KFC DIGITAL

Target: KFC (Kentucky Fried Chicken), a Yum! Brands operating concept
Audit phase: Digital Audit
Date: September 2026
Scope: KFC-brand digital, data, cyber, surveillance, and AI activity relevant to Israel, distinguishing Yum! Brands group assets from restaurant-level operations by franchisees and licensees. Yum! reported that 97% of its restaurants were independently operated at 31 December 2025.¹

Enterprise Technology Stack & Vendor Relationships

KFC is a Yum! Brands operating concept rather than one globally operative legal entity; Yum’s KFC Division includes the company’s worldwide KFC-concept operations.¹ Yum’s 2025 subsidiary exhibit lists multiple KFC-named entities in jurisdictions including the United States, United Kingdom, Canada, Germany, Australia, and South Africa, but does not list a KFC-named Yum subsidiary incorporated in Israel.²

KFC’s 2021 global digital-ordering architecture used AWS serverless and event-driven services including Lambda, API Gateway, SQS, Step Functions, SNS, DynamoDB, S3, and Athena.³ The contemporaneous KFC technical account stated that this infrastructure processed nearly half of restaurant transactions across more than 950 locations; it did not disclose AWS regions or current architecture.³

Byte by Yum! is Yum’s proprietary SaaS and AI product collection for online/mobile ordering, point-of-sale, kitchen and delivery optimisation, menu, inventory, labour, and team-member tools.^{4, 1} Yum stated in February 2025 that 25,000 restaurants globally used at least one Byte product and that KFC globally had widely scaled Byte’s AI restaurant-coach component; these are not KFC-only counts and do not establish that every Byte module is in use at KFC.⁴ Yum’s current Byte page also depicts KFC ordering kiosks and includes a KFC South Africa franchise-owner testimonial concerning real-time sales, demand, and production monitoring, confirming use of unspecified Byte capabilities in KFC operations.⁵

Yum acquired Tel Aviv-based Tictuk Technologies in 2021.⁶ At acquisition, Yum stated that Tictuk had been successfully deployed in approximately 900 combined KFC, Pizza Hut, and Taco Bell restaurants in 35 countries outside the United States.⁶ This is primary evidence of a KFC-inclusive deployment population, but it does not identify the number, countries, functions, or current status of KFC deployments.⁶ A 2023 trade-press report described Tictuk-supported kiosk ordering in KFC Latin America, but no primary company record retrieved here independently confirms the locations, scale, or present status of that report.⁷

Yum also acquired Dragontail Systems in 2021, making it a Yum subsidiary.⁸ Yum’s subsidiary exhibit lists both Dragontail Systems Ltd. and TicTuk Technologies Ltd. as incorporated in Israel at 31 December 2025; direct review of the exhibit resolves the conflicting preliminary research notes.²

LoyaltyPlant participated in KFC’s European Tech & Digital Summit in Madrid in October 2025 and has described providing loyalty and ordering infrastructure to KFC franchisees in several markets.^{9, 10} No Israeli nexus was identified for LoyaltyPlant in the reviewed evidence.^{9, 10}

Surveillance, Biometrics & Retail Technology

KFC’s US privacy policy states that KFC may connect online activity with in-store kiosk and front-counter information and that third-party partners may collect location or movement information to analyse in-store foot traffic.¹¹ The policy states that KFC does not create voiceprint biometric identifiers in the US market.¹¹

Dragontail’s Algo platform concerns restaurant kitchen-flow, cooking-time, delivery-dispatch, and order-combination functions, while QT is a camera/sensor system using machine learning to monitor food preparation and cooking.^{8, 12} QT is therefore a retail quality-control capability, not evidence of facial recognition or state-security surveillance.⁸

Dragontail’s 2017 results described a KFC Asia “Store of Tomorrow” engagement after reported benefits at Singapore stores.¹³ This is evidence of a pre-acquisition KFC Asia relationship, but no public primary evidence retrieved confirms post-acquisition QT deployment at specified KFC locations or provides an installed-KFC-camera count.^{8, 13} Secondary reporting on later Byte Kitchen rollout should not be treated as confirmation that QT cameras were installed across KFC restaurants.¹⁴

KFC China trialled Alipay/Ant Financial “Smile to Pay” facial-recognition payment in 2017.¹⁵ That trial involved Yum China, a separately listed company following its 2016 separation from Yum! Brands, and is not established here as a Yum! Brands KFC Division programme.¹⁵

No public evidence identified of biometric payment, facial-recognition, gait-analysis, predictive-policing, or workforce-surveillance programmes operated by KFC or Yum! Brands in Israel.¹¹

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

The disclosed KFC AWS architecture involved order processing, reporting and analytics, storage, and customer-personalisation use cases.³ Neither that account nor Yum’s 2025 filing identifies AWS regions, hosting locations, data-controller arrangements, or Israeli legal-access pathways for KFC customer or employee data.^{3, 1}

Yum’s June 2025 Cookie and Ads Policy identifies “TicTuk” and “Dragontail” as names used by entities within Yum! Restaurant Services Group.¹⁶ A Tictuk recruitment listing’s reference to AWS is not evidence of an AWS hosting region, Israeli data residency, or Israeli governmental access to KFC data.¹⁶

No public evidence identified of KFC or Yum operating or leasing data-centre infrastructure in Israel, using Project Nimbus, providing Israeli sovereign-cloud services, routing KFC data through Israeli-controlled infrastructure, or processing KFC data under Israeli government jurisdiction.^{3, 1, 16}

A January 2023 ransomware incident at Yum reportedly closed approximately 300 UK KFC restaurants for one day and involved employee personal data held in Yum systems.¹⁷ Subsequent US class actions alleged impacts on employees and applicants across Yum brands.¹⁸ Reports of claimed KFC Venezuela customer-data sale and an alleged Salesforce-linked KFC database leak appeared in October 2025, but the reviewed evidence does not link either incident to Israeli actors or Israeli-nexus infrastructure.¹⁹

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of KFC, Yum, Tictuk, or Dragontail holding contracts with, providing technology to, or training AI systems for Israeli defence, intelligence, security, military, settlement, or occupied-territory authorities.^{1, 2, 20, 21}

The available evidence characterises Dragontail and Byte Kitchen functions as civil quick-service restaurant ordering, kitchen orchestration, delivery dispatch, and food-preparation quality control.^{8, 12} It does not identify offensive-cyber, autonomous-targeting, kinetic, SIGINT, or comparable military-system uses.^{8, 12}

No public evidence identified of a KFC/Yum settlement-specific digital deployment, including through a franchisee or licensee, in the reviewed sources.^{2, 20, 21}

AI, Algorithmic & Autonomous Systems

Dragontail, founded by Udi Shamai in the Tel Aviv metropolitan area, developed the Algo platform for automated kitchen sequencing, cooking-time management, delivery dispatch, and geographically proximate order combination.^{22, 12} Yum completed its acquisition in September 2021 and stated at that time that Dragontail would continue as an independent brand within Yum.⁸

Yum’s September 2021 release described an intention to deploy Dragontail technology globally across Yum brands and franchisees over time.⁸ It did not establish a completed KFC deployment, separate KFC from Pizza Hut deployment, or state that QT cameras were installed at KFC restaurants.⁸ Later reporting that Byte Kitchen was live in 8,000-plus restaurant locations and that a full KFC/Pizza Hut US rollout was planned for 2025 should be read as a group-level scale and planned-rollout statement, not as confirmation of completed KFC US implementation.¹⁴

No public evidence identified of a post-2025 primary announcement confirming completion of the planned KFC US Byte Kitchen rollout.¹⁴ Accordingly, the record supports Dragontail’s acquisition, product capability, and planned Yum-brand deployment, but not a specified count of completed KFC Byte Kitchen or QT deployments.^{8, 14}

Yum announced an NVIDIA collaboration in March 2025 covering voice AI, computer-vision analytics, and restaurant-performance tools across Taco Bell, Pizza Hut, KFC, and Habit Burger, with a rollout targeting 500 restaurants across brands planned for the second quarter of 2025.²³ This was a group initiative and does not identify KFC-specific completed deployment numbers.²³ NVIDIA is US-domiciled in the existing record, with no Israeli nexus identified.²³

Sodaclick launched multilingual conversational voice AI for KFC UAE drive-throughs with Intel and Americana Restaurants.²⁴ Yum also announced a 2024 expansion of voice AI at Taco Bell US, with a future intention to extend it to other brands including KFC.²⁵ Neither item establishes an Israeli technology nexus.^{24, 25}

Before Yum’s acquisition, Dragontail announced a Pizza Hut Israel drone-delivery pilot with Pizza Hut Israel in January 2021.²⁶ This was attributed to Dragontail and Pizza Hut Israel, not KFC.²⁶

Technology Ecosystem & R&D Footprint

Yum made three technology acquisitions in 2021: Kvantum, Tictuk, and Dragontail.²⁷ Tictuk was Tel Aviv-based at acquisition, and Dragontail Systems Ltd. remained an Israeli-incorporated Yum subsidiary at 31 December 2025.^{6, 2}

Yum stated in September 2021 that Dragontail employees would primarily be located in Israel, the United States, and Australia.⁸ That is a dated employee-geography statement; it does not establish current headcount, that Israel contained the majority of employees, or that the Israeli workforce was principally R&D or engineering.^{8, 2} The former D&B-based assertion that Dragontail’s R&D and engineering workforce “remains primarily located in Israel” is therefore not sustained by the current primary record.²⁸

Company-authored, closed recruitment listings provide dated evidence of post-acquisition development activity: Dragontail advertised an R&D Project Manager in Tel Aviv District to manage software-development projects, while Tictuk advertised an R&D Manager to lead researchers, engineers and developers from its Tel Aviv office; both employers described themselves as part of Yum! Brands.^{29, 30} These are employer job advertisements, rather than personal social-media commentary. They support the existence of post-acquisition product-development functions in Israel at the time of the listings, but do not establish present headcount, a majority-Israeli workforce, or the current allocation of development work.^{29, 30}

No public evidence identified of a current country-level headcount, R&D budget, or development-work allocation for Dragontail or Tictuk.^{1, 2} Their inclusion in the December 2025 subsidiary exhibit and the dated employer recruitment records support continued group affiliation and post-acquisition Israeli development activity, without establishing precise September 2026 operating scale.^{2, 29, 30}

KFC’s October 2025 European Tech & Digital Summit publicly identified LoyaltyPlant among participating partners.⁹ No Israeli technology vendors were identified among the summit participants in the reviewed public record.⁹

Civil Society Scrutiny & Regulatory History

BDS Malaysia stated in May 2024 that KFC had never been on its boycott list and said KFC had not provided free meals to the Israeli military.³¹ Independent boycott-tracking material has cited Yum’s Tictuk and Dragontail acquisitions as a consumer-concern basis, but this is secondary commentary rather than evidence of a government, military, or settlement relationship.³² Consumer boycotts in Muslim-majority markets reportedly caused material commercial effects in 2023–2024, including temporary closure of more than 100 Malaysia outlets.³³

The January 2023 Yum ransomware incident and subsequent employee-data litigation are documented in contemporary reporting, while the October 2025 claimed and alleged incidents remain unlinked in the reviewed evidence to Israeli actors or infrastructure.^{17, 18, 19} No regulatory fine arising from those incidents was identified in the supplied audit record.^{17, 18, 19}

The supplied document-scoped full-text screening found no KFC/Yum mention in the June 2023 OHCHR settlement-business database update or the July 2025 Human Rights Council report From economy of occupation to economy of genocide.^{20, 21} This is an absence of mention in those specified documents, not a database-wide or universal absence finding.^{20, 21}

No public evidence identified of boycott, regulatory, export-control, sanctions, court, or parliamentary action specifically concerning KFC/Yum’s use of Tictuk, Dragontail, Byte Kitchen, or QT technology.^{20, 21}