Digital Audit: SAP

Enterprise Technology Stack & Vendor Relationships

• SAP Enterprise Cloud Services announced in August 2024 that it selected CyberArk for privileged and sensitive-access control across its cloud services, and the same release described SAP ECS as operating core environments for more than 6,000 organizations on hundreds of thousands of servers ¹.
• SAP’s own 2026 materials describe SAP Labs Israel as a central development site for SAP Business AI, multi-cloud, user-experience, and privacy work, which evidences a substantial in-country engineering footprint rather than a disclosed third-party procurement relationship by itself ².
• Israeli government materials describe the Sigma/Merkava environment as a SAP-based core government system, and a 21 September 2025 procurement notice records a Ministry of Health purchase for SAP licenses and maintenance through SAP Israel Ltd ³⁴.
• SAP’s 2026 subsidiaries filing identifies Israeli corporate entities within the SAP group, supporting the presence of direct local operating structures rather than a purely distributor-led model ⁵.
• No public evidence identified.
• In the reviewed memo record, no direct public evidence was identified of SAP holding disclosed enterprise-stack licensing, subscription, or integration relationships with Check Point, Wiz, SentinelOne, Nice, Verint, Claroty, or Palo Alto Networks, after review of SAP filings, SAP product materials, data-center documentation, and the CyberArk announcement ⁵¹⁶⁷.

Surveillance, Biometrics & Retail Technology

• The reviewed memo did not identify public evidence that SAP uses Israeli-origin facial recognition, gait analysis, behavioral analytics, or frictionless-checkout technologies from firms such as Trigo, BriefCam, AnyVision/Oosto, or Trax ⁸⁶⁷⁹¹⁰.
• The same source set did not surface public evidence of SAP using Israeli-origin predictive policing, sentiment analysis, social-media monitoring, or workforce-surveillance tools ²⁸⁵.
• The reviewed materials also did not identify public evidence that such technologies reach SAP indirectly through bundled suites or managed-service layers within the SAP cloud stack ¹⁶⁷.
• SAP’s Israel visitor identity-management privacy statement evidences on-premises identity and visitor-processing practices in Israel, but the memo did not connect that statement to biometric or surveillance vendor deployments ⁸.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

• SAP Help documentation dated 13 May 2026 lists Israel (Tel Aviv) as a Google Cloud-backed SAP Business Technology Platform region with the technical key il30 ⁶.
• SAP’s 2023 cloud data-center list includes Israel / Tel Aviv for multiple SAP cloud-service families, including entries associated with RISE with SAP S/4HANA Cloud private-edition infrastructure ⁷.
• Israeli government Nimbus materials identify Amazon Web Services and Google Cloud, not SAP, as the public-cloud providers selected for Project Nimbus ¹¹¹².
• The same Nimbus materials state that government ministries can procure third-party cloud services through AWS and Google marketplaces, but the reviewed memo did not surface a SAP-specific Nimbus award or a named SAP implementation role ¹¹¹².
• The available SAP platform and data-center materials evidence general cloud availability in Israel, but the reviewed memo did not identify a public SAP disclosure of a distinct sovereignty or resilience offering marketed specifically to Israeli military bodies ⁶⁷¹¹¹².

Defence, Intelligence & Security Sector Technology Relationships

• Reuters reporting syndicated by Ynet stated in January 2012 that SAP Israel signed a $10 million agreement to supply the Israel Defense Forces and the Ministry of Defense with ERP solutions, following a recent three-year licensing contract with the Ministry of Defense ¹³.
• The same report stated that the covered branches included the IDF Technological and Logistics Directorate, the Personnel Directorate, Ground Forces, and the planning branch, while the reviewed source set did not confirm the current status of that arrangement ¹³.
• The Israeli Ministry of Defense’s Applications and Technology Department states that it manages information and communication infrastructure, data centers, internal communication networks, and services for Ministry branches, the IDF, and defense exporters, which provides institutional context for large defense IT environments without naming SAP in that page itself ¹⁴.
• Israeli government materials describe Sigma/Merkava as a government-wide SAP-based ERP environment used across roughly 90 ministries and units, with HR, procurement, finance, budget, and related functions ¹⁵³.
• A 21 September 2025 procurement notice for SAP licenses and maintenance through SAP Israel Ltd indicates continuing SAP procurement activity within Israeli public administration, although the notice cited in the memo is for the Ministry of Health rather than a defense body ⁴.
• No public evidence identified.
• In the reviewed memo record, no public evidence was identified that SAP developed, sold, licensed, or maintained offensive cyber tools, zero-day exploit tools, or digital weapons systems for Israeli state actors ²⁵¹³¹⁴.

AI, Algorithmic & Autonomous Systems

• SAP states that SAP Labs Israel plays a central role in SAP Business AI and that the site developed products including SAP BTP, SAP Business Data Cloud, SAP Build, and SAP Customer Data Platform ².
• SAP’s September 2024 acquisition announcement for WalkMe states that WalkMe’s digital-adoption platform integrates generative AI and would be used to enrich SAP Business AI offerings ¹⁶.
• WalkMe’s 2024 Form 20-F identified the company as headquartered in Tel Aviv and disclosed that, as an Israeli company, it was subject to Israeli laws concerning governmental access to data ¹⁷.
• The reviewed memo did not identify public evidence that SAP provided AI or machine-learning systems, computer vision, or autonomous decision-support systems to Israeli state, military, or security bodies ^2161314.
• The reviewed memo also did not identify public evidence that SAP models or platforms were trained on civilian-population data, intercepted communications, or surveillance-derived datasets from Israel or the occupied territories ²¹⁶¹⁷.
• The reviewed materials did not identify public evidence of SAP supplying autonomous target-generation, automated lethality, or autonomous tracking systems to Israeli forces ²¹⁴¹⁰.

Technology Ecosystem & R&D Footprint

• SAP states that SAP Labs Israel was founded in 1998, and current SAP materials identify SAP Israel Ltd. in Ra’anana together with SAP Labs and SAP Portals facilities in Ra’anana and Tel Aviv ²¹⁸⁸⁵.
• SAP’s corporate history states that it acquired TopTier in 2001 and describes TopTier as Israel’s market leader in enterprise portals ¹⁹.
• SAP’s acquired-brands materials state that SAP acquired Gigya in 2017 and that Gigya technology now underpins SAP Customer Data Cloud ²⁰.
• SAP announced on 18 September 2024 that it completed the acquisition of WalkMe, and WalkMe’s pre-close SEC filing described the company as headquartered in Tel Aviv, Israel ¹⁶¹⁷.
• Patent records for EP2141645A1 list SAP Portals Israel Ltd. as the original assignee, indicating that at least part of SAP’s patent-generating activity has been attributed to its Israeli corporate footprint ²¹.
• The reviewed memo did not identify public evidence of co-owned patent portfolios, licensing agreements, or co-development arrangements between SAP and Technion, the Hebrew University of Jerusalem, or the Weizmann Institute ²²¹.

Civil Society Scrutiny & Regulatory History

• The research memo records a document-scoped absence of SAP from the 30 June 2023 OHCHR update of the database of business enterprises involved in settlement activity, while noting that this absence was reported in the supplied brief rather than independently re-run in-tool against the UN copy during the memo pass ⁹.
• The research memo likewise records no SAP mention in the advance-edited 30 June 2025 UN document A/HRC/59/23, with the same caveat that the memo reflected the supplied brief’s deterministic full-text pre-scan rather than an independent reproduction during the memo pass ¹⁰.
• The reviewed memo did not identify a SAP-specific company page or campaign page in the AFSC Investigate methodology set, the Who Profits corporate-database section reviewed, or the BDS Movement page supplied in the brief ²²²³²⁴.
• The reviewed memo also did not identify public evidence of regulatory inquiries, export-control actions, sanctions investigations, or court challenges specifically concerning SAP technology sales or services to Israeli state entities ⁵¹³¹⁴.
• The memo separately records that no settlement-specific reseller, franchisee, or deployment evidence for SAP in occupied territories was identified within the reviewed source set ⁹²³.