Digital Audit: John Lewis

Enterprise Technology Stack & Vendor Relationships

No public evidence identified of John Lewis Partnership (JLP) holding a direct licensing, subscription, or integration relationship with Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty, or Palo Alto Networks. JLP’s primary cloud transformation partner is Google Cloud, formalised via a £100m, five-year strategic agreement announced 9 August 2023 covering AI/ML capability, migration of “more of the organisation’s technology,” and development of an AI-powered customer-service bot ¹²³⁴. JLP’s systems integrator and IT-outsourcing partner is Wipro, engaged since 2020 for infrastructure services - cloud hosting, networks, end-user compute, and helpdesk support covering roughly 80,000 Partners - with the relationship extended in August 2024 for a further four years under the “Wipro FullStride Cloud” programme to complete cloud transformation and modernise IT infrastructure ⁵⁶⁷⁸. No public evidence identified confirming continued use of Amazon Web Services/EC2 following the 2023 Google Cloud migration announcement, notwithstanding historic 2016–2018 references to Amazon EC2 in JLP’s technology stack. Contact-centre operations are outsourced to Foundever under a 17-year relationship extended for a further five years, with Calabrio (a US-headquartered vendor) used for quality-assurance and sentiment/topic analytics automation; no Israeli-origin vendor such as NICE or Verint was identified in this pipeline ⁹¹⁰. Separately from its JLP engagement, Wipro - JLP’s core infrastructure/cloud integrator - maintains substantial Israel-facing industrial activity of its own: it acquired Israeli aerospace-parts manufacturer H.R. Givon in 2016 (now Wipro Givon, Kiryat Bialik) ¹¹, Wipro Infrastructure Engineering announced a strategic manufacturing alliance with Israel Aerospace Industries (IAI), Israel’s state-owned prime defence/aerospace manufacturer ¹², and Wipro partnered with Ramot, the technology-transfer company of Tel Aviv University, for joint AI research in 2017 ¹³, within a broader pattern of major Indian IT firms maintaining an Israel presence ¹⁴. No public evidence identified that Wipro has mandated or deployed Israeli-origin technology specifically within its JLP engagement; these are separate corporate activities of the integrator.

Surveillance, Biometrics & Retail Technology

JLP is a funder/participant, alongside Co-op, M&S, Boots and Primark, in Project Pegasus, a Home Office–backed retail-crime intelligence-sharing and facial-recognition-matching initiative launched in 2023 that uses the Metropolitan Police’s custody-image database and Police National Database matching ^15161718. The named technology provider for the associated facial-recognition tooling referenced in coverage is Facewatch, a UK company founded in London in 2010, confirmed as UK-origin and not Israeli ¹⁹²⁰. For online age-restricted sales, JLP partners with Yoti, a British company founded in 2014, for AI facial age-estimation to gate online knife purchases, re-launched in January 2025 with images stated to be deleted after estimation and not stored; Yoti is confirmed UK-origin, not Israeli ²¹²²²³. Historically, JLP partnered with Cimagine, an Israeli markerless-augmented-reality startup founded in Tel Aviv in 2012, to build a virtual/AR furniture-visualisation showroom at its Oxford Street flagship store, publicised in 2016 ²⁴²⁵²⁶; Cimagine was acquired by Snap Inc. in late 2016 for an estimated $30–40m ²⁷. No public evidence identified that this AR integration continued past the Cimagine-Snap acquisition, and the current status of any surviving JLP AR feature is unknown. Oriient, an Israeli indoor-positioning startup, was a finalist in JLP’s JLAB retail-technology accelerator cohort announced in February 2019 ²⁸. No public evidence identified that Oriient’s technology was subsequently deployed commercially in JLP stores beyond the accelerator finalist stage. No public evidence identified of JLP use of Trigo, Trax, AnyVision/Oosto, BriefCam, or comparable Israeli-origin biometric or computer-vision vendors for loss-prevention or frictionless-checkout applications. No public evidence identified of Israeli-origin predictive-policing, sentiment-analysis/social-media-monitoring, or workforce-surveillance tools used by JLP, whose sentiment/topic analytics instead run on Calabrio, a US vendor ²⁹. No public evidence identified of Israeli-origin surveillance or biometric technology reaching JLP indirectly via a bundled managed-security-service or platform suite, beyond the Project Pegasus facial-recognition pipeline noted above, whose direct technology provider is UK-based Facewatch.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

No public evidence identified that JLP operates, leases, or co-locates data-centre infrastructure within Israel. No public evidence identified of JLP participation in Project Nimbus or any comparable Israeli government/state-backed cloud initiative, in any capacity - JLP functions as a customer, not a provider, of cloud services. No public evidence identified that JLP provides data-sovereignty, data-residency, or infrastructure-resilience services to Israeli state institutions or military bodies, consistent with JLP not operating as a cloud or infrastructure vendor to third parties. JLP’s principal cloud vendor is Google Cloud under the £100m agreement described above ¹². No public evidence identified that JLP’s own Google Cloud contract, workloads, or data are connected to Israel’s Project Nimbus programme.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of any contract, partnership, or service agreement between JLP and the Israeli Ministry of Defence, the IDF, Israeli intelligence agencies, or other state security bodies. No public evidence identified that JLP’s commercially available technology - retail platforms, AR, e-commerce, or loyalty/analytics systems - has been publicly reported or documented as deployed for military, intelligence, or law-enforcement surveillance applications within Israel or the occupied territories. No public evidence identified of JLP developing, selling, licensing, or maintaining offensive cyber capabilities, zero-day exploit tools, or digital weapons systems, nor of any documented Israeli state-actor deployment of JLP-originated tools.

AI, Algorithmic & Autonomous Systems

No public evidence identified of JLP providing AI/ML, computer-vision, or autonomous decision-support systems to Israeli state, military, or security bodies; JLP’s disclosed AI investment is customer-facing retail and chatbot work conducted domestically with Google Cloud ¹⁴. No public evidence identified that JLP’s AI models or platforms have been trained on or given access to civilian population data, intercepted communications, or surveillance-derived datasets originating from Israel or the occupied territories. No public evidence identified of JLP providing autonomous target-generation, automated threat-detection, or autonomous tracking systems to Israeli military or security forces.

Technology Ecosystem & R&D Footprint

No public evidence identified of JLP operating R&D facilities, engineering offices, innovation labs, or accelerator programmes within Israel itself; JLP’s JLAB accelerator is UK-based (run with L Marks) but has considered at least one Israeli-founded startup, Oriient, as a participant/finalist ²⁸. No public evidence identified of JLP acquiring any Israeli-origin technology company; JLP’s historical Israel-linked technology relationship, with Cimagine, was a vendor/partner engagement rather than an acquisition or equity investment by JLP, and Cimagine was separately acquired by Snap Inc. in 2016 ²⁷. No public evidence identified of patent portfolios, licensing agreements, or co-development arrangements between JLP and Israeli-domiciled entities or research institutions such as Technion, Hebrew University, or the Weizmann Institute.

Civil Society Scrutiny & Regulatory History

JLP has been the subject of sustained NGO and campaign scrutiny from groups including the Palestine Solidarity Campaign UK and Electronic Intifada since at least 2011–2013 over its stocking of SodaStream, manufactured in the Ma’ale Adumim settlement industrial zone, and Ahava cosmetics, linked to Dead Sea settlements ^30313233. JLP stated it is “non-aligned” and would “continue to source products from Israel” ³¹. SodaStream was reportedly removed from JLP shelves following campaign pressure, with sources varying on the exact year, citing 2014 as a period of regular protest through a 2017 removal report ³¹³⁴³⁵; separately, JLP is reported to have stopped stocking Ahava as early as 2008, described by the company as a commercial decision unrelated to the boycott campaign ³⁶³⁷. A petition launched in 2013 also targeted JLP’s sale of Israeli-brand toys, including Interstar products manufactured in an OPT settlement ³⁸. These are goods/retail-sourcing matters rather than technology-provision matters and fall outside this audit’s core technology-supply-chain scope, but are noted for completeness. No public evidence identified of any NGO investigation, academic study, or UN report - Who Profits, OHCHR’s settlement-business database, or the Don’t Buy Into Occupation report - naming JLP specifically in connection with technology relationships to the Israeli state or occupied-territory operations; a direct query of the Who Profits company database (settlement-filtered) returned no JLP/Waitrose entries ²⁹, the OHCHR settlement-business database update was located but could not be confirmed via full-text access to name or exclude JLP ³⁹, and the Don’t Buy Into Occupation 2024 report’s company-list annex was located but its detailed contents could not be confirmed to include or exclude JLP ⁴⁰. No public evidence identified of boycott/divestment campaign activity against JLP specifically over technology provision - all identified campaign activity concerns physical retail goods (SodaStream, Ahava, Israeli-brand toys), not technology products or services. No public evidence identified of regulatory inquiries, legal challenges, export-control actions, or sanctions-related investigations involving JLP’s technology sales or services to Israeli state entities. JLP’s leadership team and 2024 chairman succession are a matter of public record ⁴¹⁴²; No public evidence identified of any JLP director’s or Chair’s personal equity stake, board seat, or investment in an Israeli surveillance, cyber, or AI/SIGINT firm.

End Notes