Digital Audit - Krispy Kreme, Inc.

Domain: Digital / Technology Entity scope: Krispy Kreme, Inc. (NASDAQ: DNUT) - doughnut chain majority-owned by JAB Holding Company. Krispy-Kreme-corporate’s own technology is covered here; JAB-parent/sister-brand (Panera, Pret a Manger, Peet’s, JDE Peet’s) tech and local-franchisee IT are documented at parent/sibling/franchisee level. Vendor-domicile rule applies: only genuinely Israeli-domiciled vendors are treated as material. Compiled: 2026-06-21 Method: Live web search only

Enterprise Technology Stack & Vendor Relationships

Krispy Kreme’s corporate stack is built around US/EU-domiciled enterprise vendors: NCR Aloha (POS at company stores; NCR Voyix, US), Oracle E-Business Suite (global ERP, announced 2013), iCIMS Recruit (applicant tracking, US), ECi Macola (manufacturing/distribution ERP, US), Trovata (US treasury fintech, multi-bank/multi-currency cash management), DocuSign (US), and Precisely Assure iTERA (IBM i data integrity, US).¹²³⁴⁵ A subset of Texas franchisees separately adopted Oracle MICROS Simphony cloud POS - an independent franchise IT decision, attributed to the franchisees and not Krispy-Kreme-corporate.⁶ No Israeli-domiciled vendor was identified in Krispy Kreme’s confirmed enterprise stack; all confirmed vendors are US or European-domiciled. JAB-parent technology investments and sister-brand vendor relationships are attributed to JAB/the sister brands, not Krispy-Kreme-corporate.

Surveillance, Biometrics & Retail Technology

Krispy Kreme deployed biometric timekeeping (fingerprint/hand-geometry clocks) at its Illinois operations, the subject of a federal class action (Krase v. Krispy Kreme Doughnut Corporation, N.D. Ill. 1:24-cv-04493, filed 31 March 2024) alleging Illinois Biometric Information Privacy Act violations for non-consensual collection.⁷ The specific timekeeping hardware/software vendor is not identified in public filings, and no Israeli-domiciled biometric or surveillance vendor relationship was identified. No facial-recognition, customer-surveillance, or retail-analytics technology with Israeli connections was identified for Krispy Kreme corporate operations.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

A technology-stack profile identifies Krispy Kreme SA (a separate South African franchise subsidiary) as using AWS Route53 and Cloudflare CDN.⁸ For the US corporate entity, no confirmed public disclosure of a primary cloud provider was identified in SEC filings or press releases reviewed; the FY2024 10-K references IT systems generically without specifying cloud providers.⁹ The SoundHound and Trovata platforms are US-hosted SaaS, and no Israeli sovereign-cloud or data-residency arrangement was identified. No public evidence identified of Krispy Kreme corporate participating in any Israeli sovereign-cloud programme.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of Krispy Kreme corporate holding any defence, intelligence, or security-sector technology contract, or procuring technology from companies primarily serving those sectors. The November 2024 ransomware incident prompted engagement of unnamed “leading cybersecurity experts” (per the 11 December 2024 SEC 8-K), with no specific remediation vendor publicly named; the Play ransomware group that claimed responsibility is a criminal threat actor with no identified Israeli state nexus.⁹¹⁰ No Israeli-domiciled cybersecurity vendor relationship was confirmed; a search-result assertion of a “high probability” of Israeli vendor engagement post-breach was unsubstantiated AI commentary and is disregarded.

AI, Algorithmic & Autonomous Systems

Krispy Kreme adopted SoundHound’s Houndify voice-AI platform (c. 2022) for drive-through/in-store voice ordering; SoundHound AI, Inc. (NASDAQ: SOUN) is a US-domiciled (Santa Clara) company, not Israeli.³¹¹ The company uses AI/algorithmic tools to model demand seasonality, weather, and delivery routing for its fresh hub-and-spoke logistics (vendor not publicly identified), and the Trovata platform applies machine learning to cash forecasting.¹²⁴ A December 2022 ~$6 million investment in automated production lines (inline icing/filling/packaging) used Siemens (German) drives/controls integrated by Think PLC (US).¹³ No Israeli-domiciled AI or automation supplier was identified.

Technology Ecosystem & R&D Footprint

Krispy Kreme operates no disclosed R&D function or technology incubator; its posture is that of a consumer foodservice company that buys and integrates third-party enterprise software rather than developing proprietary technology, with no patent filings, Israeli technology partnerships, or Israeli startup investments identified. No confirmed Krispy Kreme franchise in Israel was identified (Israel does not appear on Krispy Kreme’s operations-by-country record, its global locator, or its 10-K market footprint; see the Economic audit), so there is no Israeli-franchisee technology relationship to assess.¹⁴

Civil Society Scrutiny & Regulatory History

The 2024 ransomware data breach (detected 29 November 2024; Play ransomware claimed exfiltration of 184 GB; SEC 8-K filed 11 December 2024) affected 161,676 individuals - with stolen data including SSNs, driver’s licences, financial/payment-card numbers, passport and military-ID numbers, biometric and health-insurance data, and digital signatures - and the company estimated losses exceeding $11 million, reaching a class-action settlement of $1,616,760 (claim deadline 22 June 2026).^9151617 The 2024 BIPA biometric-timekeeping litigation (Krase v. KKD) remains unresolved.⁷ No FTC investigation or other federal regulatory action against Krispy Kreme specifically for digital privacy was identified, and no civil-society organisation has published scrutiny of Krispy Kreme’s technology procurement with reference to Israeli vendors or the conflict.

End Notes