Squarespace - Digital Audit

Enterprise Technology Stack & Vendor Relationships

• Squarespace’s last public annual filing described a hybrid infrastructure model using company-owned hardware in third-party data centres alongside cloud storage and computing services from Amazon Web Services (AWS) and Google Cloud, and identified connectivity, CDNs, DDoS mitigation, domain registration, DNS, cloud providers, and data centres as critical infrastructure ¹.

• Google Cloud reported that Squarespace migrated its on-premises Hadoop analytics environment to BigQuery, Cloud Storage, Dataproc, and Google Kubernetes Engine, while its customer profile describes further migration of critical workloads to Google Cloud ²³.

• Fastly identifies Squarespace as a customer since 2015 and describes providing CDN, VCL, and security capabilities supporting site delivery, although public materials do not disclose contract duration, pricing, or traffic share ⁴.

• Stripe describes a partnership of more than ten years with Squarespace and lists integrations including Payments, Checkout, Link, Connect, Capital, Issuing, Treasury, Radar, and Tax ⁵.

• Squarespace’s 2023 annual filing names Stripe, PayPal, and Block among payment-processing or payment-integration providers ¹.

• Squarespace’s security documentation describes access controls, least-privilege practices, encryption, security testing, and a dedicated security team, but it does not publicly name endpoint-security, identity, SIEM, network-monitoring, or managed-security vendors ⁶.

• No public evidence identified of Squarespace licensing, subscribing to, or integrating a verified Israeli-origin enterprise or security vendor, including Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty, or Palo Alto Networks ¹⁷⁶.

• No public evidence identified of a systems integrator or outsourcing consultancy deploying Israeli-origin technology for Squarespace, and the documented Google Cloud migration describes collaboration with Google Cloud rather than a separately named integrator ²³.

Surveillance, Biometrics & Retail Technology

• Squarespace Analytics records website activity including page views, sales, traffic sources, and visitor interactions ⁸.

• Squarespace’s Data Processing Addendum (DPA) describes processing IP addresses, device, browser, and network data, clicks, scrolling, timestamps, browsing behaviour, preferences, and page-load information for analytics, security, and fraud-related purposes ⁷.

• These disclosures describe Squarespace platform functions and do not identify an Israeli-origin analytics supplier ⁷⁸.

• No public evidence identified that Squarespace uses Trigo, BriefCam, AnyVision/Oosto, Trax, or another Israeli-origin facial-recognition, gait-analysis, biometric-identification, or frictionless-retail product ¹⁷⁶.

• No public evidence identified of Israeli-origin predictive-policing, sentiment-analysis, social-media-monitoring, or workforce-surveillance technology used by Squarespace ¹⁷⁶.

• No public evidence identified that surveillance or biometric products reach Squarespace through a managed service, security provider, or bundled enterprise suite ⁷⁶.

• Squarespace’s public DPA and security disclosures do not provide a complete internal vendor or subprocessor inventory, which limits public verification of indirect technology relationships ⁷⁶.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

• Squarespace’s public storage guidance states that Squarespace and affiliated products store data in Tier III data centres across the United States ⁹.

• The same guidance states that images and other static assets are distributed through geographically dispersed CDNs and that sites operate in a redundant private-cloud environment ⁹.

• The DPA permits global processing and transfers of site, transaction, communication, analytics, security, and end-user data where Squarespace or its subprocessors operate, particularly to the United States ⁷.

• The DPA also permits responses to binding government or law-enforcement requests and does not identify Israel as a storage or processing location ⁷.

• Fastly’s June 2026 network map lists points of presence across North America, South America, Europe, Africa, Asia, Australia, and New Zealand, without listing an Israeli or Tel Aviv point of presence ¹⁰.

• This Fastly finding is limited because Squarespace reports using multiple CDNs and does not publicly identify its complete CDN inventory ¹⁴¹⁰.

• Google opened its me-west1 cloud region in Tel Aviv in 2022, and AWS documentation lists an Israel (Tel Aviv) Region ¹¹¹².

• Squarespace’s disclosures establish AWS and Google Cloud as infrastructure suppliers but do not disclose account-region selections, workload placement, backup locations, or disaster-recovery configurations ¹⁹⁷³.

• No public evidence establishes that Squarespace workloads or customer data use either supplier’s Israeli region ^1931112.

• No public evidence identified that Squarespace operates, leases, or co-locates data-centre infrastructure in Israel ¹⁹.

• No public evidence identified that Squarespace bids for, participates in, resells, or supplies services under Project Nimbus or another Israeli government cloud programme ¹¹³.

• The UN Human Rights Council report discussing Project Nimbus identifies Google and Amazon in that context but does not identify Squarespace as a contractor or participant ¹³.

• No public evidence identified that Squarespace markets or contracts data-sovereignty, local-residency, continuity, or infrastructure-resilience services to Israeli state or military bodies ¹⁹⁷.

• No public evidence identified that Squarespace customer data is stored or processed in Israeli jurisdiction or on Israeli-controlled infrastructure ⁹⁷¹⁰.

Defence, Intelligence & Security Sector Technology Relationships

• No public evidence identified of contracts, tenders, partnerships, or service agreements between Squarespace and the Israeli Ministry of Defence, Israel Defense Forces, intelligence agencies, police, prison service, or other Israeli security bodies ^1131415.

• No public evidence identified that Squarespace hosting, commerce, analytics, communications, or domain products have been officially confirmed or documented by researchers as deployed for Israeli military, intelligence, or law-enforcement surveillance ¹¹³.

• No public evidence identified that Squarespace develops, sells, licenses, or maintains offensive-cyber capabilities, zero-day exploits, intrusion tools, or digital weapons for Israeli or other state actors ¹⁶.

• Squarespace provides a website platform internationally, but no verified customer, reseller, licence, franchise, state contract, or deployment specifically located in an Israeli settlement was identified ¹⁶¹⁷.

• Squarespace Payments did not list Israel as a supported merchant-bank jurisdiction in June 2026, although eligible merchants elsewhere could accept Israeli shekels ¹⁶.

• Neither international platform availability nor the ability of eligible merchants elsewhere to accept shekels establishes a settlement deployment ¹⁶¹⁷.

• Because no Israeli state, security, or settlement technology-provision relationship was verified, no such provision relationship was available to assess for continuation after 19 July 2024 or after the November 2024 ICC-warrant period ¹³¹⁴¹⁵.

AI, Algorithmic & Autonomous Systems

• No public evidence identified that Squarespace provides AI, machine learning, computer vision, natural-language processing, or algorithmic decision-support services to Israeli state, military, intelligence, police, or prison bodies ¹¹³.

• No public evidence identified that a Squarespace model or AI platform has been trained on Israeli or Palestinian civilian data, intercepted communications, or surveillance-derived datasets from Israel or the occupied territories ⁷.

• Squarespace’s DPA describes general analytics and security processing but does not identify those datasets or jurisdictions ⁷.

• No public evidence identified that Squarespace provides autonomous target generation, automated threat detection for security forces, autonomous tracking, fire-control, or kill-chain systems ¹¹³.

• No purpose-built targeting or weapons-system product attributable to Squarespace was identified for transfer to military users ¹.

Technology Ecosystem & R&D Footprint

• Permira funds completed the approximately $7.2 billion acquisition of Squarespace on 17 October 2024 ¹⁸¹⁹.

• Anthony Casalena remained CEO and board chair, rolled over a substantial majority of his holdings, and remained one of the largest shareholders following the transaction ¹⁸¹⁹.

• The merger proxy estimated indirect-parent ownership after contemplated contributions at approximately 33.4% for Casalena, 8.5% for General Atlantic, and 0.5% for Accel ¹⁹.

• Squarespace’s current executive page identifies Casalena as founder and CEO and John Colton as CTO, but it does not publish an equivalent current post-privatization board roster ²⁰.

• Squarespace’s final public-company board in April 2024 comprised Casalena, Andrew Braccia, Michael Fleisher, Jonathan Klein, Liza Landsman, Anton Levy, and Neela Montgomery ²¹.

• Braccia was an Accel partner and Levy was General Atlantic’s global technology head, while continuation of these directorships after the October 2024 privatization is not publicly confirmed ²¹²⁰.

• A 2022 Calcalist report stated that, while a Squarespace director, Levy led General Atlantic’s Israel activity and Tel Aviv expansion, and reported approximately $750 million of General Atlantic investments in Israeli companies including Fireblocks, AppsFlyer, Transmit Security, VAST Data, HiBob, Atera, Riskified, and Zoomin ²².

• General Atlantic currently lists a Tel Aviv office, but its Israel activity and the activities of a then-Squarespace director do not establish Squarespace procurement, investment, or operational relationships with those companies ²³²².

• Permira completed a majority acquisition of Israel-based BioCatch on 9 September 2024, before its acquisition of Squarespace ²⁴¹⁸.

• BioCatch describes its fraud-detection technology as using behavioural, device, and network signals, and Permira identifies Ran Maidan as its Israel head and BioCatch chair ²⁵²⁶.

• No public evidence identified of an operational, procurement, data-sharing, corporate-subsidiary, or service relationship between Squarespace and BioCatch ¹⁸²⁴²⁷.

• Visa announced an agreement on 3 August 2026 to acquire BioCatch from Permira-advised funds and other shareholders for $2.4 billion, subject to regulatory approvals and closing conditions ²⁷.

• Permira’s majority ownership of BioCatch began after 19 July 2024 and had not been confirmed as exited by the research cutoff ²⁴²⁷.

• No public evidence identified that BioCatch supplied the Israeli state, military, settlements, or occupied-territory surveillance operations during Permira’s ownership period ²⁴²⁵²⁷.

• No public evidence identified of a Squarespace engineering office, R&D centre, innovation laboratory, accelerator, or workforce operation in Israel ¹²⁰.

• No public evidence identified that Squarespace itself acquired an Israeli-origin company or invested directly in an Israeli startup or venture fund ¹.

• No primary-source evidence identified of Anthony Casalena or another currently disclosed Squarespace executive making a personal or family-office investment in an Israeli surveillance, SIGINT, military-technology, cyber, or AI company ¹⁹²⁰.

• No public evidence identified of significant patent licensing, assignment, co-development, or research arrangements between Squarespace and an Israeli-domiciled company, Technion, Hebrew University, Weizmann Institute, or another Israeli research institution ¹.

• Squarespace has been privately held since October 2024, and public materials do not provide a complete current board, ownership percentages, or internal related-party oversight arrangements ¹⁸¹⁹²⁰.

Civil Society Scrutiny & Regulatory History

• The 2023 and 2025 OHCHR settlement-business database updates do not name Squarespace as a company, which is a document-scoped absence rather than a conclusion about evidence outside those database iterations ¹⁴¹⁵.

• The UN Human Rights Council report A/HRC/59/23 discusses Project Nimbus, surveillance, AI, Microsoft, Google/Alphabet, Amazon, IBM, and Palantir, but does not identify Squarespace as a technology provider or implicated business ¹³.

• References to static1.squarespace.com in that report are URLs hosting cited third-party source materials rather than findings about Squarespace ¹³.

• Human Rights Watch’s 2018 report Bed and Breakfast on Stolen Land contains a static1.squarespace.com URL in a footnote linking to a third-party Booking.com document, but it does not identify Squarespace as a settlement-listing business, vendor, or subject of its findings ²⁸.

• The March 2025 Ensuring Genocide report contains Squarespace-hosted URLs for campaign material concerning Maersk shipments to Israel, but the references concern Maersk and linked documents rather than Squarespace as an insurer, carrier, arms supplier, or subject of the underlying claim ²⁹.

• The 2024 BDS corporate-priority guide and the cited BankTrack/Don’t Buy Into Occupation material do not identify Squarespace, which remains a document-scoped result only ³⁰³¹.

• No NGO, UN, or academic investigation specifically establishing a Squarespace technology relationship with the Israeli state, military, settlements, or occupied territories was identified ¹³²⁸²⁹.

• No public evidence identified of an organized campaign specifically targeting Squarespace for technology provision to Israel or the occupied territories, or of a corresponding Squarespace response ³⁰³¹.

• Informal and unsourced boycott-list entries were treated as unresolved leads and are not relied upon as evidence in this audit ³⁰³¹.

• No public evidence identified of an export-control action, sanctions investigation, regulator inquiry, OECD National Contact Point complaint, or lawsuit concerning Squarespace technology sales or services to Israeli state entities ¹¹⁴¹⁵.