Audit Phase: V-DIG
Date of Completion: 2026-05-01
Analyst Note: All findings are drawn exclusively from the research memo below. Claims that could not be independently verified beyond a prior model’s assertion are explicitly flagged as UNVERIFIED (prior model only). No scores, tiers, or conclusions are assigned. Where evidence is absent, “No public evidence identified” is the stated conclusion.
Google Cloud (confirmed, strategic, ongoing)
H&M Group announced a strategic partnership with Google Cloud in July 2022 to construct a global enterprise data platform described as foundational to its “Project Future” digital transformation programme.2 The partnership was formalised via official PR Newswire press release and is referenced in H&M Group’s corporate strategy disclosures.25 Google Cloud serves as H&M’s primary enterprise data infrastructure provider, making this a core dependency rather than a peripheral integration. Google Cloud is US-headquartered but holds a central role in Israel’s Project Nimbus sovereign cloud programme (see Cloud Infrastructure section below).91011
Zeekit (confirmed historical partnership, vendor now Walmart-owned)
H&M held a commercial partnership with Zeekit, an Israeli AR/virtual try-on startup, from approximately 2018 until Walmart’s acquisition of Zeekit in May 2021.422 H&M launched a virtual dressing room feature powered by Zeekit’s body-mapping and computer vision technology in 2018.22 Following the Walmart acquisition, this vendor relationship ceased as an independent arrangement.4 This represents the most clearly documented historical engagement with an Israeli-origin technology company at the product-integration level.
The following Israeli-origin vendors were asserted by a prior model. No public source available in the research base names H&M as a customer for any of these products. They are catalogued here for completeness and to flag evidence gaps requiring direct source verification.
No public evidence identified of named systems integrators mandating or deploying Israeli-origin technology specifically for H&M. The Google Cloud partnership involves Google Professional Services in an integrator capacity by implication, but no specific third-party integrator contract has been publicly documented. The scale of dependency on Israeli-origin technology cannot be assessed for unverified vendors; the Google Cloud relationship alone is confirmed as enterprise-critical.
Zeekit (confirmed, discontinued)
H&M’s 2018 deployment of Zeekit’s virtual dressing room technology22 represents the company’s most substantiated engagement with Israeli-origin computer vision at scale. Zeekit was founded in Israel and its computer vision algorithms were publicly reported to have origins in aerial image processing. The characterisation of “battlefield topographic mapping” provenance, cited in prior analytical reports, is consistent with publicly available founder background information but should be treated as descriptive characterisation rather than a formally verified military-origin claim. The partnership ended as an independent vendor relationship following Walmart’s acquisition of Zeekit in May 2021.4 H&M does not appear to have replaced Zeekit with another Israeli-origin virtual try-on provider.
No public evidence identified of H&M using Israeli-origin predictive policing, sentiment analysis, social media monitoring, or workforce surveillance tools. The Verint claim (workforce management) noted in Section 1 remains unverified.
No public evidence identified of Israeli-origin surveillance technology reaching H&M operations indirectly through managed services or bundled enterprise suites, beyond the Google Cloud platform relationship (which may, post-acquisition, bundle components originating from Israeli-founded companies such as Wiz).
No public evidence identified that H&M Group directly operates, leases, or co-locates data centre infrastructure within Israel. H&M’s primary technology operations are Sweden-based. The Israeli franchise operation (Match Retail) may utilise locally available cloud or managed hosting services, but no specific public disclosure of data residency arrangements for Match Retail’s Israeli operations has been identified.
H&M is not a party to Project Nimbus. Project Nimbus is a contract between the Israeli government (including Israeli military and intelligence agencies) and Google Cloud and AWS, announced in 2021, valued at approximately $1.2 billion.91011 H&M is a customer of Google Cloud2 and occupies no role as a contractor, provider, or sub-contractor within the Nimbus arrangement.
The analytical inference that H&M’s Google Cloud expenditure contributes to revenue pools enabling Google’s Nimbus commitments is a structural observation about vendor economics, not a documented or contractual relationship. H&M has no verified participation in Project Nimbus or any comparable state-backed digital infrastructure programme.
Google Cloud’s Tel Aviv region was announced and launched in 2022.24 If Match Retail’s Israeli operations route workloads through the Google Cloud Tel Aviv region, data for those operations would physically reside under Israeli sovereign jurisdiction. No public disclosure confirms or denies this routing.
Microsoft has also announced Israel datacenter infrastructure.23 H&M’s use of Microsoft Azure for some workloads is consistent with training-data knowledge, but no specific Israeli-region Azure deployment by H&M has been identified in public sources.
No public evidence identified that H&M provides any services contracted for or marketed to Israeli state institutions, government ministries, or military bodies. H&M has no known government technology contracting activity in any jurisdiction.
No public evidence identified of any contract, partnership, or service agreement between H&M Group and the Israeli Ministry of Defence, Israel Defense Forces, Shin Bet, Mossad, or any Israeli intelligence body. H&M is a consumer retail company with no known defence or intelligence contracting activity in any country.
No public evidence identified of H&M technology, data infrastructure, or software being deployed for military, intelligence, or law enforcement surveillance purposes in Israel or in the occupied Palestinian territories.
The most materially relevant defence-adjacent relationship identified in the research base is indirect and flows through H&M’s Israeli franchise structure rather than H&M Group’s own technology operations.
Match Retail / Union Group franchise relationship (confirmed):
H&M Group announced a franchise agreement for Israel store openings in 2007.1 Match Retail Ltd. operates H&M stores in Israel and is publicly described as affiliated with the Union Group, an Israeli conglomerate.27 Union Tech Ventures (UTV) is described publicly as Union Group’s technology investment arm.8
UTV portfolio — Xtend (reported, requires direct source verification):
Calcalist Tech and Ynet News reported Xtend’s Series B funding rounds in 2024–2025, totalling approximately $70 million.67 Xtend is an Israeli company developing autonomous drone systems. Whether Union Tech Ventures is specifically named as an Xtend investor within those articles requires direct reading of those sources for confirmation; the research memo flags this as plausible based on Israeli financial press coverage but requiring direct source verification. A quote attributed to Tal Recanati (Managing Director, UTV) celebrating the Xtend investment, cited in prior model output, is not independently verifiable in training data and is UNVERIFIED (prior model only).
UTV portfolio — Guardio:
Guardio, a browser security company, secured $80 million in new funding as reported by CyberWire Business Briefing.17 Prior model associates Guardio with the UTV portfolio. This specific association requires direct reading of UTV’s portfolio disclosures at the UTV domain8 for confirmation.
The franchise royalty and commercial relationship between H&M Group and Match Retail creates an economic linkage between H&M’s Israeli retail revenue and the Union Group. If UTV’s portfolio includes Xtend or other dual-use technology companies, this represents an indirect economic connection — but it does not constitute a technology vendor relationship between H&M and those companies, nor does it represent H&M’s participation in defence technology development or supply.
No public evidence identified. H&M does not develop, license, or sell cybersecurity technology in any form.
A ransomware campaign attributed to the N3tw0rm group — assessed by cybersecurity researchers as Iran-nexus and linked to the Pay2Key threat actor — targeted Israeli companies including supply chain entities in 2021.516 The Acronis threat analysis5 and JNS reporting16 confirm the N3tw0rm campaign was directed at Israeli commercial entities. Prior model asserts that Match Retail was specifically named as a victim with approximately 110 GB of data leaked; specific naming of Match Retail and the stated data volume require direct verification of those source documents and are not independently confirmable from training data alone.
H&M Group’s publicly documented AI and machine learning activities are oriented entirely toward commercial retail optimisation: demand forecasting, inventory management, trend analysis, personalisation, and virtual try-on. These functions are described in H&M Group’s annual reports and strategy disclosures.325 No AI or algorithmic system operated by H&M has been identified as deployed for, contracted to, or licensed by any state, military, or law enforcement body.
No public evidence identified. H&M does not develop AI products for external licensing.
No public evidence identified of H&M AI models being trained on data derived from surveillance infrastructure, population registries, or other datasets connected to Israel or the occupied Palestinian territories.
No public evidence identified. H&M’s supply chain automation is limited to warehouse logistics and has no identified nexus to autonomous weapons, military robotics, or dual-use autonomous systems.
H&M Group’s sustainability and governance reports reference data ethics and responsible AI at a high level.13 No Israeli-specific AI governance consideration is identified in public disclosures. H&M has not been named in any enforcement action or regulatory inquiry concerning AI bias, algorithmic harm, or AI-enabled surveillance in any jurisdiction covered by training data.
No public evidence identified of H&M Group operating R&D facilities, engineering offices, innovation labs, or technology centres within Israel. H&M’s primary technology and digital operations are anchored in Stockholm, Sweden, supplemented by offices in other European cities. The Google Cloud partnership may involve access to Google engineering teams based in Israel (Google has a significant Israeli engineering presence), but this is a vendor relationship, not H&M’s own R&D footprint.
H&M has participated in Plug and Play retail and fashion accelerator programmes. Plug and Play operates programmes internationally, including in Israel. This represents a general accelerator engagement, not a specific Israeli technology investment or contractual relationship.15
No public evidence identified of patent co-development, licensing agreements, or joint IP arrangements between H&M and Israeli-domiciled entities or Israeli research institutions (including the Technion, Hebrew University, or Weizmann Institute). Source classes reviewed include USPTO, EPO, and WIPO patent databases (training data), and H&M Group corporate IP disclosures.
H&M has been listed as a target of BDS (Boycott, Divestment and Sanctions) movement campaigns.21 The documented basis for BDS targeting is H&M’s commercial retail franchise presence in Israel via Match Retail, not any identified technology relationship with the Israeli state. BDS campaign materials characterise the payment of franchise royalties from Israeli store operations to H&M Group as a form of economic normalisation with Israeli commercial structures.21
H&M Group’s public response to BDS campaigns has, per training-data knowledge, been to maintain its Israeli franchise operations without specific public commentary on BDS demands.27 No termination or suspension of the Israeli franchise has been announced as of training data cutoff.
No BDS or civil society campaign specifically focused on H&M’s technology supply chain relationships with Israeli-origin vendors has been identified in training data. Civil society scrutiny of H&M’s technology ecosystem with respect to Israel is, on current evidence, absent.
No Tech For Apartheid and allied worker campaigns targeting Project Nimbus identify Google and Amazon as the primary targets.11 H&M is not named in any of these campaign materials as a participant, enabler, or supporting customer. The structural economic relationship between Google Cloud customer spend and Google’s Nimbus revenue has not been identified as a campaigning argument directed at H&M specifically.
No reports specifically addressing H&M’s technology relationships with the Israeli state have been identified from: Amnesty Tech, Access Now, Privacy International, Human Rights Watch technology programme, Who Profits (Israeli NGO tracking corporate involvement in the occupation), or comparable civil society databases in training data.
No regulatory inquiries, legal challenges, export control actions, or sanctions-related investigations involving H&M’s technology sales, services, or data relationships with Israeli state entities have been identified. Source classes reviewed include EU regulatory databases, US Bureau of Industry and Security (BIS) and Office of Foreign Assets Control (OFAC) public records (training knowledge), and Swedish financial regulatory filings.
https://hmgroup.com/news/hm-enters-into-franchise-agreement-for-store-openings-in-israel/ ↩
https://www.prnewswire.com/news-releases/google-cloud-announces-new-partnership-with-global-fashion-retailer-301578534.html ↩↩
https://hmgroup.com/investors/reports-and-presentations/annual-reports/ ↩
https://www.reuters.com/business/retail-consumer/walmart-acquires-zeekit-virtual-dressing-room-startup-2021-05-13/ ↩↩↩↩
https://www.acronis.com/en-us/blog/posts/n3tw0rm-ransomware/ ↩↩
https://www.calcalistech.com/ctechnews/article/rjzonkx8xe ↩
https://www.ynetnews.com/business/article/r1v1kkriex ↩
https://www.theguardian.com/technology/2022/oct/12/google-amazon-workers-condemn-project-nimbus-israel-military-contract ↩↩
https://www.972mag.com/project-nimbus-google-amazon-israel-military/ ↩↩↩
https://www.wsj.com/tech/google-wiz-acquisition-cloud-security-2024 ↩
https://hmgroup.com/sustainability/sustainability-reporting/ ↩↩
https://www.just-style.com/news/hm-group-unveils-syre-to-scale-textile-to-textile-rpet-production/ ↩↩
https://hmgroup.com/sustainability/circular-and-climate-positive/innovation/co-lab/ ↩↩↩
https://www.jns.org/report-iran-likely-behind-cyber-attacks-on-israeli-supply-chain-companies/ ↩↩
https://thecyberwire.com/newsletters/business-briefing/7/47 ↩
https://staging.cyberone.security/wp-content/uploads/2023/02/Luxury-International-Fashion-Brand-Case-Study.pdf ↩↩
https://www.wiz.io/blog/unifying-cloud-risk-and-network-defense-wiz-and-checkpoint ↩
https://assets.sentinelone.com/singularity-marketplace-briefs/checkpoint-joint-sb-en ↩
https://fashionista.com/2018/09/hm-zeekit-virtual-fitting-room ↩↩↩
https://azure.microsoft.com/en-us/blog/microsoft-datacenter-expansion-in-israel/ ↩
https://cloud.google.com/blog/products/infrastructure/google-cloud-region-in-israel ↩
https://www.crunchbase.com/organization/appsflyer ↩
Training knowledge: Calcalist / Globes reporting on Match Retail / Union Group H&M franchise — no direct article URL confirmed in research memo; URL omitted per audit instructions. ↩↩
