Audit Phase: V-DIG
Audit Date: 2026-05-01
Prepared From: Verified research memo, training knowledge through April 2026
In August 2022, BWH Hotel Group announced it was making Oracle OPERA Cloud available across its entire global portfolio of properties, establishing Oracle as the group’s primary enterprise PMS vendor.1 This is a confirmed, ongoing enterprise licensing relationship covering core guest-facing and back-office hospitality functions — reservations, front desk, housekeeping, billing, and loyalty integration — representing BWH’s most consequential third-party technology dependency.
Oracle is one of two primary contractors (alongside Google) for Project Nimbus, a contract awarded in 2021 by the Israeli government valued at a minimum of $1.2 billion.15 Project Nimbus requires Oracle and Google to provide sovereign cloud compute, artificial intelligence, machine learning, and storage services to Israeli government ministries, with the contract scope explicitly including the Israeli Ministry of Defense.15 In fulfilment of this contract, Oracle subsequently established a dedicated cloud region designated il-jerusalem-1 in Israel.14 Oracle’s position as a Project Nimbus contractor is publicly confirmed and widely reported.15
Critical distinction: BWH is a commercial hospitality enterprise customer of Oracle, not a participant in Project Nimbus. Oracle’s OPERA Cloud product for EMEA hospitality clients typically operates from European cloud regions (Frankfurt, Amsterdam, and equivalent). No public evidence has been identified that BWH has specifically contracted the il-jerusalem-1 Oracle cloud region or that BWH guest and operational data is routed to or stored within Israel. The relationship is documented at the level of Oracle’s commercial enterprise hospitality platform; the extent to which BWH’s subscription revenues contribute to Oracle’s overall corporate capacity — including Project Nimbus infrastructure investment — is not publicly quantifiable.
In 2025, BWH announced AutoClerk Atlas, a next-generation cloud-native property management system developed in partnership with HotelKey.2 AutoClerk Atlas is the intended successor to BWH’s legacy on-premise AutoClerk PMS platform. HotelKey is a US-based hospitality technology company; no Israeli corporate origin, ownership, or funding structure has been identified in public records.
The legacy AutoClerk platform was implicated in a significant data exposure incident in October 2019, in which approximately 179GB of guest data — stored in an unsecured Amazon-hosted database — was found to be publicly accessible.67 Reported data included names, addresses, email addresses, phone numbers, and travel details of guests including US government and military personnel.6 This event predates the Atlas product and the HotelKey partnership; it is documented as a data security incident of record affecting BWH’s prior infrastructure generation.
Best Western GB, the UK franchise operation of BWH, migrated over 100 websites to Microsoft Azure infrastructure in a project documented in a case study published by Northdoor plc, the named systems integrator, in February 2021.45 The Northdoor case study is the only publicly documented record of a BWH–Azure deployment relationship; no evidence of a wider Azure deployment across other BWH regional operations or core reservation systems has been identified.
Microsoft launched the Israel Central Azure datacenter region in 2023.19 Microsoft holds separate contracts with Israeli government and defence bodies (including the HoloLens contract and Azure government work); these are Microsoft-corporate-level contracts, not BWH contracts. No public evidence has been identified that Best Western GB’s Azure workloads are routed to or processed in the Israel Central region; standard UK/European Azure tenants operate from European regions by default.
BWH Hotel Group announced a partnership with Mews, a cloud-native property management system vendor, for use across its international growth portfolio.3 Mews is headquartered in Amsterdam and Prague; it is a Dutch/Czech-origin company with no Israeli corporate origin identified. In 2025, Mews secured a $300 million investment round, cementing its position as a major global hospitality operating system vendor.22
A claim in prior research materials that Mews holds Israeli investment through an individual identified as “Ory Weihs” has been assessed as a mislabelled reference: the cited article concerns that individual as the founder of a different company (Odeon), not as a Mews investor. This connection is discarded as a fabricated or confused reference.
Check Point Software Technologies is an Israeli-founded cybersecurity company (founded 1993, headquartered Tel Aviv), whose co-founder Gil Shwed served in IDF signals intelligence prior to establishing the company. Check Point has documented strategic partnerships with Wiz (for integrated CNAPP and cloud network security)11 and its ThreatCloud intelligence platform is a well-established commercial product with documented military-grade intelligence lineage.
Prior research materials cited job listings on third-party aggregator sites (Shine.com, referencing Check Point at BWH properties in India) as evidence of a corporate-level deployment. Job listings on aggregator sites are not reliable evidence of corporate procurement mandates. No official BWH press release, technology partnership announcement, vendor case study, or verified trade press article confirming a corporate-level Check Point licensing or deployment agreement has been identified. This finding is retained as an unconfirmed research lead requiring direct procurement disclosure or vendor case study verification; it is not treated as a confirmed finding.
Wiz is an Israeli-founded cloud security company (founded 2020; co-founders include Assaf Rappaport, formerly of Microsoft, with prior IDF service). Wiz was acquired by Google for approximately $32 billion in 2025. Wiz holds documented strategic partnerships with Check Point11 and SentinelOne12 for cloud security integration. No public evidence of a direct BWH–Wiz licensing or deployment relationship has been identified in corporate filings, press releases, or verified trade publications.
SentinelOne is an Israeli-founded cybersecurity company (co-founded by Tomer Weingarten, with significant R&D operations in Tel Aviv). Prior research cited a Monster.com job listing in West Springfield, VA referencing SentinelOne experience as evidence of deployment at BWH. A single job listing is not evidence of a corporate procurement mandate. No official BWH announcement or verified trade press article confirming SentinelOne deployment has been identified. SentinelOne’s partnership with Wiz is documented.12 The BWH–SentinelOne connection is discarded as a confirmed finding.
Armis is an Israeli-founded IoT and operational technology security company (founded by Yevgeny Dibrov and Nadir Izrael, both with IDF backgrounds). Prior research materials constructed an inference chain: BWH deployed Amazon Echo Dot devices in guest rooms89 → Echo devices carry Bluetooth vulnerabilities documented in the Armis BlueBorne research13 → therefore BWH uses Armis. This is an inference chain, not a documented relationship. The Armis BlueBorne blog post13 does not name Best Western as a customer or deployment site. No public evidence of an Armis–BWH deployment relationship at corporate or property level has been identified. This connection is discarded.
CyberArk is an Israeli-founded identity and access management company. Prior research materials listed CyberArk as a “potential” vendor for BWH. No evidence of any BWH–CyberArk relationship has been identified. This connection is discarded.
BWH’s Chief Technology Officer is Bill Ryan (Senior Vice President and CTO), whose role and biography are published on the BWH leadership page.20 No public documentation of specific vendor mandate decisions under his leadership has been identified beyond those covered in confirmed press releases.
BriefCam is an Israeli-origin video analytics company, originally a spinout of research conducted at the Hebrew University of Jerusalem (Professor Shmuel Peleg). Canon Inc. acquired BriefCam in 2018; the company continues to operate with R&D based in Israel. BriefCam’s product suite — including Video Synopsis, Respond, and Research modules — encompasses facial recognition, appearance-similarity search, and behavioural analytics capabilities.18 These are publicly documented product capabilities, not disputed.
Prior research materials cited a Hikvision Europe regional “Success Stories” brochure17 as evidence of a BriefCam deployment at the Best Western Plus Sunset Plaza Hotel in Los Angeles, CA, reportedly using BriefCam video analytics integrated with Hikvision cameras and a Milestone Systems VMS. Hikvision Europe does distribute regional case-study PDF compilations via its portal, and BriefCam has documented integration partnerships with Milestone Systems — these background facts are consistent with the claim. However, the specific claim that the Sunset Plaza property appears in this brochure has not been independently confirmed from a second named source. Due to tool limitations in this research session, the PDF at the cited URL could not be directly reviewed. This finding is retained as a significant unconfirmed lead requiring direct document review before being treated as a verified finding. It should not be cited as confirmed without reviewing the actual Hikvision PDF document.
No second independent source — news report, NGO filing, regulatory record, data protection authority correspondence, or court filing — confirming BriefCam deployment at any BWH property has been identified.
The BWH–Mews partnership3 brings a PMS vendor whose platform supports facial recognition and biometric check-in as an integration option for hotel operators, as documented in Mews’s published product guidance.16 This is a capability that exists within the Mews product ecosystem; it is not a default deployment feature. No public evidence has been identified that BWH has activated biometric or facial recognition functionality through Mews at any property. Mews kiosks as deployed in the hospitality sector typically use document scanning and card payment authentication; mandatory biometric authentication is not a documented default configuration.
Mews’s payments and compliance infrastructure is also documented in relation to PSD2 financial regulation.17
BWH’s deployment of Amazon Echo Dot devices in guest rooms is confirmed by a 2018–2019 WBResearch article covering BWH’s AI and big data strategy.8 A technology security blog post also references BWH’s Echo deployment as an IoT risk illustration.9 Amazon Echo is a US-origin product. As noted in the preceding section, the connection between this deployment and any Israeli-origin security tool (specifically Armis) is an inference chain unsupported by documentary evidence and is discarded.
No public evidence of BWH deploying Israeli-origin predictive analytics, workforce surveillance, or social media monitoring tools has been identified. No relevant press releases, trade press coverage, vendor case studies, or NGO reports addressing this category in relation to BWH have been located.
No public evidence of Israeli-origin surveillance tools reaching BWH indirectly via managed security service providers, bundled enterprise suites, or franchise-level technology mandates has been identified, beyond the BriefCam lead (which itself requires direct document confirmation).
BWH operates Oracle OPERA Cloud as its primary global PMS platform.1 Oracle is a confirmed Project Nimbus contractor, providing sovereign cloud infrastructure to the Israeli government including the Ministry of Defense.15 Oracle has built the dedicated il-jerusalem-1 cloud region in Israel to service this contract.14
BWH’s commercial use of Oracle’s OPERA Cloud hospitality product means that BWH is a revenue-contributing customer of a company actively operating under a contract to provide cloud infrastructure to the Israeli Ministry of Defense. No public evidence has been identified that BWH guest data, reservation data, or operational data is routed to or stored in Oracle’s Israel cloud region. Oracle’s OPERA Cloud product for EMEA hospitality clients is documented as operating from European regions by default. The data residency configuration for BWH’s Oracle deployment is not publicly disclosed. This constitutes a documented structural connection (BWH → Oracle → Project Nimbus) with an unquantified but non-zero indirect financial relationship, and an unconfirmed data routing question that could not be resolved from public sources.
Best Western GB uses Microsoft Azure for web hosting of its UK estate.45 Microsoft’s Israel Central Azure region launched in 2023.19 No public evidence has been identified that BWH GB’s Azure workloads are processed in or routed through the Israel Central region. Standard UK-based Azure tenants operate from European regions (UK South, UK West, West Europe) by default, and no BWH or Northdoor disclosure indicates a departure from this default.
No public evidence has been identified that BWH operates, leases, co-locates, or otherwise maintains any data centre infrastructure within Israel.
BWH is a hospitality company and not a cloud service provider; it is therefore structurally incapable of being a direct Project Nimbus contractor. The relevance of Project Nimbus to this audit is as an indirect relationship: BWH is a downstream commercial customer of Oracle, which holds a direct Project Nimbus contract. No public evidence has been identified that BWH participates in any Israeli government cloud initiative in any direct capacity.
No public evidence identified.
No public evidence of any contract, memorandum of understanding, or service agreement between BWH Hotel Group and the Israeli Ministry of Defence, the Israel Defense Forces, the Mossad, Shin Bet, Unit 8200, or any other Israeli intelligence or security agency has been identified.
A SAM.gov solicitation record documents a US government procurement action for hotel services in Tel Aviv, Israel, on behalf of the US Embassy Branch Office (Tel Aviv), administered through the US Embassy in Jerusalem.10 This is a routine US State Department lodging procurement. The existence of this solicitation confirms that US government hotel procurement in Tel Aviv constitutes an active market; it does not confirm that BWH was awarded this contract. Research materials note that a competitor (Dan Hotels) has been associated with US Embassy accommodation in Tel Aviv in prior periods. No award notice confirming BWH as the recipient of this or any related US government lodging contract in Israel has been identified in public procurement records.
The Best Western Regency Suites Tel Aviv property exists as a confirmed BWH-branded property.9 Its role, if any, in hosting US government, military, or intelligence personnel through formal government contracts is not publicly documented beyond the existence of the SAM.gov solicitation market context.
No public evidence has been identified that any BWH commercial technology, platform, or service has been documented, reported, or confirmed as deployed for Israeli military, intelligence, or law enforcement surveillance purposes.
No public evidence identified. BWH is a hospitality company with no known cyber capability development function, weapons supply activity, or defence technology research programme.
BWH has publicly described the deployment of artificial intelligence and big data analytics tools for commercial hospitality purposes, including guest experience personalisation, room preference learning, loyalty programme analytics, and in-room voice assistant functionality via Amazon Echo Dot devices.8 These are commercial hospitality applications with no documented defence, surveillance, or intelligence dimension.
No public evidence has been identified that BWH develops, licenses, or provides any AI or machine learning capability to Israeli government ministries, military bodies, or intelligence agencies, directly or indirectly.
No public evidence has been identified that BWH contributes to, purchases, or otherwise engages with AI training datasets derived from surveillance infrastructure operating in the Occupied Palestinian Territories or within Israel.
No public evidence identified. Not applicable to a hospitality company’s known operations.
No public evidence has been identified that BWH Hotel Group operates any research and development facility, engineering office, innovation laboratory, or technology accelerator programme within Israel. BWH’s published leadership and technology function is headquartered in Phoenix, Arizona.20
AutoClerk, BWH’s in-house PMS subsidiary (now succeeded by AutoClerk Atlas), is a US-origin company. No acquisition of or strategic investment in any Israeli technology startup, software company, or venture fund by BWH Hotel Group has been identified in public filings, press releases, or verified trade press.
No public evidence of patent filings, licensing arrangements, or intellectual property agreements between BWH and Israeli universities (Technion, Hebrew University of Jerusalem, Weizmann Institute), Israeli Defence R&D bodies (MAFAT/DDR&D), or Israeli technology companies has been identified in USPTO filings, European Patent Office records, or BWH’s public disclosures.
Prior research materials referenced an internal BWH technology initiative under the name “Project Future.” No public-facing corporate document describing the vendor mandates or technology architecture of an initiative under this specific name has been independently confirmed from primary sources. Bill Ryan’s CTO biography page20 confirms his technology leadership role and ongoing modernisation mandate, but does not provide programme-level detail confirming vendor selections under any named initiative.
The UN Independent International Commission of Inquiry on the Occupied Palestinian Territory (A/HRC/56/26, May 2024)23 addressed, among other issues, the role of technology companies in the occupied territories. This report does not specifically name Best Western Hotels & Resorts in its findings related to digital infrastructure, technology provision, or business and human rights obligations. BWH is not identified as a named subject of UN human rights concern in relation to Israeli state technology relationships in this or any other UN body report identified in training data.
No investigation specifically addressing BWH’s technology relationships with the Israeli state or Israeli defence sector has been identified from: Amnesty International, Human Rights Watch, Who Profits (Israeli NGO tracking business relationships with settlements and occupation), No Tech For Apartheid, Forensic Architecture, Access Now, or comparable civil society organisations. Source classes reviewed include published reports, press releases, and open letters in training data through April 2026.
No organised BDS or divestment campaign specifically targeting BWH for its technology provision to Israeli state entities has been identified in training data. Consumer-level BDS discussion regarding BWH-branded properties in Israel (including the Tel Aviv property) exists in general public discourse, but no coordinated campaign specifically addressing digital or technology relationships between BWH and Israeli bodies has been documented.
The 2008 Dark Reading report on a historic hack of Best Western’s hotel network21 is a matter of documented cybersecurity record, unrelated to Israeli state technology relationships.
The October 2019 data exposure — 179GB of unsecured guest data from an AutoClerk-associated database accessible via Amazon S3 — was publicly reported67 and constitutes BWH’s most significant documented data security incident. No regulatory enforcement action, fine, or investigation outcome relating to this incident has been identified in public regulatory records in training data. The incident’s data scope (US government and military travel data among those exposed) is a matter of public record.
No export control action, sanctions designation, technology transfer investigation, or related regulatory proceeding involving BWH’s technology sales, software provision, or services to Israeli state entities has been identified.
https://www.bestwestern.com/en_US/about/press-media/2022-press-releases/bwh-oracle-opera.html ↩↩
https://www.bestwestern.com/en_US/about/press-media/2025-press-releases/autoclerk-atlas.html ↩
https://www.mews.com/en/press/bwh-hotels-partners-with-mews-as-it-grows-its-global-footprint ↩↩
https://www.northdoor.co.uk/about-us/case-studies/best-western-microsoft/ ↩↩
https://www.northdoor.co.uk/wp-content/uploads/2021/02/Northdoor_BestWestern_210331.pdf ↩↩
https://siliconangle.com/2019/10/21/customer-data-best-western-hotels-exposed-massive-data-breach/ ↩↩↩
https://securityboulevard.com/2019/10/best-westerns-massive-data-leak-179gb-amazon-database-open-to-all/ ↩↩
https://digitaltravel.wbresearch.com/blog/best-western-hotels-artificial-intelligence-and-big-data-travel-experience-strategy ↩↩↩
https://www.darasecurity.com/iot-devices-convenience-with-a-risk/ ↩↩↩
https://sam.gov/workspace/contract/opp/28d8972e0c964ff68842d1103faa9692/view ↩
https://www.checkpoint.com/press-releases/check-point-enters-next-level-of-strategic-partnership-with-wiz-to-deliver-integrated-cnapp-and-cloud-network-security-solution/ ↩↩
https://investors.sentinelone.com/press-releases/news-details/2023/SentinelOne-and-Wiz-Announce-Exclusive-Partnership-to-Deliver-End-to-End-Cloud-Security/default.aspx ↩↩
https://www.armis.com/blog/blueborne-cyber-threat-impacts-amazon-echo-and-google-home/ ↩↩
https://www.theguardian.com/technology/2021/oct/12/google-amazon-workers-protest-project-nimbus-israel-military-contract ↩↩↩↩
https://www.mews.com/en/blog/facial-recognition-pms ↩
https://www.briefcam.com/lp/schedule-a-demo-isc-west/ ↩
https://www.datacenters.com/microsoft-azure-israel-central ↩↩
https://www.bestwestern.com/en_US/about/leadership-team/bill-ryan.html ↩↩↩
https://www.darkreading.com/cyber-risk/best-western-hotel-chain-pwned ↩
https://www.prnewswire.com/news-releases/mews-secures-300-million-investment-to-cement-position-as-worlds-leading-hospitality-operating-system-302668120.html ↩
https://www.ohchr.org/en/hr-bodies/hrc/co-israel/index [^17b]: http://www.hikvisioneurope.com/za/portal/portal/01-Product%26%20solution%20promotion/01-Product%20Promotion/03–Successful%20Case/Oversea%20Success%20Case/Success%20Stories%20Brochure.pdf ↩
