INDEX / DIRECTORY / AGODA / DIGITAL

Agoda DIGITAL

DIGITAL INFRASTRUCTURE AUDIT UPDATED 2026-09-08
Digital Score 3.05 /10 C Agoda - Complicity Index 592
Digital 3.05

Evidence-only forensic audit. Scoring happens downstream - see the main dossier for the composite assessment.

Forensic audits like this are reader-funded - no sponsors, no ads. Support OpenIntel →

Enterprise Technology Stack & Vendor Relationships

Agoda is a verified customer of Wiz, the Israeli-founded cloud-security company acquired by Google on 11 March 2026;1 Wiz’s published customer case study confirms Agoda uses Wiz Cloud CSPM across AWS, Google Cloud, on-premises, and hybrid-cloud environments for cloud-asset inventory, full-stack visibility, risk prioritisation, dashboards and queries, deployment monitoring, vulnerability remediation, including Log4Shell response, and PCI/SOC 2 compliance support.2 The case study does not state when the relationship began, contract terms, spend, tenant-hosting region, data fields accessed, or geographic service-delivery arrangements.2 Agoda’s Chief Information Security Officer, Yaron Slutzky, is quoted saying Wiz “allowed us to consolidate and streamline our capabilities” and provided substantially better visibility.2 Slutzky’s public speaker biographies describe more than 18 years in cybersecurity, previous CISO roles including at Israeli telecom operator Cellcom, and cybersecurity-investment activity.3, 4

Wiz’s general subprocessor list identifies Wiz Cloud Ltd. in Israel as an affiliate providing technical-support, service-management, and maintenance functions, and states that Wiz services may process customer personal data submitted to Wiz.5 The same list says customers may select a tenant-hosting region, including Israel, but it does not identify Agoda’s tenant region, contracting entity, enabled Wiz features, submitted data categories, or whether Israeli personnel accessed Agoda information.5 Accordingly, the sources establish a potential Israel-affiliate processing or access pathway within Wiz’s general service architecture, but do not verify actual Agoda customer-data or operational-data exposure to Israel.2, 5

Agoda’s core infrastructure is reported as a self-built private cloud using Kubernetes/OpenStack-based orchestration, including “Fleet,” HPE servers, VAST hardware for object storage, and Akamai as a CDN vendor, supplemented selectively by AWS and Google Cloud for particular workloads.6, 7, 8, 9 No public evidence identified of direct Agoda licensing or subscription relationships with Check Point, SentinelOne, CyberArk, NICE, Verint, Claroty, or comparable Israeli-origin enterprise vendors.2, 6, 9 No public evidence identified of an Agoda systems integrator or consultancy engagement that mandates, recommends, or deploys Israeli-origin technology.6, 9

Surveillance, Biometrics & Retail Technology

No public evidence identified of Agoda use of Trigo, BriefCam, AnyVision/Oosto, Trax, or comparable Israeli-origin facial-recognition, biometric-identification, gait-analysis, behavioural-monitoring, predictive-policing, sentiment-analysis, social-media-monitoring, or workforce-surveillance technology.2, 6, 9 No public evidence identified that such tools reach Agoda indirectly through a managed-security provider, platform provider, bundled enterprise suite, or other third-party delivery channel.2, 5

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Prior reporting describes Agoda’s private-cloud footprint as four data centres: one in the United States, one in Europe, and two in Asia; it identifies the majority of Agoda’s engineering organisation as Bangkok-based and Agoda headquarters as Singapore-based.6, 7, 8 This is historical reporting, and the retrieved current materials do not provide a country-level data-centre map.6, 7, 8, 10 Booking Holdings’ FY2025 Form 10-K states that the group has hardware in hosting facilities around the world, without naming Israel, individual hosting countries, data-access jurisdictions, or permissions for Agoda’s Israeli entity.10

Agoda’s June 2026 consumer privacy policy identifies Agoda Company Pte. Ltd. in Singapore as the responsible entity and states that personal data may be transferred, stored, and maintained outside a user’s home country.11 The policy covers account and identity data, payment and booking data, itinerary and location-related data, device data, and preference or behavioural data, but does not identify Israel as a storage, routing, processing, or access location.11 Agoda’s July 2026 business-partner privacy policy likewise describes international transfers and sharing with affiliates and service providers without identifying Israel as a processing location.12 Its Korea-specific provision states that relevant personal data are directly collected and processed overseas in Singapore; this is a Korea-specific disclosure rather than a general data-residency representation.12 Singapore’s Personal Data Protection Act requires comparable protection for overseas transfers, but does not specify Agoda’s actual transfer destinations.13

No public evidence identified in the reviewed disclosures that Agoda customer identity, payment, itinerary, location, behavioural, or account data is stored, routed, processed, or made accessible from Israel.10, 11, 12 No public evidence identified in the reviewed materials confirming Israeli data residency, routing, legal accessibility, or Israel-based control over Agoda R&D and deployment pipelines.10, 11, 12, 14 The absence of Israel from Agoda’s current corporate office-location page does not establish that an Israeli entity or prior Tel Aviv office has closed.14

No public evidence identified of Agoda participation in Project Nimbus or a comparable Israeli-government cloud initiative.15, 10 No public evidence identified of Agoda providing digital-sovereignty, data-residency, infrastructure-resilience, or related cloud services to Israeli state or military institutions.10, 11, 12

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of contracts, partnerships, or service agreements between Agoda, Agoda International Israel Ltd., or Booking Holdings and the Israeli Ministry of Defence, IDF, intelligence agencies, police, or other Israeli security bodies.10, 16 No public evidence identified that Agoda’s consumer travel-platform technology has been deployed for Israeli military, intelligence, or law-enforcement surveillance applications in Israel or the Occupied Palestinian Territories.10, 17 No public evidence identified of Agoda developing, selling, licensing, or maintaining offensive cyber capabilities, zero-day exploit tools, digital weapons systems, autonomous target-generation systems, or military-tracking systems.10, 17

AI, Algorithmic & Autonomous Systems

The historical record reports that Agoda’s Tel Aviv research centre recruited data-science talent for pricing algorithms supporting Agoda’s lowest-price-guarantee product, following Priceline’s acquisition of Qlika.18, 19, 20, 21 Agoda’s 25 November 2024 Data Science material describes a company-wide team of approximately 40 working on hotel ranking, dynamic pricing, fraud detection, customer chatbots, bidding, experimentation, supply, and marketing; it states that ideas demonstrated through A/B testing go into production.22 Agoda’s current technology careers material describes global teams supporting pricing, inventory, bookings, payments, operational and analytical databases, streaming and queue systems, business intelligence, data science, fraud models, and production releases.23 These current materials do not allocate these functions to Israel or identify the locations of model training and deployment pipelines.22, 23

No public evidence identified establishing the current Israeli team’s specific control over pricing, bidding, anomaly-detection, natural-language-processing, model-training, customer-data stores, production-deployment approvals, or end-to-end model pipelines.18, 22, 16, 23 No public evidence identified that Agoda AI/ML systems have been trained on, or given access to, civilian population data, intercepted communications, or surveillance-derived datasets from Israel or the Occupied Palestinian Territories.22, 10 No public evidence identified of Agoda providing AI/ML, computer-vision, or decision-support systems to Israeli state, military, or security bodies.22, 10

Booking Holdings’ FY2025 Form 10-K separately describes group use of generative AI for internal productivity and consumer- and partner-facing functions, including AI travel assistants and price-comparison tools; the filing does not identify Israeli state, military, security, or occupied-territory customers or datasets.10

Technology Ecosystem & R&D Footprint

Booking Holdings Inc. is Agoda’s U.S. public parent, and its FY2025 Form 10-K identifies Agoda as one of the group’s five primary consumer-facing brands alongside Booking.com, Priceline, KAYAK, and OpenTable.10 The filing describes Agoda as an Asia-Pacific-focused online accommodation-reservation service headquartered in Singapore that also offers flights, ground transportation, and attractions.10 Exhibit 21 identifies Agoda Company Pte. Ltd. in Singapore and Agoda Holding Company Limited in Mauritius as wholly owned Booking Holdings subsidiaries as at 31 December 2025, but excludes subsidiaries that are not significant in aggregate; its omission of an Israeli Agoda entity therefore does not establish that none exists.24

Booking Holdings’ FY2023 country-by-country report lists Agoda International Israel Ltd. as an Israeli group entity performing “Administrative, Management or Support Services.”16 The report does not identify its systems, personnel functions, data permissions, production access, query access, model-training responsibilities, deployment responsibilities, or a standalone entity headcount; its Israel row reports 82 employees for the jurisdiction in aggregate.16 No public evidence identified establishing that personnel or systems of Agoda International Israel Ltd. have production, administrative, query, model-training, or deployment access to Agoda customer data or related data stores.16, 11, 12

Agoda, then operating under Priceline/Booking Holdings, opened a Tel Aviv “research center of excellence” reported in November 2014, initially recruiting senior data-science talent for pricing work.18 Priceline acquired Israeli ad-tech startup Qlika in March 2014 for a reported $15–20 million, and Qlika’s QTree big-data-analysis engine was reported as folded into Agoda marketing and pricing systems.19, 20, 21 Qlika’s founding team, including Omri Morgenshtern and Ittai Chorev, joined Agoda directly; Morgenshtern became Agoda CEO on 1 July 2022 and is still identified as CEO in current Booking Holdings leadership material.25, 26, 27, 28 The Tel Aviv research-centre and Qlika findings are pre-2020 evidence; current dated evidence does not establish the Tel Aviv office’s headcount, status, technical remit, or control boundaries.18, 19, 20, 21, 14

A current Glassdoor listing and Agoda’s careers material indicate or describe Agoda technology and data-science work, but do not provide dated, Israel-specific confirmation of the Tel Aviv team’s current headcount or functions.29, 22, 23 A Jerusalem Post article reports Agoda’s stated intent to increase its Israeli footprint.30 Agoda’s current corporate office-location page did not list Israel in the retrieved version, but this does not resolve the Israeli entity’s operational status.14

Morgenshtern is described as an Israeli national raised in Tel Aviv, a Tel Aviv University M.S. graduate in Physics, a Hebrew University B.S. graduate in Physics, Computer Science and Mathematics, a Talpiot programme graduate, and Qlika co-founder.25 No public evidence identified of a documented Unit 8200 affiliation for Morgenshtern specifically; Talpiot is a distinct IDF technical programme, although sources describe close recruiting ties between the programmes.25 No public evidence identified of Israeli venture-fund investments by Agoda or Booking Holdings beyond the Qlika acquisition, or of subsequent Agoda or Booking Holdings acquisitions of Israeli cyber, surveillance, military-technology, or AI firms.19, 20, 21 No public evidence identified of patent co-development, licensing, or research arrangements between Agoda and Technion, Hebrew University, or the Weizmann Institute.18, 22

Booking Holdings’ 2026 proxy, using ownership information as of 16 March 2026, identifies The Vanguard Group at 9.4% and BlackRock, Inc. at 8.2% as the only disclosed holders above 5%; it does not identify either institution as exercising operational control.31 The proxy reports that current directors and executive officers as a group beneficially owned less than 1% of common stock and identifies Robert J. Mylod Jr. as Board Chair and Glenn D. Fogel as President and CEO.31, 28 The proxy’s related-person disclosures identify purchases from directors’ outside companies including Sonatype, Delinea, EXA Infrastructure, and HPE, but do not identify an Israeli surveillance, cyber, AI, defence-technology, or military-technology vendor.31 No conclusion is drawn regarding personal or family-office investments of directors, officers, founders, or institutional shareholders, because the reviewed disclosures are not an exhaustive person-by-person investment record.31

Civil Society Scrutiny & Regulatory History

Agoda’s parent company, Booking Holdings Inc., is listed in the UN Office of the High Commissioner for Human Rights database of business enterprises involved in specified settlement activities under Human Rights Council resolution 31/36, in its 30 June 2023 iteration.15, 32 Who Profits attributes the underlying tourism-listing activity to Booking.com, a sibling brand rather than Agoda: its cited record identifies Booking.com rental-property listings in West Bank settlements, East Jerusalem settlement neighbourhoods, and the occupied Syrian Golan.33 Who Profits classifies Booking.com as a “Settlement Enterprise” providing “Services to the Settlements” in the tourism sector.33 Derivative boycott-tracking listings, including AFSC Investigate and Is-Boycott.com, attribute the settlement-listing evidence to Booking.com and name Agoda through shared-parent corporate-group attribution rather than Agoda-specific settlement listings.34, 35

SOMO, the European Legal Support Center, Al-Haq, and The Rights Forum filed a criminal complaint with Dutch prosecutors accusing Booking.com of laundering funds allegedly obtained through war crimes in the Occupied Palestinian Territory in connection with settlement-property rental revenue.36 SOMO’s 23 May 2024 publication identifies November 2023 as the filing date; 23 May 2024 is the publication date, correcting the earlier characterisation of that date as the filing date.36 A 2026 SOMO publication states that the complaint was pending in the Netherlands at publication, which is evidence of its reported procedural status rather than a finding on the allegations’ merits.37 The complaint concerns Booking.com settlement-listing activities, including properties cited in prior reporting, rather than Agoda technology provision.38, 36, 37 Booking’s reported response was that it complies with applicable law and that no applicable laws prohibit listing accommodations in Israeli settlements.38

A manual review of the preserved primary A/HRC/59/23 report corrects the earlier no-mention finding: paragraphs 70–71 expressly name Booking Holdings and Booking.com and describe Booking.com settlement-property listings and related criminal complaints.17 The report attributes the platform activity to Booking.com; it does not establish Agoda-specific settlement inventory or an Agoda security-technology deployment.17

Booking Holdings’ FY2024 and FY2025 Form 10-K filings disclose ongoing Israeli litigation unrelated to settlements: consumer-protection and competition-law class actions concerning local-tax display, parity terms, and non-refundable-booking practices.39, 10 No public evidence identified of Agoda-specific digital services provided in settlements, an Agoda-specific post-19 July 2024 technology relationship with Israeli state institutions or settlement entities, or a boycott or divestment campaign targeting Agoda specifically on technology-provision grounds.33, 34, 35, 17 No public evidence identified of export-control action, sanctions investigation, regulatory inquiry, or other regulatory action concerning Agoda technology provision to Israeli state entities.39, 10

Footnotes

  1. https://blog.google/innovation-and-ai/infrastructure-and-cloud/google-cloud/wiz-acquisition/ ↩

  2. https://www.wiz.io/customers/agoda ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7

  3. https://www.cybertechisrael.com/node/2439 ↩

  4. https://asiatechxsg.com/atxenterprise/speakers/yaron-slutzky/ ↩

  5. https://www.datocms-assets.com/75231/1704095033-wiz-subprocessor-list-december-18th-2023-website-version.pdf ↩ ↩2 ↩3 ↩4

  6. https://blog.pragmaticengineer.com/inside-agodas-private-cloud/ ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  7. https://newsletter.pragmaticengineer.com/p/inside-agodas-private-cloud ↩ ↩2 ↩3

  8. https://newsletter.pragmaticengineer.com/p/inside-agodas-private-cloud-part-2 ↩ ↩2 ↩3

  9. https://www.computerweekly.com/news/365534949/How-Agoda-is-shaping-up-to-be-a-technology-powerhouse ↩ ↩2 ↩3 ↩4

  10. https://www.sec.gov/Archives/edgar/data/1075531/000107553126000009/bkng-20251231.htm ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11 ↩12 ↩13 ↩14 ↩15 ↩16

  11. https://www.agoda.com/info/privacy.html ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  12. https://partners.agoda.com/Content/pdf/Agoda_Partner_Center_Privacy_Policy.pdf ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  13. https://sso.agc.gov.sg/Act/PDPA2012 ↩

  14. https://www.agoda.com/about-agoda/a-truly-global-company/ ↩ ↩2 ↩3 ↩4

  15. https://www.ohchr.org/sites/default/files/documents/hrbodies/hrcouncil/sessions-regular/session31/database-hrc3136/23-06-30-Update-israeli-settlement-opt-database-hrc3136.pdf ↩ ↩2

  16. https://assets.jibecdn.com/prod/workingatbooking/0.0.56/assets/Country-Report.pdf ↩ ↩2 ↩3 ↩4 ↩5

  17. https://www.ohchr.org/sites/default/files/documents/hrbodies/hrcouncil/sessions-regular/session59/advance-version/a-hrc-59-23-aev.pdf ↩ ↩2 ↩3 ↩4 ↩5

  18. https://www.timesofisrael.com/priceline-hotel-site-seeks-big-data-expertise-in-israel/ ↩ ↩2 ↩3 ↩4 ↩5

  19. https://venturebeat.com/2014/03/10/priceline-group-buys-ad-targeting-firm-qlika/ ↩ ↩2 ↩3 ↩4

  20. https://www.timesofisrael.com/priceline-snaps-up-israeli-ad-tech-start-up/ ↩ ↩2 ↩3 ↩4

  21. https://techcrunch.com/2014/03/11/priceline-buys-israels-qlika-for-15-20m-to-boost-global-expansion-with-rocket-science-powered-ad-tech ↩ ↩2 ↩3 ↩4

  22. https://careersatagoda.com/blog/meet-data-science-team-agoda/ ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7

  23. https://careersatagoda.com/department/technology/ ↩ ↩2 ↩3 ↩4

  24. https://www.sec.gov/Archives/edgar/data/1075531/000107553126000009/bkng12312510kex21.htm ↩

  25. https://en.wikipedia.org/wiki/Omri_Morgenshtern ↩ ↩2 ↩3

  26. https://www.bookingholdings.com/press-releases/omri-morgenshtern-named-chief-executive-officer-of-agoda/ ↩

  27. https://en.globes.co.il/en/article-omri-morgenshtern-appointed-agoda-ceo-1001409689 ↩

  28. https://www.bookingholdings.com/about/leadership/ ↩ ↩2

  29. https://www.glassdoor.com/Location/Agoda-Tel-Aviv-Location-EI_IE461386.0,5_IL.6,14_IC2421090.htm ↩

  30. https://www.jpost.com/Israel-News/Travel-platform-Agoda-sets-sights-on-increased-Israeli-footprint-587487 ↩

  31. https://www.sec.gov/Archives/edgar/data/1075531/000107553126000018/bkng-20260410.htm ↩ ↩2 ↩3 ↩4

  32. https://www.opensanctions.org/datasets/ps_ohchr_settlement/ ↩

  33. https://whoprofits.org/companies/company/3768?booking-com= ↩ ↩2 ↩3

  34. https://www.is-boycott.com/en/c/agoda ↩ ↩2

  35. https://investigate.afsc.org/company/booking-holdings ↩ ↩2

  36. https://www.somo.nl/booking-com-accused-of-laundering-profits-from-israeli-war-crimes-in-palestine/ ↩ ↩2 ↩3

  37. https://www.somo.nl/profiting-from-tourism-in-illegal-israeli-settlements/ ↩ ↩2

  38. https://www.justiceinfo.net/en/132249-is-booking-com-profiting-from-war-crimes-in-palestine.html ↩ ↩2

  39. https://www.sec.gov/Archives/edgar/data/1075531/000107553125000010/bkng-20241231.htm ↩ ↩2