Gail's DIGITAL

Enterprise Technology Stack & Vendor Relationships

Gail’s Limited is an active English private limited company (company no. 06055393), whose registered person with significant control is Bread Limited, holding more than 75% of shares and voting rights.¹ Bread Holdings Limited (company no. 07570780), incorporated on 21 March 2011, is controlled by Grain Bidco Limited, which was notified as its PSC on 5 October 2021 and holds more than 75% of its shares and voting rights and the right to appoint or remove directors.^{2, 3} The Bread Factory’s 2025 tax strategy identifies the group as including Grain Topco, Grain Midco, Grain Bidco, Bread Holdings, Bread Acquisitions, Bread Limited, Gail’s Limited, The Bread Factory, The Bertinet Bakery, Wild Thexton Gluten Free, DSV Holdings, and Bread Roll Company.⁴

Bain Capital’s September 2021 announcement states that Bread Holdings, parent of Gail’s Bakery and The Bread Factory, received an investment from Bain Capital in partnership with EBITDA Investments, backed by Henry McGovern and Steven K. Winegar; it also states that Luke Johnson would remain invested and on the board.^{5, 6} Gail’s current ownership FAQ states that no single person or business has a majority stake and identifies its executive team, Bain Capital, McWin Capital Partners, and Luke Johnson as investors/owners; public material reviewed does not disclose their current percentage holdings.⁷ This current corporate statement supersedes characterisations in earlier secondary reporting of Bain as Gail’s current “majority owner,” while preserving the documented 2021 transaction.^{8, 9, 5, 7}

The same current Gail’s page says its investors are independent businesses with their own values and ambitions.⁷ Read with Bain’s identification of the 2021 investor as Bain Capital Credit/Special Situations and the evidence below identifying the Israeli technology activity as Bain Capital Ventures activity, the reviewed sources do not establish shared technology operations, procurement, management, or a Gail’s-to-BCV capital channel.^{6, 7, 10} Common Bain branding alone does not demonstrate that BCV’s technology investments are part of Gail’s technology stack or operations.^{6, 7, 10}

Gail’s publicly listed technology stack, as catalogued by aggregator RocketReach, comprises approximately 41 tools that are predominantly of US or UK origin, including AWS/Amazon S3, Cloudflare, Nginx, Amplitude, Google Analytics/Tag Manager/Maps, Microsoft Power BI/Exchange/Office, Freshdesk/Freshworks, MailChimp, Stripe/Stripe Connect, PrestaShop, Nosto, Pusher, and Aspect Software; RocketReach’s listing identifies no Israeli-origin vendor.¹¹ This is aggregator-derived stack evidence rather than a Gail’s-confirmed procurement inventory.¹¹

Gail’s began a digital-transformation programme with UK-based Vita Mojo in 2021, according to the supplier.^{12, 13} Vita Mojo says the programme centralised point-of-sale, stock management, CRM and multi-channel management, and that Gail’s selected Vita Mojo for ecommerce and Acteol for loyalty management.¹³ The Gail’s loyalty app launched in 2023, and Vita Mojo reports that nearly one-third of customers were using it in 2024.^{12, 13} The Android app remained current on Google Play following an update dated 10 July 2026; its developer is listed as GAIL’S LIMITED, and it supports loyalty QR-code scans, order-ahead, and online shopping.¹⁴ Vita Mojo’s listed partners include Inpulse, Nory, PayPal, ApicBase, and Fourth; no direct Israeli-origin AI vendor is identified in that list.¹⁵ Battery Ventures, a Vita Mojo investor, maintains a Tel Aviv office among its global offices, but no evidence establishes an Israeli technology-provision relationship reaching Gail’s through that investment.¹⁵

For physical and operational security, Gail’s partnered with Verkada to deploy cloud-managed cameras, access control, air-quality sensors, and AI-powered video search and analytics across more than 170 UK locations, announced on 7 April 2025.^{16, 17, 18, 19, 20, 21} Verkada is a US company headquartered in San Mateo, California, founded in 2016, with no identified Israeli founding ties in the retained sources.²¹ The partnership was brokered by UK-based systems integrator Tellivue, which connected Gail’s Head of Property, Brett Parker, with Verkada; no evidence identifies Tellivue as Israeli-domiciled or as having mandated Israeli-origin technology in this engagement.^{16, 22, 23} The deployment is described as supporting security, operations, and incident investigation across the UK estate.^{16, 17, 18, 19, 20}

No public evidence identified of a Gail’s licensing, subscription, or integration relationship with Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty, Palo Alto Networks, or another Israeli-origin enterprise-security provider. No public evidence identified of systems integrators or IT-outsourcing partners for Gail’s major technology programmes beyond Tellivue.^{22, 23}

Surveillance, Biometrics & Retail Technology

Gail’s current privacy policy confirms that it operates CCTV in some bakeries and offices for crime-prevention and health-and-safety purposes.²⁴ The disclosed use is consistent with the documented Verkada rollout, but the policy does not name Verkada or specify locations, retention periods, data-access roles, or enabled analytics.^{16, 24}

The Verkada deployment includes AI-powered “search by description” video analytics, such as searching footage by the colour of a shirt or an object; announcement coverage does not describe facial recognition as part of Gail’s deployment.^{16, 17, 18, 19, 20} Verkada separately markets a “Person of Interest Only” Face Search feature, which it describes as matching only against an enrolled watchlist rather than general-population scanning.²⁵ no public evidence identified that Gail’s has activated or licensed that face-search feature.

Verkada states generically that video may be stored locally on cameras for up to 365 days, encrypted in transit to cloud services, and encrypted at rest in cloud storage; it also says support personnel require explicit support access to customer information.²⁶ These are vendor-wide statements and do not establish Gail’s retention, cloud-backup, or support-access settings.²⁶

No public evidence identified that Gail’s uses facial recognition, biometric identification, gait analysis, behavioural analytics, predictive policing, sentiment analysis, social-media monitoring, or Israeli-origin retail-surveillance products, including products from Trigo, BriefCam, AnyVision/Oosto, or Trax. No public evidence identified of Israeli-origin surveillance or biometric technology reaching Gail’s indirectly through Verkada, Tellivue, Vita Mojo, or Acteol.^{16, 22, 23, 13}

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

RocketReach’s listed stack identifies AWS/Amazon S3 and Cloudflare as Gail’s cloud-related providers; both are US-headquartered.¹¹ Gail’s privacy policy states that it collects customer account data; loyalty-account name, email address, and optional date of birth/postcode; website and app IP and usage data; recruitment data; and CCTV data.²⁴ It states that it may create anonymised data and may store or transmit personal data through third parties for operation, security, analysis, disaster recovery, and business continuity.²⁴

Gail’s states that its starting position is to keep personal data in the UK or EEA, while reserving the possibility of using third parties and facilities outside the EEA where it considers appropriate transfer safeguards available.²⁴ Its policy does not identify processors, hosting regions, data centres, Israeli subsidiaries, or Israeli jurisdictions; it therefore neither verifies Israeli processing nor rules out all third-party international transfers.²⁴ Google Play’s developer-provided disclosure says the Gail’s app may share personal information and app-information/performance data with third parties and may collect personal information, app-information/performance data, and device or other identifiers; it says data are encrypted in transit and deletion can be requested.¹⁴ The listing does not identify recipients, processing countries, or server locations.¹⁴

Verkada states that it offers processing and storage options in the United States, EU, and Australia, and identifies AWS infrastructure for cloud hosting, storage, and infrastructure-management services in those regions.^{26, 27} Its February 2026 privacy policy lists group-company or service-provider locations in Australia, Canada, selected EU countries, the UK, United States, Japan, Mexico, Singapore, South Korea, Switzerland, and Taiwan.²⁷ Neither Verkada source identifies Israel as a processing or storage location, and neither establishes which region Gail’s selected.^{26, 27}

No public evidence identified that Gail’s operates, leases, or co-locates data-centre infrastructure within Israel. No public evidence identified of Gail’s participation in Project Nimbus or a comparable Israeli government or state-backed cloud initiative. No public evidence identified that Gail’s provides, rather than consumes, cloud, data-sovereignty, or resilience services to Israeli state or military bodies. Whether Vita Mojo, Tellivue, Verkada, or Acteol route Gail’s operational or customer data through Israeli-domiciled infrastructure, subsidiaries, or personnel remains unconfirmed.^{16, 22, 12, 13, 24}

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of a contract, partnership, or service agreement between Gail’s, Bread Limited, Bread Holdings, or the Gail’s-deployed vendors identified in this audit and the Israeli Ministry of Defence, IDF, Israeli intelligence agencies, or another Israeli state-security body.^{16, 22, 13, 24}

No public evidence identified that Gail’s customer, loyalty, ordering, CCTV, or Verkada-deployment data are provided to Israeli state bodies or routed through Israeli-controlled infrastructure.^{16, 13, 24, 26, 27} no public evidence identified that Gail’s develops, sells, licenses, or maintains offensive cyber capabilities, zero-day tools, or digital weapons systems.

No public evidence identified that Gail’s-deployed commercial technology - including Verkada cameras, Vita Mojo point-of-sale, or the loyalty app - has been documented as repurposed for Israeli military, intelligence, or law-enforcement surveillance in Israel or the Occupied Palestinian Territory.^{16, 18, 12, 13} Verkada separately markets government-grade solutions, including FedRAMP authorisation and a Carahsoft GSA Schedule listing for US public-sector customers, but no evidence ties that product line to Gail’s UK retail deployment.²⁸

AI, Algorithmic & Autonomous Systems

Gail’s uses third-party retail-security video analytics in the documented Verkada deployment rather than providing AI systems itself.^{16, 18} The described deployment uses AI-powered video search and descriptive attributes, not a disclosed facial-recognition programme.^{16, 17, 18, 19, 20}

No public evidence identified that Gail’s provides AI/ML, computer vision, automated decision-support, autonomous tracking, target-generation, automated threat-detection, or autonomous systems to Israeli state, military, or security bodies. No public evidence identified that Gail’s, its app vendors, or its associated platforms trained models on, or received, civilian-population data, intercepted communications, or surveillance-derived datasets originating in Israel or the Occupied Palestinian Territory.^{16, 13, 24}

Technology Ecosystem & R&D Footprint

Gail’s says it has more than 175 bakeries across the UK; the reviewed corporate records list UK addresses and do not identify an Israeli office, subsidiary, or operating location.^{2, 7, 4} no public evidence identified of Gail’s operating an R&D centre, engineering office, innovation lab, or accelerator programme in Israel. No public evidence identified that Gail’s acquired an Israeli technology company, invested directly in an Israeli technology start-up or fund, or holds a patent, licence, or research collaboration with Technion, Hebrew University, the Weizmann Institute, or another Israeli research institution.^{7, 4}

Thomas Ralph Molnar is an active director of Gail’s Limited, Bread Holdings, Bread Acquisitions, and Bread Limited, as well as other group entities.²⁹ Luke Johnson remains an active director of Bread Holdings and Bread Acquisitions; Bain’s 2021 announcement states that he remained invested and on the board after the transaction.^{30, 6} Gail’s Limited’s current officers include Molnar, Andy Trigwell, and Nicholas John Ayerst, who was appointed director on 7 July 2025.³¹ Companies House records Ran Avidan, an Israeli national resident in Israel, as a former director of Gail’s Limited and Bread Acquisitions whose directorships ended on 5 October 2021; this establishes a discontinued historic officer relationship only, not a current controlling, ownership, technology, Israeli-state, or occupied-territory relationship.^{31, 32}

Bain Capital Ventures’ profile states that partner Ron Miasnik leads its Israel practice and that BCV invested more than US$150 million “over the past year” in Israeli companies including Dream, Grain, and Daylight, while identifying earlier investments in Armis and Redis.¹⁰ Dream’s February 2025 funding announcement identifies it as Tel Aviv-based and says Bain Capital Ventures led its US$100 million Series B; Dream describes itself as providing AI cyber-resilience products for nations and critical infrastructure.³³ This is parent-platform venture activity, not evidence of a Gail’s procurement relationship, direct Gail’s investment, Israeli state contract, or traceable transfer of Gail’s revenue to Dream or another named company.^{5, 6, 10, 33}

Bain Capital Ventures investor Ron Miasnik was also reported as a co-organiser of a December 2023 “Israel Tech Mission,” whose attendees were described as longstanding investors in the Israeli start-up ecosystem.^{34, 35} This remains parent-level contextual evidence rather than a Gail’s corporate act, and no evidence identifies a Gail’s-specific revenue flow to an Israeli surveillance, defence, cyber, AI, SIGINT, or military-technology firm.^{34, 35}

Civil Society Scrutiny & Regulatory History

Gail’s has been the target of organised protest and boycott activity since late 2023–2024, based on allegations concerning its Israeli-raised founder, Yael “Gail” Mejia, and investments by its owners or investors in Israeli technology companies.^{36, 37, 38, 39} Reporting states that Mejia no longer has financial involvement in the company.^{37, 38} A north London Gail’s branch was vandalised with red paint and graffiti reading “Boycott Gail’s, funds Israeli tech.”^{37, 40, 41} Haaretz and JTA reported protests connected with a London opening in February 2026, including protesters’ allegation that profits went to private-equity owners and investors who had invested in Israeli “war tech.”^{36, 42} Those reports present this as a protester allegation and do not supply an underlying record establishing Gail’s technology provision, an Israeli state contract, or a Gail’s-specific revenue flow to a named Israeli technology firm.^{36, 42}

Gail’s co-founder and CEO Tom Molnar publicly rejected Israel-ownership claims as “ridiculous,” stating that the company has Jewish roots but is not Israel-owned.^{43, 44} Jewish Chronicle reporting indicates Gail’s sales grew from approximately £232 million to £278 million, roughly 20%, during the period discussed in that report.³⁸ Luke Johnson, a long-standing shareholder and director, has drawn protester attention partly through his public profile; no public evidence identified of his personal investments in Israeli surveillance, cyber, AI, SIGINT, or military-technology firms such as NSO, Cellebrite, Carbyne, AnyVision/Oosto, Wiz, Palantir, Check Point, SentinelOne, Verint, or NICE.^{39, 45, 30}

Document-scoped checks of the supplied local copies of UN Human Rights Council report A/HRC/59/23 and the 2023 and 2025 OHCHR settlement-business updates found no mention of Gail’s.^{46, 47} This is document-scoped evidence only and does not establish absence of a relationship not named in those materials.^{46, 47} The BDS National Committee’s 6 December 2024 priority-target guide contained no match for “GAIL” or “Bain Capital,” a finding limited to that specific guide.⁴⁸ AFSC Investigate’s retrieved public index contained no “Gail” or “Bain” match, though this was limited to the rendered index rather than every database field.⁴⁹ The supplied checks recorded no Gail’s hit in the 2024 and 2025 Don’t Buy Into Occupation reports; live landing-page checks likewise contained no “GAIL” or “Bain” string match, which is not a full-PDF database search.^{50, 51} Who Profits’ company-search endpoint was blocked by anti-bot verification, so no live company-specific result was obtained.⁵²

No public evidence identified of a regulatory inquiry, legal challenge, export-control action, sanctions investigation, court judgment, parliamentary record, or procurement record involving Gail’s technology sales or services to Israeli state, military, intelligence, settlement, or security entities. Verkada was separately subject to a 2024 FTC enforcement action and related US Department of Justice settlement resulting in a US$2.95 million penalty and permanent injunction over alleged data-security failures and CAN-SPAM violations; the matter concerned Verkada’s general practices, not an Israel-specific nexus or Gail’s-specific data.^{53, 54}