases/news-release-details/confluent-expands-partnership-google-cloud-its-named-google ↩
https://www.theguardian.com/technology/2021/may/12/google-amazon-israel-1-billion-dollar-project-nimbus-contract-data ↩↩↩↩↩↩↩↩↩
https://www.theguardian.com/technology/2024/apr/17/google-workers-project-nimbus-israel-contract-protest ↩↩
https://www.datainsightsmarket.com/news/article/toolstation-boosts-revenue-55-with-google-cloud-search-72721 ↩↩
https://www.techzine.eu/blogs/infrastructure/132905/google-cloud-summit-london-25/ ↩↩
https://omr.com/en/reviews/product/movable-ink/pricing ↩
https://docs.thredd.com/pdf/3D_Secure_RDX-biometric_Guide_1.1.pdf ↩
https://www.travisperkinsplc.co.uk/investors/ ↩
