Ahava DIGITAL

Request ID: 5aca2a67-e98a-4d76-947c-9eac8e047b76 Research date: 2026-09-30

Scope and temporal treatment

This audit concerns Ahava Dead Sea Laboratories and its regional digital services, with separately identified Fosun group activity. Fosun’s 2022 corporate account states that it completed a wholly owned acquisition of Ahava in 2016. An August 2026 report describes a China-market operating venture rather than a sale of the entire global brand; it reports that Fosun retained brand-related assets.^{1, 2}

Enterprise Technology Stack & Vendor Relationships

Israeli-origin software and services

Currently disclosed; publication date unspecified. Ahava Israel’s privacy policy lists Yotpo Ltd. for reviews, tracking and marketing, and Kaltura for tracking and marketing. Yotpo’s own disclosures identify its headquarters entity in Israel and an office in Ramat Gan. Kaltura’s 2025 Form 10-K identifies primary R&D and other functions near Tel Aviv, with 294 full-time Israeli employees at 2025-12-31.^{3, 4, 5, 6}

The Israeli policy also lists Shopify, Microsoft, Google/DoubleClick/Analytics/Tag Manager/gstatic/reCAPTCHA, TikTok, Facebook, Gorgias, Klaviyo, Nagich Accessibility, Amplitude, AWS, jQuery and Criteo. Its conditional wording describes tools the company may use; it is not a verified live-script inventory. The policy does not establish that all these suppliers are Israeli-origin.³

Currently disclosed; publication date unspecified. Ahava USA names Saywhatt as the provider of its AI Beauty Advisor and Mirage as an IT-services provider. The retrieved records establish these named relationships but do not resolve Saywhatt’s or Mirage’s legal domicile sufficiently to assign an Israeli-origin classification here.^{7, 8}

Cybersecurity-specific procurement: no public evidence identified of an Ahava licensing, subscription or implementation relationship with Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty or Palo Alto Networks.

Scale of dependency

2024 terms, still publicly accessible in September 2026. Ahava’s US and global loyalty terms connect online reward allocation to an order being marked paid in Shopify. The global terms give an effective date of 2024-03-10. This documents a transaction-linked storefront function; it does not identify enterprise-wide ERP, network-security or cloud architecture.^{9, 10}

The Israeli policy identifies Shopify’s store-management role and Yotpo’s reviews role. No public evidence identified of contract values, enterprise deployment counts, exclusivity, or critical network-security dependency.³

Procurement and integrators

Currently disclosed; publication date unspecified. The US policy describes Mirage as providing IT services, including hosting or IT maintenance/support, and processing information for those services. No public evidence identified of the supplier’s complete legal identity, a major transformation programme, or Mirage deploying a named Israeli-origin cybersecurity product at Ahava.⁷

2018 [pre-2020]; ongoing relationship unknown. Velox’s 2018-06-04 announcement states that Ahava selected LAGEENTUBES to produce its anniversary packaging using the Velox IDS 250. This is an identified intermediary relationship for digital printing, not evidence that Ahava purchased or operated a Velox printer.¹¹

Surveillance, Biometrics & Retail Technology

Facial recognition and biometrics

No public evidence identified of Ahava deploying Trigo, BriefCam, AnyVision/Oosto, Trax, gait analysis or Israeli-origin facial-recognition systems for loss prevention, checkout or store monitoring.

Currently disclosed; publication date unspecified. Ahava’s mobile-app policy states that it does not collect sensitive categories including biometric data. This is a company policy statement, not an independent biometric-system audit.¹²

Predictive analytics and monitoring

Currently disclosed; publication date unspecified. Ahava Israel lists advertising and analytics tools; Ahava USA describes Google Analytics and advertising cookies. These disclosures concern web use and marketing. They do not establish predictive policing, workforce surveillance or security-sector social-media monitoring.^{7, 3}

No public evidence identified of Israeli-origin predictive-policing, workforce-surveillance or security-monitoring tools used by Ahava.

Third-party deployment

Supplier disclosures accessible in September 2026. Yotpo lists Kaltura as a video-hosting subprocessor for Reviews and Ratings and Visual UGC. It also lists ViSenze for visual search/image recognition within Visual UGC. These are Yotpo product-level disclosures; Ahava’s enabled modules and actual use of those subprocessors are unconfirmed. No facial-recognition or biometric deployment at Ahava is established by this list.⁴

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data-centre operations in Israel

No public evidence identified that Ahava owns, leases or co-locates an Israeli data centre, or that its storefront databases occupy a specified Israeli cloud region.

Currently disclosed; publication date unspecified. Ahava Israel’s policy contemplates transfers to personnel, contractors or business partners in Israel or abroad for site operation and service delivery. It also provides for disclosure under court order or law. This documents Israel-inclusive processing and legal-disclosure conditions; it does not locate servers or establish actual state access.³

Customer-data pipeline and legal accessibility

Currently disclosed; publication date unspecified. Ahava USA describes collection of account, location, payment, communication and technical information, including interactions with its AI adviser. It permits sharing with service providers and group/affiliated companies and disclosure in response to legal process or lawful public-authority requests. No Ahava-specific storage region or documented transfer of US customer records to Israel was identified.⁷

Currently disclosed; publication date unspecified. The mobile-app policy says email/user information may be sent to Vajro and Shopify during specified login flows. Google Analytics, Firebase Analytics, Clevertap and AppsFlyer are presented as tools that may be used currently or in future. That wording does not establish current AppsFlyer procurement or routing.¹²

Supplier-level arrangements accessible in September 2026. Yotpo’s list identifies AWS in the USA as cloud/storage provider, Akamai Technologies Israel Ltd. in Israel as a CDN, and Yotpo Ltd. in Israel as headquarters. Its privacy guide discusses adequacy-based transfers to Israel. This establishes an Israeli component in the disclosed vendor ecosystem, but not which Ahava records traverse that component.^{4, 13}

Undated legacy statement; operative status unknown. Ahava’s separately accessible privacy PDF describes customer-information collection, behavioural advertising and disclosure required by law. It does not identify a server jurisdiction and is not treated as replacing the regional policies.¹⁴

Government cloud contracts

No public evidence identified of Ahava participation in Project Nimbus or another Israeli government cloud programme. Naming AWS, Google or Shopify in a retail privacy policy does not establish such participation.³

Sovereignty and resilience services

No public evidence identified of Ahava selling or contracting digital-sovereignty, sovereign-cloud, data-residency or infrastructure-resilience services to Israeli state or military bodies.

Defence, Intelligence & Security Sector Technology Relationships

Military and intelligence contracts

No public evidence identified of Ahava supplying administrative IT, communications, hosting, analytics or other digital services under a contract with the Israeli Ministry of Defence, IDF, intelligence agencies or another Israeli state security body.

Dual-use technology provision

No public evidence identified of Ahava technology being deployed for Israeli military, intelligence or law-enforcement surveillance in Israel or occupied territories.

The verified printing relationship is packaging production; the verified AI relationship is retail advice; the historical decision-support research concerns personalised skin treatment. None of these records establishes a security-sector customer or deployment.^{15, 11, 16, 17}

Offensive cyber and digital weapons

No public evidence identified of Ahava developing, selling, licensing or maintaining offensive cyber capabilities, exploit tools or digital weapons.

No public evidence identified of a purpose-built targeting or weapons-effect system requiring referral to Military.

AI, Algorithmic & Autonomous Systems

Retail AI and provision to state bodies

Currently disclosed; publication date unspecified. Ahava USA identifies a dedicated AI Beauty Advisor and says personal information supplied during interaction may be shared with Saywhatt. Saywhatt’s case-study index independently identifies an AHAVA beauty-advice use case. Its FAQ describes SAM as a conversational sales engine based on retail methodology and behavioural economics. These are retail applications; performance statements are vendor claims, not independently measured findings.^{7, 15, 8}

No public evidence identified of Ahava providing AI/ML, computer vision or autonomous decision-support systems to Israeli state, military or security bodies.

Training data and model development

No public evidence identified of Ahava AI being trained on intercepted communications, surveillance-derived information or civilian-population datasets from occupied territories.

Current supplier description; publication date unspecified. Saywhatt describes its sales-methodology basis, but this does not disclose Ahava-specific model providers, training corpora, processing countries, retention or whether shopper conversations are reused for training.¹⁵

2008–2012 [pre-2020]; project closed. European Commission records identify Ahava as coordinator of SKIN TREAT, grant 213202. The project included biological-marker analysis, bioinformatics data mining, biomarker-analysis software and a clinical treatment decision-support system. The separate results account describes personalised skin diagnosis and treatment work. These records do not establish surveillance datasets, military AI or current commercial deployment of that system.^{16, 17}

Autonomous systems and lethality

No public evidence identified of Ahava providing autonomous target generation, automated military threat detection or autonomous tracking to Israeli security forces.

Technology Ecosystem & R&D Footprint

Israeli R&D facilities

2022 corporate account; current scale unconfirmed. Fosun’s account of the new Ahava factory opening describes skincare technology R&D and visits to the Israeli Ahava and Sisram Medical teams. It reports that Fosun RZ Capital had invested in nine local startups and that Fosun had invested in 15 Israeli companies. The account does not name those nine startups or identify a dedicated Ahava software-engineering centre.¹

Currently published; publication date unspecified. Ahava’s global brand page describes its in-house laboratory on the Dead Sea shore and proprietary mineral-formulation research. This establishes company-described cosmetic R&D, not cloud, cyber or AI infrastructure.¹⁸

No public evidence identified of a separately verified Ahava cyber/AI accelerator or dedicated digital engineering office with published headcount.

Acquisitions, investments and group activity

2018 [pre-2020]; current holding and board status unknown. Fosun’s 2018-08-17 announcement says Fosun and Fosun Hani jointly announced a US$5 million investment in Israeli fintech platform The Floor, headquartered at the Tel Aviv Stock Exchange, with Fosun joining its board. The platform’s stated fields include fintech, blockchain and cyber. The announcement describes its role as bringing “Israeli technologies to Asia”; it does not name an offensive-cyber investee or an Israeli security contract.¹⁹

2018 [pre-2020]; current investment status unknown. Fosun’s publication of Guo Guangchang’s speech identifies Israeli BondIT within its fintech ecosystem and describes planned international development. This is parent-level financial-technology activity, not verified Ahava procurement or a separate personal investment by Guo.²⁰

2022; current portfolio composition unconfirmed. Fosun describes Sisram Medical’s Caesarea headquarters, Alma’s medical-aesthetic technology and proposed cooperation with Ahava. This documents group medical-technology activity, not surveillance or weaponry.¹

No public evidence identified of Ahava itself acquiring an Israeli cyber, surveillance or AI startup.

Controlling principals

2023 ownership disclosure; not a current share register. A SEC-filed Butterfly Network proxy, tracing its Fosun shareholder chain, reports ultimate holding-company interests of approximately 85.29% for Guo Guangchang and 14.71% for Wang Qunbin and identifies Guo’s control. These historical percentages are not presented as verified September 2026 ownership of Ahava.²¹

No public evidence identified in the completed searches of a specific Ahava controlling-principal personal investment in NSO, Cellebrite, Carbyne, Oosto, Wiz or another named surveillance/SIGINT firm. Current Ahava board membership and the complete set of relevant personal vehicles remain unresolved.

2026-08-08 report. Jiemian, syndicated by Eastmoney, describes Shanghai Qingdao owning 70% of a new Shanghai Ahava venture, Xingzhi Yumei 29.5714% and AHAVA 0.4286%. It attributes China-market operating scope to Yuyuan and says Fosun retained brand-related assets. A primary agreement was not obtained; these figures are reported venture interests, not percentages of the global Ahava company.²

Patents and co-development

2023 publication, with 2019 priority [pre-2020]. Patent application US20230172925A1, published 2023-06-08, names Ahava as original assignee and identifies Zeevi Maor and colleagues as inventors of skin-care compositions. The 2022 assignment record names the Israeli Ahava entity. This is cosmetic-formulation IP, not a software or surveillance patent. Database legal-status annotations were not independently verified.²²

No public evidence identified of a verified Ahava digital-IP licence or digital co-development agreement with Technion, Hebrew University or Weizmann Institute. The verified historical EU consortium’s data-analysis work is described above; its current continuation is unconfirmed.^{16, 17}

Civil Society Scrutiny & Regulatory History

NGO and UN screening

2012 [pre-2020], with a later company-response annotation. Who Profits’ Ahava report concerns settlement manufacturing, natural-resource extraction and trade. Its landing page records Ahava’s October 2024 statement that its production chain had operated from Ein Gedi since 2022. These are attributed investigation and company-response records; they do not establish digital provision to settlements.²³

2025–2026 matters described in an undated current AFSC profile. AFSC identifies Fosun as Ahava’s parent and reports inclusion of the companies in the 2025 UN settlement database. It reproduces a company response asserting relocation and denying occupied-territory extraction. The official database row and response could not be independently opened in this session. Consequently, inclusion is recorded as AFSC’s report, not as independently inspected primary UN evidence.²⁴

No public evidence identified in the successfully retrieved materials of a target-specific NGO finding establishing Ahava surveillance, Nimbus participation or state AI provision. Full inspection of A/HRC/59/23 and the latest official OHCHR entries remains an evidence gap.

Boycott and divestment campaigns

Historical [pre-2020] and later developments described by AFSC. AFSC documents campaigns concerning Ahava’s settlement/resource activity. No public evidence identified of a campaign specifically directed at Ahava’s digital technology provision. The general cosmetics boycott is not characterised as a technology boycott.²⁴

Regulatory and legal actions

No public evidence identified of an export-control action, regulatory inquiry or sanctions investigation specifically concerning Ahava technology sales or digital services to Israeli state bodies.

Post-July and post-November 2024 continuity

The currently published Ahava policies disclose retail technology and data-service relationships, but supply no contract chronology establishing uninterrupted provision across July and November 2024. The 2024 relocation statement and AFSC’s later accounts concern production/resource disputes. No public evidence identified of Ahava continuing a verified state-security technology contract after those dates.^{7, 3, 23, 24}

Digital settlement nexus

No public evidence identified of a specific Ahava digital product, platform or service supplied to a settlement institution, franchisee or public body. Historical settlement manufacturing allegations cannot establish the location of storefront servers, AI inference or customer-data processing.^{23, 24}