Digital Audit: HiBob

Domain Audit: HiBob - Digital Audit

Enterprise Technology Stack & Vendor Relationships

HiBob’s own published sub-processor disclosure does not name Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty, or Palo Alto Networks as licensing or subscription vendors; No public evidence identified of any such relationship. The current sub-processor list instead names Cloudinary Ltd. (Israel-domiciled, image/media processing) and Descope Technologies Israel (2022) Ltd. (Israel-domiciled, identity/SSO/authentication) as active vendors ¹. Cloudinary was founded in 2012 in Petah Tikva, Israel, and now maintains a US headquarters alongside an Israel office ². Descope was founded in April 2022 by an eight-person Israeli team that had previously built Demisto, a SOAR company acquired by Palo Alto Networks in 2019 for $560 million, and Descope maintains a Tel Aviv office ³. A prior case study names Dig Security, an Israeli (Tel Aviv-founded, 2021) cloud data-security-posture-management startup, as the provider of HiBob’s cloud data-visibility and scanning capability ⁴. Dig Security was subsequently acquired by Palo Alto Networks, with the acquisition announced October 31, 2023 ⁵ and completed December 5, 2023, folding the technology into Palo Alto’s Prisma Cloud platform ⁶; no evidence was found confirming whether HiBob’s direct relationship with the Dig product continued after this acquisition. HiBob’s primary cloud and network-security infrastructure vendors are AWS and Cloudflare ⁷¹. No public evidence identified of named systems integrators or IT-transformation consultancies engaged by HiBob for major technology programmes.

Surveillance, Biometrics & Retail Technology

No public evidence identified of HiBob’s use of facial recognition, biometric identification, gait analysis, or products from Trigo, BriefCam, AnyVision/Oosto, or Trax; HiBob is a B2B HR SaaS platform with no retail or physical-security product line identified in any source reviewed. No public evidence identified of predictive-policing tools, sentiment-analysis surveillance products, social-media monitoring tools, or third-party workforce-surveillance technology procurement beyond HiBob’s own marketed people-analytics features, which are the company’s own HR product rather than a third-party surveillance capability. No public evidence identified of indirect delivery of biometric or surveillance technology via bundled third-party suites.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

HiBob does not appear to operate its own data-centre infrastructure in Israel; production customer data is hosted on AWS in Ireland as the primary region, with AWS Frankfurt, Germany, serving as the disaster-recovery location ⁴⁸⁷. However, HiBob’s corporate and legal structure is Israeli: the parent entity, Hi Bob Ltd., is incorporated and headquartered in Tel Aviv per the company’s own sub-processor/subsidiary disclosure and corporate-registry data ¹⁹. A secondary analytical source states that for European customer contracts, the contracting entity is the Israel-incorporated Hi Bob Ltd. rather than a US or EU subsidiary, meaning EU customer data flows into a relationship governed by Israeli corporate law - permitted under the EU’s adequacy decision for Israel (Commission Decision 2011/61/EU) without requiring Standard Contractual Clauses ⁸. The same source states that, as an Israeli (non-US) entity, Hi Bob Ltd. is not directly subject to US CLOUD Act compulsion, while flagging Israeli domestic intelligence bodies (Shin Bet, Unit 8200) as a theoretical access vector under Israeli law, and noting that EU adequacy decisions are subject to periodic review ⁸. No public evidence identified of HiBob participation in Project Nimbus or any comparable Israeli government-backed cloud or AI infrastructure programme. No public evidence identified of HiBob marketing or contracting data-sovereignty or resilience services to Israeli state institutions or military bodies; HiBob is a tenant/customer of AWS infrastructure, not a sovereign-cloud provider.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of contracts between HiBob and the Israeli Ministry of Defence, the IDF, or Israeli intelligence agencies for HR, IT, or any other services. No public evidence identified of HiBob’s commercial HR software being repurposed for military, intelligence, or law-enforcement surveillance applications in Israel or the occupied territories. No public evidence identified of HiBob developing, selling, or licensing offensive cyber capabilities, zero-day tools, or digital weapons systems. On adjacent, non-technology-provision grounds: HiBob CEO Ronni Zehavi sits on the executive committee of the IDF Disabled Veterans Organization (Beit Halochem), and spoke publicly in November 2025 about HiBob funding a “Beit HaLochem 2.0” rehabilitation center in Tel Aviv and a storytelling platform for wounded veterans, stating that high-tech professionals have a “moral duty” to support them ¹⁰. HiBob also granted 1,800 stock options across 47 employees who served 30 or more days of IDF reserve duty during the post-October 7, 2023 conflict, with Zehavi describing reserve duty as “a cornerstone of Israel’s strength” ¹¹¹²; this is an internal compensation policy for HiBob’s own Israel-based employees rather than a technology-provision relationship with Israeli security bodies.

AI, Algorithmic & Autonomous Systems

HiBob’s AI product (“AiMind”) uses AWS Bedrock foundation models via retrieval-augmented generation over customers’ own internal HR documents, per HiBob’s own engineering blog - a general-purpose enterprise AI assistant for HR document Q&A, with no evidence it is provided to any state or military body ¹³. HiBob’s sub-processor list additionally names OpenAI, L.L.C. and Microsoft Corporation (Azure OpenAI) as optional AI sub-processors supporting its generative-AI features ¹. No public evidence identified of HiBob providing AI or ML systems to Israeli state, military, or security bodies. No public evidence identified that HiBob’s AI models were trained on, or given access to, civilian population data, intercepted communications, or surveillance-derived datasets from Israel or the occupied territories. No public evidence identified of HiBob providing autonomous targeting, threat-detection, or tracking systems to Israeli military or security forces.

Technology Ecosystem & R&D Footprint

HiBob’s primary R&D centre and company origin is Tel Aviv, Israel - the company was founded there in 2015 by Ronni Zehavi, Amit Knaani, Israel David, and Andy Bellass, with Tel Aviv described as the birthplace of the “Bob” platform and the company’s primary R&D centre ¹⁴¹⁵¹⁶. The company’s registered legal headquarters and incorporation remain in Tel Aviv per corporate-registry data and HiBob’s own sub-processor disclosure ⁹¹. HiBob has made acquisitions of Pento, a UK-based payroll-automation company, and Mosaic, a US-based FP&A platform acquired for approximately $35 million in a deal signed February 2025 ¹⁷¹⁸; No public evidence identified of HiBob acquiring an Israeli-origin technology company to date. No public evidence identified of a formal HiBob venture-investment arm making strategic investments into Israeli startups or VC funds. No public evidence identified of patent portfolios, licensing, or co-development arrangements between HiBob and Technion, Hebrew University, the Weizmann Institute, or other Israeli research institutions.

Civil Society Scrutiny & Regulatory History

HiBob does not appear in the OHCHR Database of Business Enterprises maintained under Human Rights Council Resolutions 31/36 and 53/25, most recently updated in September 2025 to cover 158 companies from 11 countries; no HiBob-specific entry was located ¹⁹²⁰. HiBob does not appear in the Who Profits companies database based on a direct search of its listings ²¹. No public evidence identified of HiBob being named in UN Special Rapporteur reports on the occupied Palestinian territories, or on the AFSC Investigate platform. No public evidence identified of an organized boycott, divestment, or sanctions campaign specifically targeting HiBob on technology-related grounds. No public evidence identified of regulatory inquiries, export-control actions, or sanctions investigations involving HiBob’s technology sales or services to Israeli state entities. HiBob is a privately held company, last reported at approximately a $2.7 billion valuation following a 2023 $150 million funding round led by General Atlantic, with investors including Battery Ventures, Bessemer Venture Partners, Eight Roads Ventures/Fidelity, and Farallon Capital ²²²³²⁴; No public evidence identified of SEC 10-K/20-F filings, consistent with HiBob’s private, non-US-listed status.

End Notes