Mastercard DIGITAL

Enterprise Technology Stack & Vendor Relationships

Mastercard’s security and data-analytics stack in the Israeli technology ecosystem has been built substantially through direct acquisition of Israeli-origin firms rather than through publicly identified vendor-customer procurement contracts. In May 2020, Mastercard acquired Cytegic, an Israeli cyber-risk-quantification startup founded by Elon Kaplan and Gerard Sabbah; its Israel-based team continued development under Mastercard’s Data & Services division.^{1, 2, 3} Mastercard separately acquired RiskRecon, a Salt Lake City-based cyber-risk assessment firm, in December 2019, and NuData, a Canada-based behavioural-biometrics fraud-prevention firm, in 2017; no Israel nexus was identified for either acquisition.^{4, 5, 6}

In September 2024, Mastercard announced its acquisition of Recorded Future, a Somerville, Massachusetts-headquartered threat-intelligence firm, for $2.65 billion; Mastercard finalized the transaction in December 2024.^{7, 8, 9} Recorded Future reportedly serves governments in 45 countries among more than 1,900 global clients, including United States defence, intelligence, and law-enforcement agencies and Ukrainian cyber-defence bodies.¹⁰

Mastercard’s Binding Corporate Rules (BCRs), updated 15 July 2025, list three Israel-incorporated Mastercard-group entities: Mastercard Israel Subsidiary Ltd. (company no. 515837888), Finsec Lab Ltd. (516105624), and Dynamic Yield Ltd. (51-474336-8).¹¹ The BCRs provide a group-wide framework for transfers of personal information “to and among” listed Mastercard entities and cover controller and processor activity, including transaction data such as account number, transaction date, time, amount, merchant name, and merchant location.¹¹ The framework establishes that the listed Israeli entities are BCR-bound entities through which regulated intra-group transfers may occur; it does not establish an actual transfer to Israel of payment, identity, behavioural, biometric, fraud, or customer data, nor identify Israeli employee access, storage locations, or Cytegic-specific processing.¹¹

No public evidence identified of Mastercard holding direct licensing, subscription, or integration relationships as a customer of Check Point, Wiz, CyberArk, NICE, Verint, Claroty, or Palo Alto Networks, nor of named systems integrators or consultancies mandating Israeli-origin technology for Mastercard’s major technology programmes.^{1, 7, 12}

Surveillance, Biometrics & Retail Technology

Mastercard operates the Mastercard Biometric Checkout Program, which enables facial- or palm-based payment authentication and was launched in May 2022.¹³ No public evidence identified connecting the underlying biometric-capture technology to an Israeli-origin vendor such as Trigo, BriefCam, AnyVision/Oosto, or Trax.¹³

Mastercard’s BCRs describe group-wide processing of payment, fraud-prevention, identity-verification, open-banking, and engagement-program data, but do not identify Israel-based personnel or systems as accessing biometric, identity, fraud, behavioural, or payment data.¹¹ Mastercard’s Israel-localized privacy notice similarly identifies Mastercard International Incorporated and its affiliates collectively as Mastercard, with a Global Privacy Office address in Purchase, New York, without identifying Israeli processing or access locations.¹⁴ No public evidence identified of Israeli biometric or surveillance technology reaching Mastercard indirectly through bundled or managed-security-service suites, or of Mastercard use of Israeli-origin predictive-policing, sentiment-analysis, social-media-monitoring, or workforce-surveillance tools.^{13, 14, 11}

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

No public evidence identified that Mastercard operates, leases, or co-locates data-centre infrastructure within Israel.^{14, 11, 15} No public evidence identified of Mastercard participation in Project Nimbus or a comparable Israeli-government cloud or data-sovereignty programme; publicly documented Project Nimbus participants are limited to other providers and Mastercard does not appear among them.^{16, 17, 18}

Mastercard’s current Global Privacy Notice states that personal information may be transferred to the United States and other countries, using BCRs, contractual protections, and other transfer mechanisms; it does not name Israel as a destination or disclose payment-data routing, data-centre location, or Israel-based access.¹⁵ The BCRs state that Mastercard evaluates destination-country law, processing and storage location, and possible public-authority access for transfers, but do not supply a regional hosting map or identify actual transfers to an Israeli entity.¹¹

Dynamic Yield’s documentation establishes that it processes customer personal data, including geographic information, audience membership, browsing or activity-linked identifiers, and, in some customer-supplied workflows, email-address data; it states that email addresses are typically hashed and originals are stored separately in a secure, segregated location.¹⁹ Its personalization-services data-processing agreement additionally lists IP addresses, online and device identifiers, browser attributes, page views and interactions, customer events, search terms, email addresses, and customer-supplied CRM data as potential end-user data categories.²⁰ Dynamic Yield’s Privacy Center states that privacy-rights tools can search its “entire database” for data tied to users or devices.²¹

Dynamic Yield Ltd.’s privacy notice identifies the company as notice provider and, for EEA, United Kingdom, and Swiss individuals within the notice’s scope, as responsible controller; it gives a One Tower, Ramat Gan, Israel address and states that personal information may be shared with Mastercard’s United States headquarters, Mastercard affiliates, business partners, and storage and analytics service providers.²² The notice also describes use of information for tailored content, research, analytics, and AI training.²² Apart from the scoped Crownpeak processing record below, no public evidence identified of the storage regions, cloud providers, processing locations, Israel-based infrastructure, or Ramat Gan personnel access rights for Dynamic Yield customer profiles, event streams, identifiers, or personalization datasets.^{19, 21, 20, 22}

No public evidence identified of Mastercard providing data-sovereignty or infrastructure-resilience services expressly marketed to Israeli state or military institutions.^{16, 17, 18}

Scoped processing-location corroboration

Crownpeak’s published subprocessor list names Dynamic Yield (Mastercard) for its FirstSpirit Intelligent Content Engine, with Germany and Israel as processing locations. It describes error analysis, information exchange for module troubleshooting where licensed, and contact-detail exchange for licence management and billing.²³ This qualifies the earlier general absence of identified Israeli processing: a named customer/vendor record identifies limited Dynamic Yield processing in Israel. The list does not identify all data fields handled during troubleshooting, establish that all Dynamic Yield customer profiles are processed in Israel, show Ramat Gan personnel permissions, or demonstrate access to Mastercard’s global cardholder or biometric data.²³

Defence, Intelligence & Security Sector Technology Relationships

Mastercard’s clearest defence and intelligence-sector nexus runs through its September–December 2024 acquisition of Recorded Future.^{7, 8} Recorded Future’s CEO, Christopher Ahlberg, stated in comments reported by Forbes that the company provided intelligence to the Israeli National Cyber Directorate (INCD) and had done so “for a long time”; he also declined in that interview to name specific Israeli customers.¹⁰ The relationship predated Mastercard’s acquisition. No post-closing source reviewed confirms that Mastercard or Recorded Future continued servicing INCD after the December 2024 closing.^{8, 10}

Recorded Future was also reported to be a major provider to United States defence, intelligence, and law-enforcement agencies, including the NSA, Cyber Command, Secret Service, and ICE, and to provide defensive cyber services to Ukrainian agencies.¹⁰ Available sourcing characterizes Recorded Future as a defensive threat-intelligence platform; no further breakdown was identified of Israeli military- or defence-ministry-specific, as distinct from civilian-cyber-agency, contracts.¹⁰

No public evidence identified of direct Mastercard contracts with the Israeli Ministry of Defence, the IDF, Shin Bet, or Mossad for IT, communications, hosting, or analytics services.^{7, 8, 10} No public evidence identified of dual-use deployment of Mastercard commercial technology for military, intelligence, or law-enforcement surveillance in Israel or the Occupied Palestinian Territories, or of Mastercard development, sale, licensing, or maintenance of offensive cyber capabilities or zero-day exploit tools.¹⁰

SHVA’s 2024 report describes SHVA as critical state infrastructure supervised by Israel’s National Cyber System and subject to government security guidelines and audits; this describes SHVA’s regulatory position, not a Mastercard contract with that body.²⁴

AI, Algorithmic & Autonomous Systems

Mastercard’s principal AI asset with an Israeli nexus is Dynamic Yield, an Israeli AI-driven personalization platform founded in 2012 by Liad Agmon and Omri Mendellevich. McDonald’s acquired Dynamic Yield in 2019 for roughly $300 million, and Mastercard’s acquisition closed in April 2022 for approximately $320 million.^{25, 26, 27, 28} Ori Bauer, Dynamic Yield’s CEO at the time of the Mastercard transaction, reportedly served in Mamram, the IDF’s central computing-services unit, during mandatory military service.^{25, 26}

Dynamic Yield’s data documentation establishes that the platform can process customer personal data. Its privacy notice separately describes tailored content, research, analytics, and AI training within that notice’s scope; this does not establish that customer-platform datasets are used for AI training.^{19, 20, 22} Those documents do not attribute training, testing, or operating functions to Ramat Gan personnel or infrastructure, identify applicable datasets, distinguish production from pseudonymous, synthetic, or irreversibly anonymized data, or identify environment-separation controls.^{19, 21, 20, 22} No public evidence identified that Mastercard’s Israel hub develops, trains, tests, or operates AI, fraud-detection, personalisation, cybersecurity, or identity systems using production, pseudonymous, or identifiable customer data rather than exclusively synthetic or irreversibly anonymized data.^{19, 21, 11, 20, 22}

No public evidence identified that Mastercard’s AI models, including Dynamic Yield’s personalisation engine or Mastercard fraud-detection AI, were trained on or granted access to civilian-population data, intercepted communications, or surveillance-derived datasets originating from Israel or the Occupied Palestinian Territories.^{19, 11, 22} No public evidence identified of Mastercard providing AI/ML, computer-vision, autonomous decision-support, autonomous targeting, automated threat-detection, or autonomous tracking systems to Israeli state, military, or security bodies.^{7, 8, 10}

Technology Ecosystem & R&D Footprint

Mastercard maintains a technology R&D centre in Ramat Gan’s One Tower in the Exchange District, shared with Dynamic Yield, with reported headcount in the range of 300–500 personnel conducting AI-driven R&D.^{27, 28, 29} In May 2020, Mastercard and Enel X jointly established the FinSec Innovation Lab in Beersheba’s Gav-Yam Negev High-Tech Park after winning a 2019 government tender issued jointly by the Israel Innovation Authority, the Israel National Cyber Directorate, and the Israeli Ministry of Finance.^{30, 31, 32, 33, 34, 35} The arrangement included NIS 13 million, approximately $3.7 million, in funding and a three-year mandate to work with early-stage Israeli startups on fintech and cybersecurity proof-of-concept development.^{30, 31, 32, 33, 34, 35} Whether the lab continued operating beyond its stated three-year term is not confirmed by the reviewed sources.^{30, 32, 34}

The 2025 BCR appendix provides current authoritative evidence of Israeli Mastercard-group legal-entity presence through Mastercard Israel Subsidiary Ltd., Finsec Lab Ltd., and Dynamic Yield Ltd.¹¹ Mastercard’s FY2025 material-subsidiary exhibit lists significant subsidiaries including Mastercard International Incorporated, Mastercard Europe SA, Mastercard Technologies, LLC, and Mastercard Middle East Africa FZ-LLC, but contains no Israel-jurisdiction entity; the exhibit expressly omits subsidiaries that are not significant in aggregate, so that omission does not establish an absence of an Israeli subsidiary, branch, employer entity, or affiliate.³⁶ Mastercard’s FY2025 Form 10-K states that the group conducts business principally through Mastercard International Incorporated, without allocating operational control of Israel-based teams or their data pipelines.¹²

No public evidence identified of which Israeli entity employs the Ramat Gan R&D workforce, which entity manages or controls the relevant systems, or whether a specific data or R&D pipeline is operationally controlled from, or legally accessible within, Israel.^{12, 36, 14, 19, 11} The Israeli Corporations Authority provides an official route to entity-specific company extracts, but no entity-specific extract for Mastercard, Dynamic Yield, Cytegic, or a successor entity was retrieved in the reviewed research; the precise employment relationships, directors, ownership, and company registration details therefore remain unresolved.³⁷

Mastercard acquired Cytegic in May 2020 and Dynamic Yield in April 2022; Recorded Future is not Israeli-domiciled but has the documented pre-acquisition INCD customer relationship described above.^{25, 27, 1, 7, 8, 10} No public evidence identified of Mastercard patent, licensing, or co-development arrangements with the Technion, Hebrew University, or the Weizmann Institute specifically.^{30, 32, 34}

Mastercard received Bank of Israel approval in April 2019 to acquire 10% of Automatic Bank Services Ltd. (SHVA), Israel’s payment-card clearing switch, from Bank Hapoalim; Visa separately held a parallel 10% stake acquired from Bank Leumi in 2018.^{16, 17, 18} SHVA operates Israel’s payment-card services system, connecting issuers, merchant acquirers, and merchant terminals; it provides processing, switching, collection, settlement-interface services, and the national interbank ATM switch.³⁸ SHVA’s 2024 annual report states that it is a public company with no controlling shareholder and that no shareholder held more than 10% of share capital after the 2019 public listing.²⁴

The Bank of Israel stated that new SHVA owners could influence board composition through the general meeting.¹⁶ SHVA’s 2024 annual report further documents that SHVA entered into an agreement with Mastercard, completed a direct technological connection in 2022, and provided value-added services to SHVA system participants that are also Mastercard customers.²⁴ As of 31 December 2024, SHVA said it was developing the possibility of making information enriched through Mastercard available to issuers in approval applications for issuer risk-management decisions.²⁴ This confirms a direct technical integration and an envisaged information-enrichment function, but does not show that the enriched-information function had entered operation, identify the information fields or controller roles, establish Mastercard receipt of SHVA transaction data, or disclose processing locations or security terms.²⁴

No public evidence identified of Mastercard-specific board representation, audit rights, transaction-data access, information rights, access to SHVA production systems, or exercise of such rights.^{16, 24, 39, 40} The reviewed sources also do not confirm Mastercard’s precise current SHVA shareholding after 2019.^{16, 24}

Civil Society Scrutiny & Regulatory History

Bank Hapoalim and Mizrahi Tefahot Bank, both documented Mastercard-network card issuers in Israel, are profiled by the Who Profits and AFSC Investigate databases for operating branches and ATMs in West Bank settlements including Ariel and Ma’ale Adumim.^{41, 42, 43, 44} Mastercard’s relationship to settlement activity through this network is indirect, running through network fees on transactions processed by settlement-branch-operating banks rather than direct operational presence.^{41, 42, 43, 44}

No public evidence identified in the reviewed OHCHR 2023 settlement-business database, its 2025 update, or the July 2025 UN Special Rapporteur report A/HRC/59/23 that Mastercard is listed or mentioned; this is document-scoped and does not establish absence from all settlement-linked commercial activity.^{45, 46, 47} The July 2025 report names 48 corporations and institutions across military, technology, financial, and academic sectors, but Mastercard is not identified in the checked report text.^{46, 47}

Mastercard Vice President of Government Affairs and Policy Raisa Sheynberg is named as a board member of the Gaza Humanitarian Foundation (GHF), the Israeli-security-cabinet-approved Gaza aid-distribution mechanism approved in early May 2025.^{48, 49, 50, 51} NGOs and reporting have criticized GHF as politicised and scrutinized Israeli military involvement in distribution-site security and reported casualties near aid sites.⁵² The public May-2025 memorandum names Sheynberg, but the expanded political audit distinguishes that listing from verified tenure, performed duties, or authority to represent Mastercard. No evidence was identified of Mastercard authorization, institutional participation or resources; the association should not be treated as a verified corporate role.^{48, 49, 50, 51}

No public evidence identified of an organized boycott or divestment campaign specifically targeting Mastercard’s technology provision to Israel, and Mastercard does not appear among primary BDS Movement-listed targets in the reviewed campaign materials.⁴⁵ No public evidence identified of regulatory inquiries, export-control actions, or sanctions-related investigations involving Mastercard’s technology sales or services to Israeli state entities.^{7, 8, 10} No public evidence identified of a Mastercard corporate statement addressing the ICJ Advisory Opinion of 19 July 2024 or the November 2024 ICC arrest warrants, nor of a documented modification to Israeli operations following either milestone.^{12, 11, 24}