Digital Audit: Salesforce

Enterprise Technology Stack & Vendor Relationships

Checkmarx, the Israeli-founded application-security company established in 2006 by Maty Siman and Emmanuel Benzaquen, is Salesforce’s designated static-analysis provider for the mandatory AppExchange Security Review, with Salesforce partnering to give ISV partners free use of the Checkmarx Static Analysis Suite (CxSAST) when submitting apps for review ¹². This is an embedded, non-peripheral relationship: Checkmarx scanning is a named component of Salesforce’s own platform-security certification pipeline for all third-party AppExchange applications, and the relationship remains active in current Salesforce developer documentation ². Salesforce Ventures was an early investor in Checkmarx’s Series B round (November 2013, $8M, alongside XT Hi-Tech and K1 Investment Management), and Checkmarx was later named as an early portfolio company of a dedicated $100M Salesforce Ventures accelerator/investment initiative targeting European and Israeli startups in cloud, AI, fintech and insurtech, alongside CoolaData, OwnBackup and CloudLock ³. Checkmarx was subsequently acquired by outside investors for $1.15 billion, a transaction reported in Israeli press independent of Salesforce ⁴.

Salesforce Ventures led or participated in the Series B, C, D and E rounds of Wiz, the Israeli cloud-security company founded by Unit 8200 alumni Assaf Rappaport, Ami Luttwak, Yinon Costica and Roy Reznik, beginning with a $120 million Series B in May 2021 ⁵⁶⁷. Wiz was acquired by Google for $32 billion in a deal that closed around March 2026, representing a major exit for Salesforce Ventures’ investment ⁸. Marc Benioff, Salesforce’s Chair and CEO, personally invested in Wiz’s 2020 seed round ($21 million, alongside Sequoia and Cyberstarts) and in other Israeli or Israeli-founded startups including BigID (data-security/privacy), Zebra Medical Vision (AI medical imaging) and Enclave, an Israeli AI-code-security startup that raised $6 million alongside 8VC, Patrick Collison, Aaron Levie and Jeremy Stoppelman ^9101112.

Salesforce’s 2024 acquisition of Zoomin, an Israeli data-management company, brought in founders with prior senior roles at Israeli communications-intelligence-adjacent firms: co-founder Gal Oron previously worked as an M&A manager at Verint, and co-founder Hannan Saltzman was a former senior executive at NICE Systems, both companies with long-documented histories of supplying communications-interception and analytics technology, including to state security customers ¹³¹⁴. This is a personnel-lineage finding rather than an equity relationship, but it is now inherited into a wholly-owned Salesforce subsidiary following the acquisition’s close around November 1, 2024 ¹³¹⁴. CyberArk, the Israeli-founded identity-security vendor, uses Salesforce’s Experience Cloud/Partner Community platform to run its own partner-management program, which reflects CyberArk’s use of Salesforce as a platform vendor rather than Salesforce procurement of CyberArk’s product. No public evidence identified of Salesforce itself being a CyberArk customer for internal identity security, and No public evidence identified of a direct enterprise licensing relationship between Salesforce and Check Point, SentinelOne, NICE, Verint or Claroty as internal security or network-monitoring vendors. No public evidence identified of named systems integrators or IT-transformation consultancies contracted by Salesforce that mandated or recommended Israeli-origin security technology as part of Salesforce-led engagements.

Surveillance, Biometrics & Retail Technology

Salesforce has stated publicly that it has never offered facial-recognition technology, with the company’s own account being that “in 2017, when we launched our AI Einstein Vision product, we made the conscious decision to prohibit facial recognition as part of our commitment to Equality” ¹⁵. No public evidence identified of any commercial relationship between Salesforce and Israeli-origin biometric or facial-recognition vendors such as Trigo, BriefCam, AnyVision/Oosto or Trax for retail loss-prevention or store-analytics applications. No public evidence identified of Israeli-origin predictive-policing, sentiment-analysis, social-media-monitoring or workforce-surveillance tools being used internally by Salesforce or resold through its platform. No public evidence identified of indirect delivery of any such surveillance or biometric technologies to Salesforce via bundled managed-security or third-party platform arrangements.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Salesforce does not operate or own a data centre in Israel; instead, it launched Hyperforce, its cloud-native hyperscaler-hosted architecture, in Israel on September 10, 2024, as its 17th global Hyperforce location, running on AWS’s Israel (Tel Aviv) Region infrastructure, with Google Cloud flagged as a possible future option ^16171819. Salesforce’s own regional sales lead, Itai Margalit, framed the local launch as serving “organizations in the public and private sectors” and explicitly referenced “Project Nimbus, a large-scale multi-year flagship project managed by the government of Israel,” noting that such entities “cannot go out of the boundaries of Israel” for regulatory and privacy-law reasons ¹⁹²⁰. This framing positions Salesforce’s Israel cloud launch as complementary to Nimbus and Israeli-government data-residency needs, even though Salesforce is not named as a direct Nimbus prime contractor, a role held by Google and AWS ¹⁹. Prior to the local launch, Israeli government use of Salesforce reportedly already occurred via Salesforce’s Frankfurt data centre, with Udi Shvekey, Salesforce’s lead Hyperforce architect, stating that “the Israeli government approved our Frankfurt data center, for government use” ¹⁹. All existing Salesforce customers in Israel were slated for migration to the new local Hyperforce-Israel platform following the September 2024 launch ¹⁶¹⁷. Bank Leumi, an Israeli bank, was named as the first live customer on the Hyperforce Israel platform, used to power AI-based digital banking capabilities ¹⁹.

AWS’s Israel (Tel Aviv) Region, the underlying infrastructure on which Salesforce Hyperforce runs, is described by Israeli trade press as covering, via the broader Project Nimbus government framework, “all branches of the Israeli government, including the military, the Israeli Security Agency (Shabak/Shin Bet), Police, and Prison Service” ²¹. This describes the AWS/Nimbus government-cloud ecosystem generally; No public evidence identified that Salesforce’s own Hyperforce workloads are specifically provisioned into a segregated Nimbus government/defense enclave as opposed to AWS’s general-availability commercial Israel Region. No public evidence identified of Salesforce being named as a formal Project Nimbus consortium member or subcontractor. No public evidence identified of Salesforce services being explicitly marketed to Israeli military bodies for “resilience” or “digital sovereignty” purposes beyond the general government and regulated-sector data-residency framing described above.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of a direct, named contract or service agreement between Salesforce and the Israeli Ministry of Defence, IDF, Mossad or Shin Bet. Salesforce launched “Missionforce” on September 16, 2025, a new business unit intended to focus on the needs of defense, intelligence and aerospace agencies around personnel, logistics and decision-making, led by Kendall Collins, CEO of Government Cloud ²²²³. In January 2026, Salesforce, operating via its subsidiary Computable Insights LLC (“Salesforce National Security”), won a $5.6 billion IDIQ contract with the US Army for data-analytics and agentic-AI capability ²⁴. Marc Benioff has stated publicly that Salesforce beat Palantir for elements of this contract because “our prices are just so much lower” ²⁵. Salesforce and Palantir are described in trade press as competitors rather than partners in the government-technology space; a technical Foundry-Salesforce data connector exists for customers running both platforms, but this reflects product interoperability rather than a corporate partnership ²⁶. This Army contract and the Missionforce unit are documented US Department of Defense relationships; No public evidence identified of any Israel-specific Missionforce or national-security deployment. No public evidence identified of offensive cyber capability, zero-day exploit tooling, or digital-weapons development or sale by Salesforce, and No public evidence identified of Salesforce commercial products being documented as repurposed by Israeli state actors for military or intelligence surveillance in Israel or the Occupied Palestinian Territories.

AI, Algorithmic & Autonomous Systems

No public evidence identified of Salesforce providing AI/ML, computer-vision, or autonomous decision-support systems to Israeli state, military or security bodies specifically; the confirmed Missionforce and Agentforce for Government deployments are documented only in a US federal/DoD context ²⁴²²²³. Salesforce’s stated 2017 policy decision to prohibit facial-recognition capability within its Einstein Vision AI product remains the company’s own account of its position on biometric AI ¹⁵. No public evidence identified that any Salesforce AI model, including Einstein or Agentforce, has been trained on or given access to civilian population data, intercepted communications, or surveillance-derived datasets originating from Israel or the Occupied Palestinian Territories. Autonomous targeting and lethality systems fall outside Digital domain scope; No public evidence identified in any case of Salesforce providing such systems to any military customer.

Technology Ecosystem & R&D Footprint

Salesforce entered the Israeli market in 2011 via its acquisition of Navajo Systems and has since built what it and Israeli trade press describe as one of its three global strategic R&D hubs alongside the US and India, with approximately 750–900 employees across sites in Tel Aviv and Nazareth ²⁷²⁸. Subsequent Israeli-origin acquisitions include Blue Tail (2012), Kreios/Kransen (2015), Implicit (2016) and Datorama, an AI/big-data marketing-intelligence company acquired for $850 million in July 2018 that became an Israel R&D facility ²⁷. Salesforce acquired ClickSoftware, an Israeli cloud field-service-management company whose customers include airlines, railroads, governments and hospitals, for $1.35 billion in August 2019 ²⁹³⁰³¹. In September 2024 Salesforce acquired Zoomin, an unstructured-data/AI company, for approximately $450 million, with the deal closing around November 1, 2024 ^13323314. On September 5, 2024, Salesforce also announced the acquisition of Own (OwnBackup), a data-backup and recovery company, for $1.9 billion, with the deal closing on November 18, 2024 ^34353637. Own was originally founded in Herzliya in 2006 as “Recover Information Technologies” by Eran Cohen, Daniel Gershoni and Ariel Berkman, the latter having served in IDF intelligence Unit 81 and having developed the underlying cloud-data-recovery technology later commercialized by the company ³⁴. The Own acquisition closed roughly four months after the July 19, 2024 ICJ advisory opinion and approximately three days before the November 21, 2024 ICC arrest warrants, while the Zoomin acquisition closed shortly before the ICC warrants were issued ³⁴¹³. No public evidence identified of a formal Salesforce research or licensing partnership with Technion, Hebrew University or the Weizmann Institute.

Civil Society Scrutiny & Regulatory History

A BDS-aligned company-listing site classifies Salesforce as “Boycott Safe” and states that it found “no verified evidence proving that Salesforce…has any ties to Israel,” an assessment that appears to be an outlier given the R&D, acquisition and cloud-infrastructure findings documented above; this should be treated as one campaign source’s non-listing rather than an authoritative clearance ³⁸. Salesforce does not appear by name in the text extracted from the OHCHR Special Rapporteur’s advance edited version of report A/HRC/59/23 (July 2, 2025), whose named technology and corporate entities in press coverage include Google, Amazon, Microsoft, IBM, Palantir, Chevron, BP, Caterpillar, Glencore, Booking.com, Airbnb, Volvo, Barclays, BNP Paribas, Lockheed Martin, Fanuc, Leonardo and Rada Electronic Industries ³⁹⁴⁰. No public evidence identified of Salesforce being named in the OHCHR Business and Human Rights database materials reviewed ⁴¹⁴². The American Friends Service Committee’s “Companies Profiting from the Gaza Genocide” tracker names AWS, Google/Alphabet, Microsoft, Cisco, Cellebrite, Corsight AI, InfiniDome, Palantir, DJI, Shield AI, Skydio and XTEND, and does not list Salesforce ⁴³. A search of the Don’t Buy Into Occupation 2024 and 2025 report materials did not surface Salesforce among the named companies in retrievable summaries, which instead named Airbnb, Carrefour, Cisco, IBM, Puma, Siemens and Volvo, among others ⁴⁴⁴⁵. No public evidence identified of a Who Profits or Al-Haq investigative dossier specifically naming Salesforce.

Salesforce’s own October 2023 public statement, “Salesforce Response to the Israel-Hamas War,” confirms $1 million each to United Hatzalah, Save the Children and The Association for Immediate Help for Holocaust Survivors, plus $1 million to World Food Program USA for Gaza humanitarian logistics, and states the company “unequivocally stand[s] against racism and hate of any kind, including anti-Semitism and Islamophobia” ⁴⁶. Marc Benioff’s own public commentary on the Israel-Gaza conflict was limited to a single October 2023 social-media post supporting United Hatzalah and Save the Children relief efforts, and Semafor’s October 24, 2023 survey of CEO statements on Israel and Gaza listed Benioff among executives who made only limited public remarks ⁴⁷⁴⁸. No public evidence identified of any OECD National Contact Point complaint against Salesforce in the Israel NCP registry checked directly ⁴⁹. No public evidence identified of export-control actions, sanctions investigations, or regulatory inquiries specifically targeting Salesforce’s technology sales or services to Israeli state entities.

End Notes