Digital Audit - Uber

Domain: Digital - Digital / Technology Entity scope: Uber Technologies Inc. (NYSE: UBER; HQ San Francisco), including Uber Eats, Uber Freight, Postmates, and Careem (Uber-owned MENA ride-hailing/super-app unit); Advanced Technologies Group (ATG) was sold to Aurora Innovation in January 2021 and its post-sale acts are attributed to Aurora, a separate company, not to Uber. Compiled: 2026-06-26 Method: Live web search only

Enterprise Technology Stack & Vendor Relationships

Cloud infrastructure. In February 2023 Uber signed dual seven-year strategic cloud agreements with Google Cloud and Oracle Cloud, simultaneously closing its own data-centre facilities.¹² Under the Google partnership Uber migrates applications and data to Google Cloud and uses Google’s mapping APIs for routing; Oracle supplies cloud-based ERP and database products principally for Uber Freight.² In April 2026 Uber expanded a separate AWS agreement to run additional AI and compute workloads on Amazon’s proprietary Graviton (Arm) processors and to trial Trainium AI-training chips.³ All three hyperscalers are US-domiciled; no Israeli-domiciled cloud relationship was identified.

Mapping. At CES 2024 Uber named HERE Technologies as a preferred global location provider for long-term mapping and geolocation data across rideshare and Uber Eats.⁴ HERE Technologies is a Netherlands-headquartered entity majority-owned by a consortium of German automakers (Audi, BMW, Mercedes-Benz) and Intel; it is not Israeli-domiciled.⁵

Identity and background screening. Uber’s Real-Time ID Check for drivers uses Microsoft Azure Cognitive Services (Face API) for driver selfie-to-profile photo matching.⁶ For rider verification Uber partnered with Prove (phone-number-based identity assurance, US-domiciled) in September 2024 and with CLEAR (biometric identity verification, US-domiciled; NYSE: YOU) for a nationwide rider “Verified” badge programme.⁷⁸ Driver background checks are outsourced to US-domiciled screening vendors including Checkr and Accurate Background.⁹ No Israeli-domiciled identity or background-check vendor was identified in Uber’s confirmed stack.

Surveillance, Biometrics & Retail Technology

Driver biometric verification. Uber’s Real-Time ID Check, operational since 2016, periodically prompts drivers to submit a real-time selfie before a session begins; Microsoft Azure Face API verifies the match against the account photo.⁶ The system has attracted civil-rights scrutiny for disproportionate failure rates affecting transgender drivers.¹⁰ The vendor (Microsoft/Azure) is US-domiciled.

God View / location surveillance. Uber’s internal “God View” tool, which allowed corporate employees to track any rider or driver in real time, became public knowledge in 2014 following reports that a senior executive had used it to track a journalist without consent.¹¹ Following an investigation by the New York Attorney General, Uber restricted God View access to designated staff with multi-factor authentication.¹¹

Autonomous delivery robots. Uber Eats deploys autonomous sidewalk delivery robots in partnership with Avride (US-domiciled spin-off of Yandex’s self-driving unit) in Austin, Dallas and Jersey City, and with Cartken in Osaka.¹² Uber invested in Avride’s $375 million funding round alongside Nebius in October 2024.¹² Neither Avride nor Cartken is Israeli-domiciled.

No Israeli-domiciled surveillance or biometrics vendor relationship was identified.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Uber’s core cloud footprint rests on the Google Cloud and Oracle Cloud seven-year agreements signed in February 2023, supplemented by the April 2026 AWS Trainium/Graviton expansion.¹²³ Uber’s own data centres have been progressively closed as part of the migration.¹ No Israeli sovereign-cloud, government-cloud or Israeli-headquartered data-residency arrangement was identified. Neither Google Cloud, Oracle Cloud nor AWS maintains a dedicated Israeli sovereign cloud region; their standard infrastructure includes edge/CDN points of presence in Israel but those are not separate sovereign-cloud contracts.

Data-residency regulatory exposure: The Dutch Data Protection Authority fined Uber €290 million in July 2024 for transferring European driver personal data (including sensitive categories) to US servers between August 2021 and November 2023 without adequate GDPR transfer safeguards.¹³ This was Uber’s third Dutch DPA penalty, following €600,000 (2018) and €10 million (2023).¹³ Uber indicated it would contest the fine.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of Uber Technologies holding direct contracts with defence ministries, intelligence agencies or military procurement bodies.

Flytrex - Israeli-domiciled investee company (in scope, strategic investment). In September 2025 Uber announced a strategic investment of tens of millions of dollars in Flytrex, an Israeli-domiciled drone-delivery company headquartered in Tel Aviv (founded 2013, reported ~50 employees in Israel and ~20 in the US).¹⁴¹⁵ The stated purpose is integration of Flytrex autonomous drone capability into Uber Eats for last-mile food delivery in US markets, with a pilot planned for late 2025.¹⁴ Flytrex is a commercial civilian delivery company whose technology is FAA-certified for beyond-visual-line-of-sight (BVLOS) operations in the United States, one of only four operators holding that authorisation.¹⁴

Background on Flytrex: Executive Chairman Noam Bardin is the former CEO of Waze (the Israeli-founded navigation company sold to Google in 2013), and Flytrex has received a reported $1.3 million grant from the Israel Innovation Authority (a state agency) and investment from the Israeli venture platform OurCrowd.¹⁴¹⁶ Activist boycott sources additionally assert that co-founder and CEO Yariv Bash is an IDF veteran who founded “Mahanet” (described as a military-technology camp) and that co-founder Amit Regev has a military-intelligence background;¹⁷ these founder-background characterisations derive from advocacy sources and are not independently corroborated by primary records, although Bash’s separate role co-founding the space non-profit SpaceIL is well documented. No public contract between Flytrex and any military or defence procurement body has been identified, and the characterisation of Flytrex as a “military-technology company” is UNVERIFIED - the company’s stated business is commercial food delivery. The civil-society boycott response is covered below.

Otto (historical, resolved). In August 2016 Uber acquired Otto, a US-domiciled San Francisco startup specialising in autonomous-truck conversion, for approximately $680 million.¹⁸ Otto’s co-founder Lior Ron is Israeli-born, but Otto itself was a US-domiciled entity; this is therefore an acquisition of a US company founded in part by an Israeli national, not an Israeli-domiciled acquisition. Otto’s technology was folded into Uber’s ATG division, divested to Aurora Innovation in January 2021; post-divestiture Aurora activity is attributed to Aurora, a separate company, not to Uber.¹⁹

AI, Algorithmic & Autonomous Systems

Platform AI. Uber’s core platform uses proprietary machine learning for dynamic pricing (surge), driver-rider matching, route optimisation, fraud detection, and demand forecasting. No Israeli-domiciled AI vendor is confirmed in these systems.

Uber AI Solutions (B2B). Uber has commercialised its internal AI data-labelling and testing infrastructure as an enterprise product line - Uber AI Solutions - offering uTask (workflow orchestration), uLabel (AI data labelling) and uTest (scaled app testing).²⁰ This is a civilian, commercial B2B service leveraging Uber’s global gig-worker network for AI annotation.

Autonomous vehicles - robotaxi partnerships. Following the ATG divestiture, Uber pursues an asset-light AV strategy through commercial partnerships. In March 2025 Uber launched “Waymo on Uber” robotaxi service in Austin, expanding to Atlanta in June 2025 with approximately 100 Waymo vehicles.²¹ Additional AV partnerships include Avride, May Mobility, Cartken, Coco, Nuro and Serve Robotics. None is Israeli-domiciled.

NVIDIA partnership (October 2025). Uber and NVIDIA announced a joint initiative to build a robotaxi data factory on the NVIDIA Cosmos platform, with Uber targeting 100,000 autonomous vehicles on its platform by 2027.²² NVIDIA is US-domiciled; no Israeli nexus identified.

Uber Freight AI. Uber Freight’s Insights AI and TMS platform embed machine learning for shipment-lifecycle automation.²³ No Israeli-domiciled AI or data vendor is confirmed in the Uber Freight stack.

Technology Ecosystem & R&D Footprint

No standalone Israeli R&D centre identified. No public evidence of Uber Technologies operating a dedicated engineering or research-and-development centre in Israel was identified across multiple live searches. Uber has operated a ride-hailing presence in Israel - it launched in 2014, closed in June 2023 citing regulatory uncertainty and limited market share against Gett and Yango, and as of September 2025 denied Israeli transport-ministry claims that it would relaunch in 2026.²⁴²⁵ Uber’s Israeli operational presence has thus been limited to a commercial ride-hailing office, not a technology R&D function. The Israeli-born co-founder of Otto (Lior Ron) returned to Uber to lead Uber Freight after the ATG/Aurora sale, but this is an individual executive hire rather than an Israeli-domiciled R&D programme.²⁶

Flytrex - Israeli-domiciled investee (confirmed in scope). The sole confirmed Israeli-domiciled digital/technology relationship in Uber’s current ecosystem is the September 2025 strategic investment in Flytrex (Tel Aviv).¹⁴¹⁵ The investment is a minority stake, terms undisclosed, structured as a strategic commercial partnership for Uber Eats drone delivery. Flytrex retains independent operational status; it is not a subsidiary of Uber.

HERE Technologies (Netherlands-domiciled, not Israeli). The long-term mapping partnership announced at CES 2024 involves a Netherlands-headquartered entity, not an Israeli-domiciled relationship.⁴⁵

Careem. Uber’s MENA super-app unit Careem (acquired 2020 for $3.1 billion; the super-app platform became majority-owned by UAE telco e& following a 2023 spinout, while Uber retains the ride-hailing unit) is Dubai-domiciled, not Israeli.²⁷

Civil Society Scrutiny & Regulatory History

Privacy and data enforcement.

• 2016 data breach / cover-up: In November 2016 hackers accessed personal data of 57 million users and 600,000 drivers; Uber paid the attackers $100,000 to suppress disclosure and concealed the breach for over a year. In September 2018 Uber paid $148 million to settle actions by all 50 US states and the District of Columbia.²⁸
• FTC settlements: Uber settled FTC allegations in 2017 and 2018 related to deceptive privacy and data-security claims.²⁹ In April 2025 the FTC sued Uber over deceptive Uber One subscription billing and cancellation practices; an amended complaint co-filed with 21 states followed in December 2025.³⁰
• Dutch DPA / GDPR: The Dutch DPA issued three fines against Uber: €600,000 (2018), €10 million (2023), and €290 million (2024) - the third for unlawful EU-to-US driver-data transfers, one of the largest GDPR fines imposed by a national authority.¹³
• 2022 Lapsus$ breach: In September 2022 an attacker affiliated with the Lapsus$ group social-engineered an Uber contractor to approve a fraudulent MFA prompt, then escalated privileges to access internal systems.³¹ Uber stated no production user data was exfiltrated.

God View / location tracking (historical). 2014 reports of Uber employees abusing the “God View” internal tracking tool resulted in a New York Attorney General settlement requiring access controls and multi-factor authentication.¹¹

BDS / civil society (Flytrex). Following the September 2025 Flytrex investment announcement, pro-Palestinian civil-society groups - including the Canadian BDS Coalition, Middle East Monitor, and groups amplified by the Business and Human Rights Resource Centre - launched a boycott campaign against Uber Eats.³²³³ The campaign cites the founders’ alleged backgrounds, the Israel Innovation Authority grant, and OurCrowd’s investment as grounds. Uber Technologies had not publicly responded to these specific campaign claims as of the date of this audit. The boycott claims regarding dual-use military potential of Flytrex drone technology are characterised as activist claims - UNVERIFIED against confirmed military contracts or Israeli government defence procurement.

End Notes