Netlify DIGITAL

Target: Netlify, Inc. Research date: 23 October 2026 Domain: Digital Forensics (Digital)

Enterprise Technology Stack & Vendor Relationships

Corporate and technology profile

Netlify describes itself as a venture-backed software company founded in 2014 by Mathias Biilmann and Christian Bach, headquartered in San Francisco, and providing tools for building, deploying and scaling web applications; its company profile identifies investors including Andreessen Horowitz, Bessemer Venture Partners, BOND, EQT Ventures, Kleiner Perkins and Menlo Ventures.¹

Israeli-origin software integration: Wix

On 10 May 2023, Netlify published an announcement describing its partnership with Wix to support Wix Headless, combining Wix’s business-management APIs and services with frontend applications deployed through Netlify; the announcement identifies Bookings as an initial integration and describes templates for events, ecommerce and content management.²

Netlify’s publicly accessible integration catalogue continues to list Wix as a supported provider for content management, ecommerce, scheduling, event management and subscription services as of the October 2026 review.³

Netlify’s Wix Content Manager integration describes using Wix Data APIs to store and manage application content while deploying the frontend through Netlify.⁴

The Wix Bookings integration provides application developers with access to appointment scheduling, payments, staff management, customer information and related business services.⁵

The Wix Events integration supports ticketing and RSVP functionality through Wix Events APIs.⁶

The Wix Ecommerce integration supports use of Wix commerce services for products, inventory, payments, shipping and fulfilment in applications deployed through Netlify.⁷

The Wix Pricing Plans integration supports subscriptions, memberships and recurring or one-time payments.⁸

The 2023 partnership announcement describes a workflow in which a user authorises Netlify to read Wix site and business information, after which the integration configures a frontend client identifier for deployment; this establishes an API integration mechanism involving customer-selected Wix services.²

Israeli-origin cybersecurity integrations

Netlify publishes a Snyk integration for identifying and monitoring vulnerabilities in JavaScript dependencies, including a build-security workflow intended to prevent deployments containing identified vulnerabilities.⁹

The Snyk listing also describes protection for Netlify Functions and software licence compliance checking; the listing establishes an available developer-platform integration, while internal Netlify procurement of Snyk remains unconfirmed.⁹

Other named infrastructure providers

Netlify’s public Trust Center identifies Amazon Web Services as a subprocessor providing hosting, compute, storage, networking and managed cloud services for Netlify infrastructure.¹⁰

The same Trust Center identifies other providers used for data processing and platform operations, including Altinity/ClickHouse for managed analytical databases; its supplier register distinguishes infrastructure vendors from customer-selectable integrations.¹⁰

Technology dependency and scale

The Wix documentation establishes multiple customer-facing integrations across business-critical application categories, including content, commerce, bookings and payments, but does not disclose the number of customers using each integration or the associated revenue.³

Netlify’s broader integrations catalogue includes numerous developer frameworks, content-management products and third-party application services, with integrations available through its published platform catalogue.¹¹

Procurement and systems integrators

No public evidence identified of a Netlify systems integrator mandating Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty or another named Israeli-origin security product within Netlify’s internal infrastructure; the reviewed public supplier and integration disclosures identify specific providers but do not constitute a complete procurement ledger.^{10, 11}

No public evidence identified establishing that the documented Wix or Snyk integrations represent mandatory dependencies for all Netlify deployments.^{3, 9}

Wix integration: controllers and processing responsibilities. Wix’s published Data Processing Agreement establishes that the customer operating a Wix service is the controller of its users’ personal information and Wix is the processor. Section F expressly states that information received from the European Economic Area, United Kingdom and Switzerland is initially transferred to Wix.com Ltd. in Israel under the European Commission’s adequacy decision. This establishes an Israeli corporate processing and legal-access nexus for customer-selected Wix services connected to Netlify. It does not establish that Wix controls Netlify’s infrastructure or receives unrelated Netlify customer datasets.^{12, 13}

Wix integration: relevant data categories. Wix’s law-enforcement policy identifies subscriber names, email addresses, telephone numbers, postal addresses, payment-source information, service usage, session records, IP addresses, transactional records and website content among information potentially held by Wix. Its processing agreement additionally permits customer-defined information concerning customers, prospective customers, employees, contractors and other individuals. Consequently, the documented Netlify–Wix integrations can expose relevant business and personal information to Wix processing where the developer configures the corresponding services and supplies that information; the precise categories depend on the particular implementation.^{12, 14, 15}

Wix integration: current operational status. As of 23 October 2026, Netlify’s public Wix catalogue continues to advertise the integration and its business-service templates. The Bookings template identifies Wix as its developer and describes access to appointments, payments, staff, clients, reminders and subscriptions. The Content Manager template identifies Wix Data APIs as the means of storing and managing content. These public listings support continued availability of the documented integration workflow but do not independently establish production uptime, the number of active integrations, individual customer deployments or current transaction volumes.^{3, 5, 4}

Surveillance, Biometrics & Retail Technology

Facial recognition and biometrics

No public evidence identified of Netlify procuring or deploying facial-recognition, biometric-identification, gait-analysis or retail surveillance technologies supplied by Trigo, BriefCam, AnyVision/Oosto, Trax or comparable Israeli-origin providers; Netlify’s published platform integrations and corporate technology disclosures do not establish such arrangements.^{11, 1}

Predictive analytics and monitoring

Netlify’s April 2026 privacy statement identifies collection and processing of website interaction information, service usage data, device identifiers and IP addresses, and describes analytics and service-improvement purposes.¹⁶

No public evidence identified of Netlify deploying Israeli-origin predictive policing, workforce surveillance, law-enforcement sentiment analysis or social-media intelligence products; its disclosed analytics and data-processing activities do not establish those specific applications.^{16, 10}

Third-party surveillance deployments

The published Wix integrations allow developers to connect applications with Wix business systems, but the reviewed integration documentation does not identify facial-recognition or policing functionality.^{3, 4}

No public evidence identified that Netlify’s published Snyk integration bundles offensive surveillance, biometric identification or predictive policing systems.⁹

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Cloud infrastructure

Netlify identifies AWS as a cloud infrastructure subprocessor responsible for compute, storage, networking and associated managed services.¹⁰

Netlify’s Functions documentation identifies US East Ohio as the default execution region for applicable newer sites and documents configurable execution regions in North America, Europe, South America and the Asia-Pacific region; it also notes that sites created before 4 October 2023 may have a different default.¹⁷

The publicly documented Functions region list includes locations such as Ireland, Frankfurt, London, Tokyo and Singapore, but does not identify an Israeli execution region.¹⁷

Distributed application execution

Netlify’s Edge Functions documentation describes executing application logic close to users through its distributed edge infrastructure.¹⁸

Netlify’s Image CDN documentation describes image transformation and optimisation performed through Netlify’s delivery infrastructure.¹⁹

Netlify’s Forms documentation describes collection and management of submissions made to websites deployed on the platform.²⁰

Data-exposure principle

Netlify’s April 2026 privacy statement describes processing of account information, customer content, deployments, activity data, IP addresses, device identifiers, payment-related information and information received through connected services.¹⁶

The same statement provides for international transfers of personal data, sharing with contracted service providers and affiliates, and disclosure to public authorities when legally compelled.¹⁶

Netlify’s published Trust Center identifies processing locations for individual subprocessors, including the United States for AWS in the public register; this does not establish the complete location of all customer-specific application traffic or storage.¹⁰

No public evidence identified establishing that Netlify customer data is systematically stored, processed or routed through infrastructure under Israeli jurisdiction; the reviewed privacy statement and Functions-region documentation do not identify an Israel-specific processing arrangement.^{16, 17}

The Wix integration enables applications deployed through Netlify to communicate with Wix APIs and use Wix business data, but the reviewed documentation does not identify the jurisdiction or physical processing location of individual Wix-connected customer datasets.^{2, 4}

Israeli government cloud contracts

The Israeli Government Procurement Administration describes Project Nimbus as a government cloud programme initiated in 2019 with participation from the Ministry of Finance, national digital and cybersecurity bodies, the Ministry of Defence and the IDF; it identifies AWS and Google as the selected public-cloud suppliers.²¹

Google’s 25 May 2021 announcement confirms its selection for Project Nimbus and describes provision of government cloud services to ministries, authorities and other eligible public-sector organisations.²²

No public evidence identified that Netlify itself is a Nimbus contract holder, named subcontractor, approved marketplace supplier or direct technology provider to the Israeli Ministry of Defence or IDF; the reviewed Israeli government procurement description identifies AWS and Google but does not identify Netlify.^{21, 22}

Data sovereignty and Israeli data centres

No public evidence identified that Netlify operates, leases or manages a dedicated data centre in Israel, or markets an Israeli sovereign-cloud service; its published Functions regions and Trust Center do not identify such a facility or offering.^{17, 10}

No public evidence identified of Netlify providing dedicated data-sovereignty or infrastructure-resilience services contracted by an Israeli state, intelligence or military institution.^{21, 17}

Wix processing: Israeli legal accessibility and geographical limits. Wix’s processing agreement, Section F.18.1, expressly identifies Wix.com Ltd. in Israel as the initial recipient of users-of-users information. Section F.17 permits international processing subject to applicable safeguards, while Section F.18.3 governs onward transfers to subcontractors. Wix’s Trust Center identifies its principal data-centre locations as the United States and Ireland. Accordingly, the documented Israeli jurisdictional connection arises through the receiving processor and its legal obligations; evidence of an Israeli execution region or physical storage location is unnecessary to establish that limited connection. The disclosures do not establish that every Netlify–Wix request is physically executed or persistently stored in Israel.^{12, 23}

Wix downstream exposure. Wix’s subprocessor register expressly states that users-of-users personal data is first processed by Israel-based Wix.com Ltd. and may subsequently be transferred to Wix entities worldwide. It identifies AWS, Google Ireland, Fastly and Snowflake among infrastructure, content-delivery and analytics providers, alongside providers for communications, support, monitoring and data processing. This establishes potential downstream processing categories for data entering Wix services through a configured Netlify integration. It does not establish that every listed provider receives every integration dataset, or that Netlify independently contracts with those providers through the Wix workflow.^{13, 13}

Netlify direct-processing route: provider and jurisdiction evidence. Netlify’s publicly accessible Trust Center identifies AWS as its infrastructure subprocessor, registered as SP-20160510.1, with the United States listed as the processing location. It separately identifies Google Cloud Platform/Zencore Group under SP-20160815.1, also with the United States listed as the location. The register distinguishes these contracted infrastructure providers from customer-selected integrations. Although AWS and Google operate globally, these Netlify-specific disclosures do not establish an Israeli contracting entity, Israeli-controlled operational access or an Israeli legal-access beneficiary for Netlify’s directly processed customer data.¹⁰

Netlify direct-processing route: downstream data exposure. The public register additionally identifies Segment for collecting and routing analytics events, Fivetran for replicating data into analytical infrastructure, Snowflake for data warehousing, and observability providers including Datadog, Axiom and CrowdStrike/Humio. These constitute documented downstream processing relationships with Netlify, but their listed processing locations are in the United States. The register does not identify Israeli recipients or establish that Israeli affiliates, employees or authorities possess operational access to Netlify customer datasets through these arrangements.¹⁰

Netlify direct-processing route: legal and contractual boundaries. Netlify’s April 2026 privacy statement expressly distinguishes processing for which Netlify acts as controller from customer information processed on behalf of enterprise customers under its Data Processing Agreement. Its enterprise subscription agreement restricts processing of customer content to the agreement and applicable DPA. Neither the reviewed public contractual description nor the public subprocessor register establishes an Israel-specific transfer instruction, an Israeli legal entity controlling Netlify infrastructure, or a contractual entitlement for Israeli authorities to obtain Netlify customer information through a named provider.^{10, 16, 24}

23 October 2026 - no public evidence identified: Searches of Netlify’s published subprocessor register, privacy statement and enterprise processing arrangements identified no documented Israeli-controlled processing infrastructure, Israel-specific privileged access arrangement, Israeli legal-access beneficiary or downstream recipient applicable to Netlify’s general customer-data processing independently of customer-selected Wix services. The public disclosures also do not conclusively exclude undisclosed provider support access or contractual arrangements outside the published register.^{10, 16, 24}

Defence, Intelligence & Security Sector Technology Relationships

Military and intelligence contracts

No public evidence identified of a direct Netlify contract with the Israeli Ministry of Defence, IDF, Mossad, Shin Bet or another Israeli state security institution in the reviewed corporate customer disclosures or government Nimbus documentation.^{25, 21}

Netlify’s commercial platform permits developers and organisations to deploy applications and websites, while the published customer catalogue identifies selected customers and use cases without establishing a named Israeli military or intelligence deployment.²⁵

Dual-use technology

Netlify’s documented platform capabilities include web application deployment, serverless functions and distributed edge execution, which are general-purpose application infrastructure technologies.^{1, 17, 18}

No public evidence identified of a particular Netlify application, deployment or service being commissioned or documented for Israeli military intelligence collection, operational surveillance or policing within occupied territories.^{25, 21}

Offensive cyber and digital weapons

The documented Snyk integration concerns software vulnerability identification and deployment security, rather than provision of exploit development or offensive cyber tooling.⁹

No public evidence identified of Netlify developing, selling, licensing or maintaining zero-day exploitation platforms, offensive cyberweapons or digitally controlled weapons systems for Israeli state actors.^{9, 11}

Settlement nexus

No public evidence identified in the reviewed Netlify customer disclosures, integration catalogue or Israeli government procurement material establishing provision of Netlify services to a named settlement municipality, settlement business administration or occupied-territory security programme.^{25, 11, 21}

Continuity following July and November 2024

Netlify continued publishing and offering its developer platform and integrations after July and November 2024, as reflected in its current integrations catalogue and 2026 privacy disclosures.^{11, 16}

No public evidence identified establishing a particular Israeli military, intelligence or settlement-related Netlify contract that continued after either date.^{21, 25}

AI, Algorithmic & Autonomous Systems

General-purpose AI infrastructure

Netlify’s AI Gateway documentation describes infrastructure enabling applications to access supported AI model providers and integrate model capabilities into developer workflows and deployed applications.²⁶

Netlify’s Trust Center identifies Anthropic among its disclosed service providers for AI-related functionality, distinguishing this provider relationship from customer-selectable integrations and cloud infrastructure dependencies.¹⁰

AI-related data processing

Netlify’s April 2026 privacy statement says that it does not use customer code or customer content to train AI models without explicit opt-in.¹⁶

The privacy statement also describes collection and use of service activity and performance information for operation, security and improvement of the platform.¹⁶

Provision to Israeli state bodies

No public evidence identified establishing that Netlify supplied AI Gateway services, models, machine-learning pipelines or automated decision-support tools to an Israeli military, intelligence or government customer; the reviewed AI Gateway documentation describes general-purpose functionality without identifying such a deployment.^{26, 21}

Training on surveillance-derived datasets

No public evidence identified that Netlify trained AI models using intercepted communications, surveillance-derived civilian datasets or population records originating in Israel or occupied Palestinian territory.^{16, 26}

Autonomous and kinetic systems

No public evidence identified of Netlify developing or supplying autonomous target-generation, fire-control, kill-chain automation or other purpose-built kinetic targeting systems to Israeli military or intelligence organisations.^{26, 25}

Technology Ecosystem & R&D Footprint

Corporate leadership and investors

Netlify’s corporate profile identifies co-founders Mathias Biilmann and Christian Bach and discloses institutional investors including Andreessen Horowitz, Bessemer Venture Partners, BOND, Designer Fund, EQT Ventures, Kleiner Perkins, Mango Capital and Menlo Ventures.¹

Netlify’s November 2021 financing announcement stated that Mary D’Onofrio would join its board, Martin Casado would take a board seat, Elena Verna would join the board, and Ohad Eder-Pressman would move into an observer role; the announcement does not establish their positions as of October 2026.²⁷

No public evidence identified in these reviewed governance disclosures establishing a controlling principal’s corporate-attributable ownership or board role in an Israeli surveillance, military, SIGINT or offensive cybersecurity supplier.^{1, 27}

Research and development facilities

Netlify’s company profile describes a global team and its San Francisco headquarters, without naming an Israeli R&D centre or engineering laboratory.¹

No public evidence identified of a Netlify-operated Israeli engineering office, research centre, accelerator or government-linked innovation facility.^{1, 27}

Acquisitions

On 17 November 2021, Netlify announced its acquisition of OneGraph, a GraphQL-based technology for integrating third-party application services and APIs.²⁷

Netlify’s April 2026 privacy statement lists Stackbit, Inc., Gatsby, Inc., Netlify Canada Limited, Netlify EMEA Limited and Netlify UK Limited as affiliated entities.¹⁶

No public evidence identified in the reviewed acquisition and affiliate disclosures establishing an acquisition of an Israeli military, surveillance, offensive cyber or intelligence technology company.^{16, 27}

Investment programmes

Netlify’s November 2021 announcement described a planned Jamstack Innovation Fund, including a target of $10 million for emerging companies and a separate $1 million commitment to open-source support.²⁷

No public evidence identified in the reviewed fund announcement establishing investment in an Israeli surveillance, military AI, SIGINT or offensive cybersecurity company.²⁷

Patents and intellectual property

No public evidence identified of a Netlify co-development agreement, patent-licensing relationship or sponsored research arrangement with the Technion, Hebrew University, Weizmann Institute or another named Israeli research institution in the reviewed corporate and technology disclosures.^{1, 27}

Civil Society Scrutiny & Regulatory History

United Nations and civil-society scrutiny

No public evidence identified within the reviewed source material establishing that Netlify was specifically investigated for technology provision to Israeli settlements, military surveillance, population monitoring or Project Nimbus; Netlify is not identified in the reviewed official Nimbus programme description.²¹

The Israeli government documentation identifies AWS and Google as Nimbus cloud providers, while Netlify separately identifies AWS as its infrastructure subprocessor; the documents establish two distinct contractual contexts without identifying Netlify as a Nimbus participant.^{21, 10}

No public evidence identified in the reviewed primary disclosures substantiating a specific Netlify deployment cited by Who Profits, AFSC Investigate, Amnesty International, Human Rights Watch or another civil-society organisation as supporting an Israeli military or settlement operation.^{25, 21}

Boycott and divestment campaigns

No public evidence identified of a campaign specifically naming Netlify for direct technology provision to the Israeli military, intelligence agencies or settlement administrations in the reviewed corporate disclosures and procurement records.^{25, 21}

No documented Netlify corporate response to such a specific campaign was identified in the reviewed corporate publications.^{1, 25}

Regulatory and legal actions

Netlify’s public Trust Center identifies security and compliance documentation, including SOC 2 and 2026 information-security certification material, with some reports available only through access requests.¹⁰

No public evidence identified in the reviewed disclosures establishing export-control enforcement, sanctions proceedings or regulatory action against Netlify concerning technology provision to Israeli government, military, intelligence or settlement entities.^{10, 16}

Platform and content moderation

Netlify’s published privacy statement describes the collection and processing of platform data and the circumstances in which information may be disclosed to public authorities.¹⁶

No public evidence identified in the reviewed disclosures establishing a specific Netlify content-moderation decision concerning Palestinian websites made at the request of Israeli authorities.^{16, 25}

Wix government-data requests: established legal-access procedure. Wix publishes a policy for requests from law-enforcement and governmental authorities, identifying Wix.com Ltd.’s Tel Aviv address as a contact point for legal process. The policy identifies subscriber records, transactional information and website content as potentially responsive categories. It states that Wix evaluates the legal authority of each request, restricts disclosure to information legally required, and ordinarily notifies customers unless notification is prohibited. Wix also states that it does not voluntarily provide governments with direct customer-data access for surveillance purposes. The policy establishes a legally mediated access route concerning Wix-held data, including data associated with customer-selected integrations, without proving disclosure in any particular case.^{14, 14}

Wix transparency and access safeguards. Wix’s public transparency portal describes requests from domestic and foreign governments, courts and civil litigants, and links annual transparency reports covering 2021–2025. Its published policy also permits challenges to requests where the legal basis is uncertain or the request is excessively broad. These disclosures establish a formal process for handling governmental demands; they do not establish that an Israeli authority requested or received information originating from a Netlify-connected Wix application.^{14, 28}

23 October 2026 - no public evidence identified: Searches of Wix’s published law-enforcement policy, transparency portal and processing agreements identified no named Israeli authority request, confirmed disclosure or government-directed surveillance involving a particular Netlify–Wix integration. The absence of a publicly identified case does not negate the Israeli processing relationship expressly documented in Wix’s DPA.^{12, 14, 28}