Digital Domain Audit: Marriott International

Target: Marriott International, Inc. (global hotel group) Domain: Digital (Digital / Technology) Date: June 2026 Scope: Marriott International’s own digital/data/cyber/surveillance/AI conduct re Israel.

Enterprise Technology Stack & Vendor Relationships

Marriott International is executing a multi-year technology transformation, with 2024 technology expenditure reaching up to $1.2 billion - the highest in company history - centred on replacing its central reservations system (CRS), property management system (PMS), and Bonvoy loyalty platform.¹²

Central Reservations System - Amadeus (Spain/EU): In November 2021 Marriott agreed to deploy the Amadeus Central Reservations System (ACRS) as its new cloud-based reservations infrastructure.³ Amadeus IT Group is a European company headquartered in Madrid, Spain; no Israeli domicile identified.⁴

Property Management - Agilysys (US) and Oracle (US): In December 2022 Marriott contracted Agilysys (Alpharetta, Georgia) for a cloud-native PMS across US/Canada properties.⁵ In January 2024 Marriott selected Oracle Hospitality OPERA Cloud PMS, running on Oracle Cloud Infrastructure alongside Microsoft Azure.⁶ Both are US-domiciled.

Loyalty/CRM - Salesforce (US): Marriott launched a global customer-recognition platform on Salesforce Service Cloud in 2018, integrating 30 brands and ~6,500 properties.⁷ US-domiciled.

Contact Centre - NICE Ltd (Israel): Marriott consolidated its customer-engagement technology onto the NICE CXone platform, going live in March 2023 after a pilot from July 2021, spanning 20 global customer-engagement centres and 6,500+ agents and replacing 11 legacy vendor solutions.⁸ NICE Ltd is an Israeli company, incorporated in Israel and headquartered in Ra’anana (north of Tel Aviv), founded in 1986 by seven former members of Israeli intelligence; listed on the Tel Aviv Stock Exchange (since 1991) and NASDAQ (ADRs, since 1996).⁹ This is an Israeli-domiciled vendor in Marriott’s active contact-centre technology stack.

Cloud/DevOps - AWS (US), Microsoft Azure (US), Harness (US): Marriott’s primary cloud runs on AWS, with Oracle Cloud Infrastructure and Microsoft Azure as additional platforms; at AWS re:Invent 2025 Marriott described deploying Harness (US DevOps CI/CD platform).⁶¹⁰¹¹ None is Israeli-domiciled.

No public evidence identified of Marriott using Check Point Software (Israel) or any other confirmed Israeli-domiciled vendor in its core enterprise stack beyond NICE Ltd and Torq (see below).

Surveillance, Biometrics & Retail Technology

Facial recognition check-in - Alibaba/Fliggy (China): In July 2018 a joint venture of Alibaba Group and Marriott trialled facial-recognition check-in at two China properties (Hangzhou and Sanya), powered by Alibaba’s Fliggy platform.¹² No public evidence confirms scaled deployment beyond the two China pilot properties or continuation after 2018.

Hotel-level CCTV: No group-level contract with an identified Israeli (or other) CCTV vendor has been publicly disclosed; individual franchisee properties have used third-party suppliers such as Hanwha (South Korean).¹³

No public evidence identified of Marriott deploying facial recognition at properties outside China, or of any Israeli-origin biometric or surveillance vendor in its disclosed hotel technology stack.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Marriott’s cloud strategy is multi-cloud: AWS as the primary platform, with Oracle Cloud Infrastructure and Microsoft Azure for PMS and HR workloads.⁶¹⁰ Its China partnership with Ant Group (announced May 2022) implies some data localisation for Chinese guest records consistent with Chinese data-sovereignty requirements.¹⁴ No equivalent Israeli sovereign-cloud arrangement has been identified. No public evidence identified of Marriott participating in an Israeli sovereign cloud or data-residency scheme.

The Starwood-origin breach (2014–2018, see below) exposed the consequences of inadequate data-residency and encryption controls over acquired legacy infrastructure.¹⁵

Defence, Intelligence & Security Sector Technology Relationships

Cybersecurity stack - Palo Alto Networks (US) with AWS and Deloitte: Marriott’s cybersecurity posture is managed through a partnership with AWS, Palo Alto Networks, and Deloitte.¹⁶ Palo Alto Networks is US-domiciled (Santa Clara, CA; NASDAQ: PANW); it was founded in 2005 by Nir Zuk, an Israeli national who previously served in the IDF’s Unit 8200 and co-founded Check Point.¹⁷¹⁸ However, Palo Alto Networks is incorporated and headquartered in the United States, with an R&D hub in Tel Aviv as a subsidiary operation; under the entity-scope rule (US/EU-domiciled vendors treated as such even if Israeli-founded), it falls outside the in-scope Israeli-domicile category.¹⁷

AI security operations - Torq (Israel): Torq, a Tel Aviv-headquartered AI-native security operations centre (SOC) platform company, lists Marriott among its Fortune 500 enterprise clients.¹⁹²⁰ Torq was founded in 2020 by Ofer Smadari (CEO), Leonid Belkind (CTO), and Eldad Livni, headquartered at 3 HaMelacha St., Tel Aviv; it raised a $140 million Series D in January 2026 at a $1.2 billion valuation.²¹²² Torq is an Israeli-domiciled vendor that Marriott uses for active AI-driven SOC operations.²³ No evidence has been found that Torq holds IDF contracts or Israeli defence procurement; it is a commercial cybersecurity company.²⁴

NICE Ltd - historical military/intelligence origins: NICE Ltd’s Cyber and Intelligence business division was sold in 2015 to Elbit Systems (Israel’s largest defence contractor) for up to $157.9 million, becoming Cyberbit.²⁵ This means the military/intelligence surveillance technology originally developed within NICE now sits with Elbit, not with the current NICE CXone commercial enterprise software business used by Marriott. No public evidence identified that the NICE CXone products deployed by Marriott carry current IDF contracts or Israeli defence procurement.

AI, Algorithmic & Autonomous Systems

Ask Bonvoy conversational AI: Marriott launched the beta of Ask Bonvoy on 16 June 2026 - a conversational search/booking tool grounded in Marriott-owned property data; the company is also partnering with OpenAI on its Ad Pilot programme and integrating with Google’s AI Mode.²⁶²⁷ OpenAI and Google are US-domiciled.

“Agentic mesh” architecture + Microsoft 365 Copilot: Marriott is building an internal “agentic mesh” orchestration layer; ~six properties were beta-testing new CRS/PMS/loyalty platforms as of late 2025, and Marriott piloted Microsoft 365 Copilot.²²⁸

Generative-AI cybersecurity (Palo Alto / Deloitte / AWS): Incorporates generative AI/ML for threat detection and autonomous response.¹⁶ Torq AI SOC agents (Israel) constitute an active Israeli-origin AI system within Marriott’s security operations (see above).

No public evidence identified of Marriott deploying algorithmic pricing, guest-profiling, or discriminatory AI from any Israeli-domiciled vendor.

Technology Ecosystem & R&D Footprint

Marriott operates an internal R&D function (Marriott Design Lab) and ran a Travel Experience Incubator with Accenture and accelerator 1776.²⁹ Its DevSecOps modernisation (AWS re:Invent 2025) deployed Harness (US).¹¹ No Israeli startup has been publicly identified as a participant in, or recipient of investment from, any Marriott innovation programme. No public evidence identified of Marriott operating an R&D centre in Israel, holding equity in Israeli technology companies, or making direct venture investments in Israeli startups.

Civil Society Scrutiny & Regulatory History

Starwood / Marriott Guest Reservation Database breach (2014–2018): Malicious actors compromised the Starwood network in or around June 2014 - two years before Marriott’s 2016 acquisition - and maintained access until September 2018, undetected for ~14 months during the Starwood era.¹⁵³⁰ Approximately 339 million guest records worldwide were compromised, including 5.25 million unencrypted passport numbers.³⁰³¹ Accenture, which managed Starwood IT/security before and after the acquisition, was implicated; a US federal court found the class action against Accenture could proceed.³²

• ICO fine (UK, October 2020): £18.4 million (reduced from an original £99.2 million notice of intent), covering ~7 million UK records.³³
• FTC consent order + state AG settlement (October 2024): A 20-year FTC consent order (regular risk assessments, encryption, incident response, customer data-deletion rights, Bonvoy-point restoration) and a concurrent $52 million settlement with 49 state attorneys general and DC.³⁴³⁵
• 2022 breach (Maryland, July 2022): ~20 GB exfiltrated from a BWI-airport property server; ~300–400 individuals notified.³⁶
• 2020 loyalty-account breach: ~5.2 million guest records exposed (September 2018–February 2020).³⁴
• Class action: Certified May 2022 (133.7 million US consumers), vacated August 2023, reinstated November 2023.³⁷

BDS/civil-society pressure: A Change.org petition calling on Marriott to “cut business ties with Israel” circulated as of 2024, citing Marriott’s hotel operations in Israel; no evidence identified that Marriott has responded or taken action in response.³⁸

End Notes