Stellantis DIGITAL

Research cut-off: 6 October 2026 Target: Stellantis N.V. and attributable controlled entities, with independent importers and third-party vendors distinguished by capacity.

Stellantis’ 2025 Form 20-F provides the corporate baseline for this audit and identifies Daniel Ramot as a non-executive director.¹ Lubinski Group’s current official page describes Lubinski as a family company and one of Israel’s longstanding vehicle importers; it represents Peugeot, Citroën, Opel and DS brands of Stellantis in Israel.² Lubinski is therefore treated as an independent importer/representative, and its separate acts are not attributed to Stellantis without additional evidence.²

Enterprise Technology Stack & Vendor Relationships

Israeli-origin software and services

In April 2021, FCA Italy, described by the Italian Embassy in Tel Aviv as a wholly owned Stellantis subsidiary, signed a cooperation agreement with the Israel Innovation Authority. The authority was to identify Israeli startups and finance development activity, while FCA Italy would support scaling, R&D, marketing and international activity.³ The agreement establishes a structured Israeli-technology collaboration channel in 2021; the reviewed evidence does not establish that the framework remained active in 2026 or that Stellantis operated its own Israeli R&D centre.³

In December 2023, Stellantis’ Venture Awards material identified Vayyar of Israel and its 4D imaging-radar technology for in-cabin monitoring, including seat-belt reminders, anti-intrusion functions and child-presence detection.⁴ Vayyar describes its in-cabin system as radar-based occupant detection/classification that can operate without line of sight.⁵ The award programme covered both startup partners and separately identified investment recipients, but the cited material does not establish a Stellantis equity investment in Vayyar.⁴

On 21 July 2026, Mobileye announced that selected future Stellantis vehicles would use its cloud-enhanced ADAS with Road Experience Management, with initial deployment expected from 2027 on selected U.S. models.⁶ Mobileye says a front-facing camera collects selected road and environmental observations and anonymized data is transmitted to a cloud system that produces road intelligence.⁶ The announcement does not identify the hosting country or legal jurisdiction for those Stellantis-derived data packets.⁶

Ituran provides a more direct connected-vehicle relationship. A 25 February 2026 Ituran release filed with the SEC states that Stellantis selected Ituran for Fiat Connect on the Fiat Strada in South America under an initial three-year agreement with an optional two-year extension.⁷ The described solution includes embedded tracking/connectivity hardware, connected-vehicle services, operation of the technology backend and an end-user mobile application.^{7, 8} Ituran’s May 2025 results release separately states that in March 2025 Stellantis switched its stolen-vehicle-recovery subscriber base to Ituran and Ituran began providing services.⁹ These records establish an Israeli supplier handling connected-vehicle service infrastructure, but they do not disclose the data-centre country, cloud provider, controller/processor allocation or whether Stellantis-derived data is stored or processed in Israel.^{7, 8, 9}

2026 Ituran service-chain addendum. Ituran’s current Form 20-F identifies Ituran Location and Control Ltd. as the Israeli parent and records the May 2025 Stellantis multi-country South American service agreement and February 2026 Connect Fiat expansion.¹⁰ Its significant subsidiaries include Ituran Sistemas de Monitoramento Ltda. and Ituran Serviços Ltda. in Brazil, both 98.75% owned; Ituran Road Track Monitoramento de Veiculos Ltda. in Brazil, 100% owned; Ituran MOB Services Ltda. in Brazil, 51% owned; E.R.M. Electronic Systems Limited in Israel, 49.5% economically owned with 51% voting power; and wholly owned Israeli entities E.D.T.E – Drive Technology Ltd. and Ituran Tech Ltd.¹⁰ The filing does not identify which of these entities is the legal counterparty or performing entity for each element of the Stellantis agreements.¹⁰

The same filing states that Ituran telematics products are manufactured and assembled by manufacturers in Israel, including E.R.M., and in China, and that Ituran and its subsidiaries, mainly in Brazil, Argentina and the United States, purchase GPS/GPRS equipment from E.R.M.; 2025 group purchases from E.R.M. were approximately NIS85.5 million / $24.8 million.¹⁰ Ituran also states that most of its R&D takes place in Israel, Mexico, Colombia and Ecuador and covers service infrastructure, fleet-management applications and cellular/GPS service platforms.¹⁰ This establishes Israeli manufacturing and R&D within the Ituran group beyond supplier nationality alone, but no public evidence identified tying a specific E.R.M.-manufactured unit, Israeli R&D team or Israeli facility to the Stellantis/Connect Fiat deployment.^{7, 10}

The current Google Play listing identifies Stellantis Automóveis Brasil Ltda. as the Connect Fiat app developer/publisher.¹¹ Ituran’s SEC-filed announcement separately states that Ituran supplies the end-user application and operates the technology backend.⁷ These records identify the customer-facing Stellantis Brasil app entity and the Ituran connectivity/backend supplier, but they do not disclose the specific Ituran subsidiary performing the contract or the programme-specific development location.^{7, 10, 11}

Karamba Security’s live site displays Stellantis in a customer/trusted-company logo group and lists an Israeli office.¹² Because the page is undated and does not identify the product, contract date, deployment scope or active production system, it establishes only a public vendor/customer signal, not a specific current Stellantis deployment.¹²

A technical paper published by SAE on 9 April 2024 was co-authored by Bill Mazzara of Stellantis N.V. and Issak Davidovich of C2A Security and addresses component-level threat analysis and ISO/SAE 21434 automotive cybersecurity risk assessment.¹³ The Israel Innovation Authority identifies C2A-SEC Ltd as an Israeli enterprise-software/infrastructure company developing automotive cybersecurity technology.¹⁴ Together these records establish joint technical work; they do not establish a Stellantis purchase, licence or production deployment of C2A software.^{13, 14}

The clearest verified Palo Alto Networks deployment is within controlled Aramis Group rather than Stellantis’ group-wide core stack. Aramis’ 2025 universal registration document records Stellantis control through Automobiles Peugeot, with 60.54% of capital and 67.40% of voting rights at the stated 2025 reporting point.¹⁵ Aramis identifies six local commercial brands across Europe.¹⁶ A Palo Alto Networks customer case dated December 2022 states that Prisma Cloud secures Aramis’ predominantly AWS-based cloud environment, including cloud-native applications, container scanning and cloud-security-posture management.¹⁷ The case does not establish a 2026 renewal, deployment across other Stellantis entities, or Israeli hosting.¹⁷

Targeted review for direct Stellantis deployment of Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint and Claroty produced no public evidence identified in the reviewed public records.^{1, 13, 12}

Scale of dependency

Palantir is the broadest publicly documented enterprise-data relationship identified. Palantir’s May 2022 announcement says Stellantis expanded predecessor FCA and PSA relationships into a global enterprise Foundry licence spanning all 14 brands, business functions and plants, with use cases including manufacturing, supply chain, commercial activity, quality/R&D and analysis of billions of connected-vehicle data points.¹⁸ On 30 March 2026, a Palantir statement announced a new five-year agreement that broadens Foundry use and begins AIP deployment in selected Stellantis functions and regions.¹⁹ The announcement says the collaboration began in 2016 [pre-2020], while the 2026 renewal establishes continuation of the relationship beyond that historical starting point.¹⁹

Mobileye’s 2026 relationship is narrower in the public evidence because the announced REM integration applies to selected future vehicles beginning in 2027.⁶ Ituran’s relationship is specific to connected-vehicle services and the Fiat Connect programme described above.^{7, 8, 9} Vayyar, Karamba and C2A evidence does not establish comparable enterprise-wide dependency.^{4, 13, 12}

Procurement and integrators

AWS documented a Stellantis Data & Software Hub in November 2024 for securely storing, managing, developing, analysing, sharing and deploying data and software products across the enterprise.²⁰ Microsoft announced on 16 April 2026 a multi-year Stellantis collaboration covering more than 100 AI initiatives, an AI-driven global cyberdefense centre, Microsoft Azure infrastructure modernisation and a target to reduce Stellantis’ datacentre footprint by 60% by 2029.²¹ no public evidence identified that AWS, Microsoft or another disclosed integrator mandated an Israeli-origin vendor as part of these Stellantis programmes.^{21, 20}

Surveillance, Biometrics & Retail Technology

Facial recognition and biometrics

Vayyar’s Stellantis-related technology is 4D radar for in-cabin monitoring and occupant/movement detection, including seat-belt, anti-intrusion and child-presence functions.^{4, 5} The cited material describes radar rather than facial-recognition technology and does not establish biometric identity matching.^{4, 5}

Mobileye REM uses a forward-facing camera to collect selected road/environment observations for cloud-enhanced mapping and ADAS.⁶ The cited announcement describes mapping and driver-assistance functions, not facial recognition or biometric identification.⁶

For Stellantis use of Trigo, BriefCam, AnyVision/Oosto, Trax or comparable Israeli-origin facial-recognition or retail-behaviour systems, no public evidence identified in the reviewed sources.^{1, 4, 6}

Predictive analytics and monitoring

Palantir Foundry processes extensive operational and connected-vehicle data for Stellantis, but the disclosed Stellantis use cases concern engineering, quality, manufacturing, supply chain, commercial activity and broader business operations.^{18, 19} no public evidence identified that Stellantis uses an Israeli-origin predictive-policing, social-media-monitoring or workforce-surveillance product.^{18, 19}

Third-party deployment

The reviewed AWS, Azure, Palantir and Aramis/Palo Alto disclosures establish broad third-party cloud, data and security platforms, but they do not identify an indirectly bundled Israeli-origin facial-recognition or biometric surveillance product reaching Stellantis through those platforms.^{19, 17, 21, 20} no public evidence identified for such an indirect deployment.^{19, 17, 21, 20}

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data-centre operations in Israel and data exposure

Stellantis has documented cloud/data relationships with AWS, Microsoft Azure and Palantir.^{18, 19, 21, 20} no public evidence identified that Stellantis itself operates, leases or co-locates a data centre in Israel.^{1, 21, 20}

The Mobileye REM announcement states that anonymized road/environment observations from selected future Stellantis vehicles will be transmitted to Mobileye’s cloud system, but it does not name the data-centre country, cloud provider or legal jurisdiction.⁶ Accordingly, no public evidence identified that Stellantis-derived REM data is stored or processed specifically in Israel.⁶

Ituran’s Fiat Connect arrangement is data-relevant because Ituran operates the technology backend and mobile application and supplies embedded connected-vehicle hardware/services.^{7, 8} The 2025 subscriber-transfer disclosure also confirms Ituran began serving Stellantis’ stolen-vehicle-recovery subscriber base.⁹ However, the public materials do not identify where Stellantis/Fiat customer or vehicle data is hosted, routed or processed, which entity controls particular datasets, or what government-access regime applies to those systems.^{7, 8, 9} Supplier nationality therefore does not establish Israeli data residency.^{7, 8, 9}

The current Connect Fiat app listing describes vehicle diagnostics, route monitoring, stolen-vehicle assistance, collision response, vehicle location, route history and location sharing.¹¹ It identifies Stellantis Automóveis Brasil Ltda. as developer/publisher and says the services apply to vehicles purchased in Brazil, with activation and cellular coverage required.¹¹ These programme-specific customer functions are consistent with the Ituran backend/application role disclosed in its SEC-filed announcement, but they do not identify server location, cloud account, controller/processor allocation or foreign access.^{7, 11}

Ituran Brasil’s general privacy policy states that its own products/services may involve geolocation and telemetry data, sharing with group companies or service providers, and storage on Ituran-owned servers or cloud technology.²² That policy is not Connect Fiat-specific, so it does not establish that Stellantis/Fiat data is stored on those systems, transferred to Israel or handled by an Israeli group entity.²² no public evidence identified of a programme-specific data-processing agreement, subprocessor list, cloud region, cross-border transfer destination or Israeli legal-access pathway for Connect Fiat data.^{7, 11, 22}

Palantir’s Stellantis relationship encompasses connected-vehicle and enterprise data, and its 2026 agreement expands the relationship, but the reviewed Stellantis-Palantir records do not identify Israeli hosting or an Israeli processing path for Stellantis data.^{18, 19} Likewise, the Aramis Prisma Cloud case identifies AWS resources and cloud-native workloads, but it does not establish Israeli hosting or routing.¹⁷

Government cloud contracts

A/HRC/59/23 discusses Microsoft, Alphabet/Google and Amazon cloud/AI relationships with Israeli state bodies and separately discusses Palantir’s Israeli military relationship.²³ A text search of the report found no occurrence of Stellantis.²³ Those vendor relationships do not establish Stellantis participation in Project Nimbus or show that Stellantis AWS/Azure workloads are hosted in Israel.^{23, 21, 20} no public evidence identified that Stellantis is a supplier or contractor to Project Nimbus or another Israeli government cloud programme.^{1, 23}

Data sovereignty and resilience services

No public evidence identified that Stellantis provides digital-sovereignty, data-residency or infrastructure-resilience services to an Israeli state institution or military body.^{1, 23}

Defence, Intelligence & Security Sector Technology Relationships

Military and intelligence contracts

No public evidence identified of a direct digital-technology contract between Stellantis and the Israeli Ministry of Defense, Israel Defense Forces or Israeli intelligence agencies in the reviewed material.^{1, 23}

Palantir is a Stellantis enterprise-data vendor under the 2022 and renewed 2026 agreements.^{18, 19} Palantir’s FY2024 SEC filing separately states that in 2024 it agreed to a strategic partnership with the Israeli Ministry of Defense to supply technology to Israel to assist in the ongoing war.²⁴ These are two distinct relationships; the reviewed evidence does not establish that Stellantis technology, data or personnel were supplied to the Israeli Ministry of Defense through Palantir.^{18, 19, 24}

A/HRC/59/23 states that Palantir expanded support to the Israeli military after October 2023 and attributes military AI/data functions to the company.²³ Palantir’s 22 May 2025 response says its Israeli Ministry of Defense work began after 7 October 2023, denies involvement with the Gospel or Lavender targeting systems, and disputes predictive-policing and unlawful-surveillance characterisations.²⁵ These are attributed, competing accounts of Palantir’s separate Israeli state work; neither establishes Stellantis participation in that work.^{25, 23}

For chronology, the ICJ issued its advisory opinion on 19 July 2024, and the ICC announced arrest warrants for Benjamin Netanyahu and Yoav Gallant on 21 November 2024.^{26, 27} Stellantis and Palantir then announced their five-year renewal on 30 March 2026.¹⁹ These dates establish chronology only; the reviewed material does not establish what legal or human-rights assessment Stellantis made concerning Palantir’s separate Israeli defense relationship.^{19, 24, 26, 27}

Dual-use technology provision

No public evidence identified that Stellantis’ own general-purpose digital technology has been verified as deployed for Israeli military, intelligence or law-enforcement surveillance in Israel or the occupied Palestinian territory.^{1, 23}

Offensive cyber and weapons technology

No public evidence identified that Stellantis develops, sells, licenses or maintains offensive cyber tools, zero-day exploit systems or digital weapons for Israeli state actors.^{1, 23} Palantir’s separate defense relationship is vendor context and is not attributed to Stellantis.²⁴

AI, Algorithmic & Autonomous Systems

AI/ML provision to state bodies

Stellantis’ 2026 Palantir renewal includes AIP deployment in selected business functions and regions.¹⁹ Microsoft’s April 2026 statement describes more than 100 Stellantis AI initiatives across customer care, product development and operations, including product development/validation, predictive maintenance and digital services, as well as an AI-driven cyberdefense centre.²¹ These are Stellantis enterprise and product programmes; no public evidence identified that Stellantis provides those AI systems to Israeli state, military or security bodies.^{19, 21}

Mobileye REM is an ADAS/cloud-mapping technology planned for selected Stellantis models from 2027.⁶ The evidence establishes Stellantis as a customer/integration partner, not as a supplier of Mobileye technology to the Israeli state.⁶

Training data and model development

No public evidence identified that a Stellantis AI model was trained on civilian-population data, intercepted communications or surveillance-derived datasets from Israel or the occupied Palestinian territory.^{18, 19, 21} Palantir’s handling of Stellantis connected-vehicle/enterprise data is documented, but the reviewed sources do not identify an Israeli processing location or Israeli surveillance dataset in that Stellantis workflow.^{18, 19}

Autonomous systems and lethality

No public evidence identified that Stellantis provides autonomous target generation, automated military threat detection, kill-chain automation or autonomous tracking systems to Israeli military or security forces.^{1, 23} The disputed claims concerning Palantir’s own Israeli military work remain attributable to Palantir and do not establish Stellantis provision.^{24, 25, 23}

Technology Ecosystem & R&D Footprint

Israeli R&D centres

The April 2021 FCA Italy-Israel Innovation Authority agreement created a framework for collaboration with Israeli startups.³ It does not establish a Stellantis-owned engineering centre or laboratory physically operated in Israel, and continuation of the 2021 framework in 2026 was not confirmed by a dated current source.³ no public evidence identified of a Stellantis-owned Israeli R&D centre in the reviewed material.^{1, 3}

The Ituran supplier group, separately from Stellantis itself, has current Israeli R&D activity. Its 2025 Form 20-F states that most Ituran R&D takes place in Israel, Mexico, Colombia and Ecuador and covers service infrastructure, fleet applications and cellular/GPS platforms.¹⁰ That group-level fact does not establish that Connect Fiat software was developed in Israel; no public evidence identified allocating Connect Fiat development work to a particular Ituran R&D location.^{7, 10}

Acquisitions and investments

Vayyar was a Stellantis Venture Award honoree in 2023, but the award material does not state that Vayyar received a Stellantis equity investment.⁴ no public evidence identified in the reviewed sources of Stellantis acquiring Vayyar, C2A Security, Karamba Security, Mobileye or Ituran.^{4, 6, 13, 12}

Patent, IP and co-development arrangements

The 2024 Stellantis/C2A Security SAE paper establishes joint technical authorship on automotive cybersecurity risk analysis.^{13, 14} It does not establish an IP licence, patent assignment or commercial co-development contract.¹³ no public evidence identified of a significant Stellantis patent-licensing or co-development arrangement with Technion, Hebrew University or Weizmann Institute in the reviewed sources.^{1, 13}

Controlling principals and board review

Stellantis’ 2025 filing identifies Daniel Ramot as a non-executive director.¹ Via’s governance biography states that Ramot, a Talpiot graduate, served in the Israeli Air Force from 1996 to 2002 [pre-2020] and worked on avionics systems for F-15 and F-16 aircraft; it also records his appointment to the Stellantis board in April 2025.²⁸ no public evidence identified in the reviewed governance material of a personal Ramot investment in the named surveillance/cyber firms searched for this audit.^{1, 28}

Aramis Group is a controlled entity: its 2025 registration document records Stellantis control through Automobiles Peugeot at 60.54% of capital and 67.40% of voting rights.¹⁵ Its Prisma Cloud deployment is therefore included as controlled-subsidiary technology use, with the limited 2022 scope described by the vendor case.¹⁷

Lubinski, by contrast, describes itself as a family company and vehicle importer representing four Stellantis brands in Israel.² Its independent technology or commercial acts are not attributed to Stellantis absent separate evidence.²

Civil Society Scrutiny & Regulatory History

UN, NGO and academic scrutiny

A/HRC/59/23, dated 2 July 2025, discusses technology-sector support to Israeli state and military activity, including Microsoft/Amazon/Alphabet cloud relationships and Palantir’s military relationship.²³ Stellantis does not appear in a text search of that report; the relevance here arises only from Stellantis’ separately verified relationships with Palantir, AWS and Microsoft.^{18, 19, 21, 20}

Palantir disputes important parts of the Special Rapporteur’s characterisation in its May 2025 response, including claims concerning predictive policing and the Gospel and Lavender systems.²⁵ The audit therefore records the UN report and Palantir response as attributed, competing accounts.^{25, 23}

The current OHCHR settlement-business update reviewed here is A/HRC/60/19, dated 26 September 2025.²⁹ Text searches found no entry for Stellantis, Peugeot or Citroën.²⁹ The report explains that its process concerns specified settlement-related activities and an assessed set of enterprises, so non-listing is not proof that every possible settlement-linked activity is absent.²⁹

Boycott and divestment campaigns

Engineers Against Apartheid, a U.S.-based advocacy group of automotive engineers, explicitly names Stellantis among companies it asks to stop providing Israel with weapons or intelligence and to sever corporate ties.³⁰ The page does not present a Stellantis-specific digital contract, military procurement record or dataflow establishing the allegation, and no public evidence identified in the reviewed material of a direct Stellantis response to this campaign.³⁰

Separately, Storebrand Asset Management’s 15 October 2024 review says it excluded Palantir from its investment universe because of the risk of involvement in human-rights risks in the occupied Palestinian territories.³¹ That action concerns Stellantis’ vendor Palantir, not Stellantis itself.³¹

Regulatory and legal actions

No public evidence identified of a regulator, court or export-control authority bringing a Stellantis-specific action over digital technology sales or services to Israeli state, military or security entities in the reviewed material.^{1, 23} The ICJ and ICC documents establish the requested external chronology but do not name Stellantis as a technology provider or party.^{26, 27}

Evidence Gaps

Public records do not reveal every startup engaged under the 2021 Israel Innovation Authority framework, whether that framework remains active in 2026, or commercial terms of individual projects.³ Karamba’s page does not disclose which product Stellantis uses, deployment scale, contract date or current production status.¹² The Vayyar material does not establish series-production deployment or 2026 continuity.^{4, 5} The C2A evidence establishes joint research authorship but not procurement.^{13, 14}

Mobileye has announced the Stellantis REM programme for 2027, but the public announcement does not identify the cloud provider, data-centre location or legal jurisdiction handling Stellantis-derived data.⁶ Ituran’s disclosures establish backend/app and connected-vehicle service functions but likewise do not disclose hosting location, subprocessor chain, controller/processor allocation or government-access pathway for Stellantis/Fiat data.^{7, 8, 9} No reviewed AWS, Azure, Palantir or Aramis/Palo Alto document establishes that Stellantis or Aramis customer, vehicle or employee data is stored or processed in Israel.^{18, 19, 17, 21, 20}

The expanded Ituran research establishes that the supplier group has Brazilian operating subsidiaries, Israeli technology subsidiaries, Israeli/Chinese telematics-product manufacturing and R&D in Israel, Mexico, Colombia and Ecuador.¹⁰ It still does not identify the exact Ituran legal entity performing the Stellantis contracts, the manufacturer/model of the Connect Fiat telemetry module, whether E.R.M. supplies that module, the development location of Connect Fiat software, or the physical/cloud location of its backend.^{7, 10}

Private enterprise-software and supply-chain agreements are incomplete in public records. Negative findings therefore mean no qualifying public evidence was identified in the searches and documents reviewed; they do not establish that an undisclosed private relationship cannot exist.¹