INDEX / DIRECTORY / PAYPAL / DIGITAL

PayPal DIGITAL

DIGITAL INFRASTRUCTURE AUDIT UPDATED 2026-09-07
Digital Score 1.82 /10 B PayPal - BDS-1000 708
Digital 1.82

Evidence-only forensic audit. Scoring happens downstream - see the main dossier for the composite assessment.

Forensic audits like this are reader-funded - no sponsors, no ads. Support OpenIntel →

Enterprise Technology Stack & Vendor Relationships

PayPal Holdings, Inc. is a Delaware corporation whose FY2025 filing defines the company as PayPal Holdings, Inc. and its consolidated subsidiaries, identifies its principal executive offices in San Jose, California, and identifies PayPal, Braintree, Venmo, Xoom, Hyperwallet, Honey, Paidy, PayPal Credit, and PayPal Open among its principal brands. 1

PayPal’s significant-subsidiary exhibit lists, among others, Bill Me Later, Inc., Paidy Inc., PayPal (Europe) S.à r.l. et Cie, S.C.A., PayPal, Inc., PayPal Pte. Ltd., and PayPal UK Ltd.; the exhibit is expressly non-exhaustive. 2

Alex Chriss ceased to be CEO and a director on 2 February 2026; Jaime Miller served as interim CEO until Enrique Lores became President and CEO effective 1 March 2026, and David W. Dorman became Board Chair effective 2 February 2026. 3 The 2026 proxy identifies Enrique Lores as President and CEO and identifies Michelle Gill, Frank Keller, Suzan Kereere, and Jamie Miller among executive officers. 4

BlackRock’s Schedule 13G/A reports 71,769,305 PayPal shares, or 8.1% of the class, as of the 30 June 2026 event date. 5 The proxy amendment reports that PayPal directors and executive officers as a group beneficially owned 704,989 shares, less than 1% of outstanding common stock, as of 25 March 2026. 6 No current beneficial owner holding at least 10% was established by the reviewed 2026 SEC materials; this is filing-scoped and does not substitute for a complete real-time beneficial-ownership search. 4, 6, 5

PayPal’s FY2016 filing states that it acquired Israeli company CyActive Security Ltd. in April 2015 for approximately $43 million net of cash acquired to enhance information-security capabilities. 7

Contemporaneous trade reporting described PayPal’s stated intention for CyActive to seed an Israeli security hub connected to a Tel Aviv fraud-and-risk operation, but this reporting is not a current PayPal confirmation of continuing operations. 8

PayPal’s FY2025 filing contains no text match for “CyActive” or “Curv,” and its aggregated intangible-asset and acquisition disclosures do not attribute present deployment, products, revenue, personnel, or infrastructure to either company. 1 No authoritative corporate, regulatory, or transaction record located in the bounded research establishes that CyActive or Curv technology remains deployed or integrated in PayPal, or establishes its current scale; the acquisitions remain verified, but continuing deployment is unknown. 1, 7, 9

No public evidence identified in the reviewed materials of PayPal licensing, subscribing to, or integrating named products from Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty, or Palo Alto Networks. 1, 10, 11

No public evidence identified of a named systems integrator or IT-outsourcer deploying Israeli-origin technology for PayPal. 1, 10, 11

Surveillance, Biometrics & Retail Technology

PayPal’s privacy statement says it may collect voice identification, photo identification, and face scans when a user consents to authentication or identity-verification actions. 11

The same statement describes collection and use of transaction, geolocation, device, network-activity, inferred-risk, and biometric data, alongside automated fraud, risk, and creditworthiness decisions. 11

PayPal’s public privacy materials do not identify the supplier of its biometric or identity-verification technology, including any Israeli-origin vendor. 11

No public evidence identified of PayPal’s use of Israeli-origin facial recognition, gait analysis, retail computer vision, predictive-policing, social-media monitoring, sentiment analysis, or workforce-surveillance products. 1, 10, 11

No public evidence identified that such products reach PayPal through a disclosed managed-security, platform, or bundled-enterprise supplier. 1, 11

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Effective 6 July 2026, PayPal’s Israel user agreement identifies PayPal Israel Payments Services Ltd., company number 516478872, as the entity offering PayPal services in Israel and as a payment-service provider licensed and regulated by the Israel Securities Authority. 10

The agreement gives the entity’s notice address as 98 Yigal Alon Street, 18th Floor, Tel Aviv-Yafo 6789141, Israel, and states that PayPal creates, hosts, maintains, and provides services via the internet; this describes a service function rather than a physical hosting location. 10

PayPal’s migration FAQ states that Israeli users moved from PayPal Pte. Ltd. to PayPal Israel Payments Services Ltd. on 6 July 2026, subject to licence receipt, and describes privacy supervision by the Israel Privacy Protection Authority and direct payment-services supervision by the Israel Securities Authority. 12

The FAQ also states that Israeli users may be required to use multi-factor authentication, complete digital identity verification at relevant transaction thresholds, and provide additional anti-money-laundering information in some circumstances. 12

PayPal’s privacy statement permits its and its service providers’ transfer, processing, and storage of personal information outside a user’s country, including in the United States and other countries. 11

The available materials establish a locally regulated Israeli service entity but do not establish that PayPal customer data are stored, processed, routed, retained, or accessed in Israel, or identify an Israeli data centre, cloud region, colocation provider, data-residency control, or access arrangement for Israeli authorities. 10, 12, 11

No public evidence identified of PayPal participation in Project Nimbus or another Israeli government-cloud programme; the cited Central Tender identifies AWS and Google as the cloud providers, not PayPal. 13

No public evidence identified of PayPal services marketed or contracted as Israeli state digital-sovereignty, data-residency, or infrastructure-resilience services. 10, 12, 13

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of a PayPal contract, partnership, or service agreement with the Israeli Ministry of Defense, IDF, Israeli intelligence agencies, or another Israeli security body within the reviewed source set. 1, 10, 13

No public evidence identified that PayPal products have been documented as deployed for Israeli military, intelligence, or law-enforcement surveillance in Israel or the occupied territories. 1, 11

No public evidence identified of PayPal developing, selling, licensing, or maintaining offensive-cyber capabilities, exploit tools, digital weapons, or purpose-built targeting technology for Israeli state actors. 1, 9, 14

Targeted searches did not produce a primary corporate or regulatory record, reliable biographical source, or acquisition document establishing military- or intelligence-alumni origins for CyActive, Curv, or the technology PayPal acquired. No public evidence identified in this bounded search sufficient to establish that premise; unverified online descriptions or individual-profile claims were not treated as evidence of company origin, PayPal procurement, or technology deployment. 1, 7, 9

This is a bounded finding rather than an exhaustive Israeli-procurement review, and the Nimbus tender is not a comprehensive list of all potential marketplace suppliers. 13

AI, Algorithmic & Autonomous Systems

PayPal states that it may use personal information to train AI models supporting its services and that it uses automated decision-making for risk analysis, fraud prevention, risk management, and creditworthiness assessments. 11

PayPal’s privacy statement says its agentic-AI tools may access user queries, preferences, interests, purchase history, and payment information, while stating that those tools are not designed for legally or similarly significant decisions. 11

In January 2026, PayPal announced an agreement to acquire Cymbio, described as a multi-channel orchestration platform connecting brands with e-commerce and AI-shopping channels, with closing expected in the first half of 2026 subject to conditions. 14

PayPal’s investor-site announcement now states that PayPal completed its acquisition of Cymbio on 5 February 2026. 15 The same source describes Cymbio as founded in 2015 and headquartered in Tel Aviv, and states that its team and technology will enable PayPal’s Store Sync service. 15

PayPal describes Store Sync as making merchant product data discoverable in AI channels and enabling orders to reach merchants’ existing fulfilment and management systems. 15 A 10 April 2026 Vertex announcement independently describes Cymbio as a Vertex Israel Fund V portfolio company acquired by PayPal at an approximately US$160 million valuation, while not disclosing transaction terms from PayPal itself. 16

The investor-site page retains the original forward-looking January wording, but PayPal’s dated completion note resolves the acquisition-status question. 15

No public evidence identified of PayPal providing AI/ML, computer-vision, autonomous-tracking, or target-generation systems to Israeli state, military, or security bodies. 10, 11, 13

No public evidence identified that PayPal AI models have been trained on intercepted communications, surveillance-derived civilian data, or datasets originating in Israel or the occupied territories. 11

Technology Ecosystem & R&D Footprint

PayPal announced and subsequently confirmed completion of its 2021 acquisition of Tel Aviv-based Curv, which it described as cloud-based digital-asset-security infrastructure using multi-party computation technology. 9

PayPal stated that Curv’s team would join its blockchain, crypto, and digital-currencies business unit. 9

The 2015 CyActive acquisition establishes a historical Israeli information-security acquisition, while current evidence in this record does not establish the continuing operational status of the reported Tel Aviv security hub. 7, 8

No public evidence identified of a current CyActive security hub, Curv operational unit, deployment of either technology, or either company’s current personnel and infrastructure scale. 1, 7, 9

No public evidence identified in the reviewed corporate records of a PayPal-operated Israeli R&D centre, engineering office, data centre, cloud region, or infrastructure location beyond the Tel Aviv service-entity address. 2, 10

No public evidence identified of PayPal co-development, licensing, or patent arrangements with Technion, Hebrew University, Weizmann Institute, or another Israeli research institution. 1, 9, 14

Civil Society Scrutiny & Regulatory History

The supplied document-scoped pre-scan found no PayPal full-text mention in the cited 2023 OHCHR settlement-business database update or the 2025 UN Special Rapporteur report A/HRC/59/23; the reviewed materials also did not identify PayPal group entities, directors, executive officers, or named large shareholders in those documents. This does not establish absence from all UN, NGO, civil-society, or database-wide records. 17, 18

In 2018, 7amleh published a report concerning PayPal’s non-availability in Palestine and called on PayPal to provide Palestinians access to its services; this establishes the organisation’s published position rather than independently proving the underlying allegation. 19

In 2024, 7amleh published a position paper alleging discrimination against Palestinians in PayPal’s digital-payment services and described the PayPal4Palestine campaign as operating since 2017; these are the organisation’s advocacy findings, not a PayPal admission. 20

AFSC Investigate lists PayPal under “Discrimination” and links to 7amleh materials and shareholder-resolution material, establishing AFSC’s published characterisation and lead trail only. 21

PayPal’s 2026 proxy includes a shareholder proposal seeking a policy against discriminatory exclusion from financial services in conflict zones, including Palestine, and states that the proposal’s assertions are solely the proponents’ responsibility and may include assertions PayPal considers incorrect. 4

PayPal’s board recommended voting against that proposal and stated that market-entry evaluations consider customer demand, financial impact, competitive landscape, costs, risks, regulatory and compliance requirements, and partner relationships. 4

The proxy response does not announce service availability in the Palestinian Territories or disclose a relationship with Israeli state or security bodies. 4

In 2015, OFAC announced a $7,658,300 settlement with PayPal concerning apparent violations of several U.S. sanctions programmes and inadequate transaction-screening procedures through 2013. 22, 6

The OFAC action does not concern Israel, occupied-territory activity, Israeli state entities, or technology provision to Israel. 22, 6

No public evidence identified of a regulatory inquiry, export-control action, sanctions-related investigation, or legal action concerning PayPal technology provision to Israeli state entities in the reviewed materials. 1, 13

Footnotes

  1. https://www.sec.gov/Archives/edgar/data/1633917/000163391726000024/pypl-20251231.htm ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11 ↩12 ↩13 ↩14

  2. https://www.sec.gov/Archives/edgar/data/1633917/000163391726000024/exhibit2101subsidiarylistf.htm ↩ ↩2

  3. https://www.sec.gov/Archives/edgar/data/1633917/000119312526035860/d68718d8k.htm ↩

  4. https://www.sec.gov/Archives/edgar/data/1633917/000119312526145721/d59508ddef14a.htm ↩ ↩2 ↩3 ↩4 ↩5

  5. https://www.sec.gov/Archives/edgar/data/1633917/000201238326002851/xslSCHEDULE_13G_X02/primary_doc.xml ↩ ↩2

  6. https://ofac.treasury.gov/media/12326/download?inline= ↩ ↩2 ↩3 ↩4

  7. https://www.sec.gov/Archives/edgar/data/1633917/000163391717000027/pypl201610-k.htm ↩ ↩2 ↩3 ↩4 ↩5

  8. https://techcrunch.com/2015/03/10/paypal-confirms-acquisition-of-cyactive-plans-to-open-new-security-hub-in-israel/ ↩ ↩2

  9. https://newsroom.paypal-corp.com/2021-03-08-PayPal-to-Acquire-Curv ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7

  10. https://www.paypal.com/il/legalhub/paypal/useragreement-full?locale.x=en_IL ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10

  11. https://www.paypal.com/us/legalhub/paypal/privacy-full?locale.x=en ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11 ↩12 ↩13 ↩14

  12. https://www.paypal.com/il/cshelp/article/israel-legal-entity-migration---frequently-asked-questions-faqs - help1373?locale.x=en_IL ↩ ↩2 ↩3 ↩4

  13. https://mr.gov.il/ilgstorefront/en/p/attachment/005056BF65EB1EDEB5C7C3681D78414A/%D7%9E%D7%A1%D7%9E%D7%9B%D7%99%20%D7%94%D7%9C%D7%99%D7%9A ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  14. https://about.pypl.com/news-details/2026/PayPal-to-Acquire-Cymbio-Accelerating-Agentic-Commerce-Capabilities/default.aspx ↩ ↩2 ↩3

  15. https://investor.paypal-corp.com/news-and-events/news-details/2026/PayPal-to-Acquire-Cymbio-Accelerating-Agentic-Commerce-Capabilities/default.aspx ↩ ↩2 ↩3 ↩4

  16. https://links.sgx.com/FileOpen/VertexHoldings_BoardSuccession_10Apr2026.ashx?App=Announcement&FileID=883006 ↩

  17. https://www.ohchr.org/sites/default/files/documents/hrbodies/hrcouncil/sessions-regular/session31/database-hrc3136/23-06-30-Update-israeli-settlement-opt-database-hrc3136.pdf ↩

  18. https://docs.un.org/en/A/HRC/59/23 ↩

  19. https://7amleh.org/post/palestine-and-paypal-towards-economic-equality-new-report-by-7amleh ↩

  20. https://old.7amleh.org/2024/05/08/position-paper-on-paypal-discrimination-against-palestinians ↩

  21. https://investigate.afsc.org/company/paypal-holdings ↩

  22. https://ofac.treasury.gov/recent-actions/20150325_33 ↩ ↩2