Costa Coffee Digital Audit

Audit Phase: V-DIG (Digital Forensics / Technology Supply Chain)
Audit Date: 2026-05-01
Prepared by: Audit Research Function
Evidentiary Standard: All factual claims sourced from the research memo’s verified findings only. Unverified inference chains from prior reporting are explicitly flagged. No new research has been conducted.

Enterprise Technology Stack & Vendor Relationships

Cloud Infrastructure

The most directly evidenced technology relationship in the public record is Costa Coffee’s engagement with Vega IT, a Serbian IT consultancy, to rebuild the company’s data architecture on Microsoft Azure ¹. The Vega IT case study confirms Azure as Costa’s primary cloud platform for data workloads, though it does not specify data residency regions, nor does it reference any relationship to Israeli Azure infrastructure ¹. Azure is a product of Microsoft Corporation, a US-headquartered company.

Costa’s BaristaBot robotic kiosk platform — formerly Briggo, acquired by Coca-Cola/Costa in 2021 — is separately documented as running on Amazon Web Services (AWS) ³⁴. Both hyperscale providers are US-headquartered. No evidence has been identified that Costa’s AWS or Azure usage involves data routing through Israeli infrastructure or participation in Israeli state cloud programmes.

Contact Centre Platform

Costa Coffee operates a UK contact centre. A Call Centre Helper site visit report (approx. 2023–2024) documents operational practices including workforce management and customer interaction tooling, but does not name any specific contact centre platform vendor ². Costa appeared in exhibitor and attendee materials for Contact Centre Expo 2025 (CC/CX25), where NICE was also present as an exhibitor ²⁰²¹; this establishes professional proximity at an industry event but does not establish a contractual or licensing relationship. No public evidence of a confirmed NICE CXone contract at Costa identified.

Network Security

A CISO Inspired Summit UK 2025 agenda lists a Check Point representative alongside an individual from Costa Coffee’s security function as speakers at the same event ¹⁵. This establishes co-appearance at an industry summit; no procurement record, case study, or corporate disclosure confirms Check Point as a Costa vendor. No public evidence of a confirmed Check Point deployment at Costa identified.

Endpoint Detection & Response

The Nebula Global Services “Oxygen 250” market report (January 2024) lists Costa Coffee as a named organisation within its broader market data ¹⁶. Nebula Global Services is a reseller and managed services partner of SentinelOne. However, the document does not explicitly state that Costa Coffee is a Nebula client, nor does it confirm a SentinelOne deployment. The inference chain — that Costa appears in a Nebula market document, therefore Costa uses SentinelOne via Nebula — is not sufficient for verification under this audit’s evidentiary standards. No public evidence of a confirmed SentinelOne deployment at Costa identified.

Privileged Access Management

Exponential-e, a UK managed services provider, lists CyberArk among the security vendors whose technologies it deploys as part of its Identity-as-a-Service and endpoint protection offerings ¹⁷¹⁸. The prior report asserted Costa is an Exponential-e client, and therefore uses CyberArk. Exponential-e’s customer stories page does not name Costa Coffee ¹⁴, and no primary source confirms this intermediary relationship. No public evidence of a confirmed CyberArk deployment at Costa identified.

Workforce / Speech Analytics

Sabio Group is a UK contact centre technology integrator and Verint partner. Bellrock, a facilities management firm, is a documented Sabio client ¹⁹. The prior report’s claim that Costa uses Verint “via Bellrock and Sabio” is an inference chain with no logical connection to Costa Coffee’s technology stack; Bellrock is not a Costa IT partner. An FStech reference from July–August 2013 is pre-2020 and does not name Costa as a Verint client ³⁹. No public evidence of a confirmed Verint deployment at Costa identified.

Systems Integrators

• Infosys / Americana Restaurants (Confirmed — Franchisee Level): Infosys’s 2024–25 Annual Report and a separate Infosys case study document a project with Americana Restaurants — the franchisee operating Costa Coffee across 12 MENA countries — involving accounts payable automation using agentic AI ³⁰³¹⁴⁴. This is a confirmed Infosys engagement, but with the franchisee entity, not with Costa Coffee Ltd directly. The case study does not confirm whether Infosys’s Panaya-derived modules (from its Israeli acquisition) were specifically used in this engagement ³¹.

• Capgemini: A Capgemini GB retail thought leadership piece references Costa Coffee in the context of post-COVID retail transformation ³². This is a marketing editorial mention and does not confirm a systems integration contract.

• Publicis Sapient: Referenced in trade press (DecisionMarketing) in the context of Costa’s digital marketing transformation ³³. The reference is editorial and does not confirm a specific contract scope or value.

Surveillance, Biometrics & Retail Technology

Autonomous / Frictionless Checkout (Zippin) — Confirmed

Retail Tech Innovation Hub (June 2024) ⁶ and RTIH Magazine (April–June 2024) ⁷ confirm that Costa Coffee deployed Zippin frictionless checkout technology in at least one UK location. Zippin is a US-headquartered company (San Francisco, CA).

PitchBook investor data ⁹ and an OurCrowd blog post referencing Zippin’s deployment milestones ⁸ confirm that OurCrowd, an Israeli venture capital platform headquartered in Jerusalem, is a documented investor in Zippin. The size of OurCrowd’s stake and whether it remains a current (as opposed to historical) shareholder is not specified in available public sources. OurCrowd is a minority financial investor in Zippin; it is not an operational partner, technology licensor, or product developer in relation to Zippin’s checkout systems. Zippin is not itself an Israeli-origin company.

Smart Vending & Demographic Analytics (Intel / Marlow) — Confirmed Historically

GeekWire reported in 2013 ¹² that Costa Coffee’s “Marlow” smart vending machines, developed in collaboration with Intel, used facial detection technology to estimate customer age and gender for targeted advertising and product recommendation. This is a confirmed historical deployment. Intel is a US-headquartered company with significant R&D operations in Israel (Haifa and Petah Tikva), though it is not an Israeli-origin company. No post-2020 source confirms whether this demographic analytics capability remains active in current-generation Costa vending hardware. Current status is unknown.

Reckon.ai Smart Cabinets — Confirmed Trial

RTIH (May 2025) ³⁷ and Retail Tech Innovation Hub (November 2025) ³⁶ both confirm that Costa Coffee trialled Reckon.ai unattended retail cabinet technology. Reckon.ai is a Portuguese/Dutch startup; its documented investor Iberis Capital is a Portuguese venture capital fund. Reckon.ai is not of Israeli origin.

Robotic Kiosks (BaristaBot / Briggo) — Confirmed

Coca-Cola acquired robotic coffee kiosk company Briggo (Austin, Texas) in 2021, rebranding the platform as BaristaBot under Costa Coffee ³⁴. CXM Today confirms the subsequent launch of BaristaBot locations in the UK and US ⁵. Briggo/BaristaBot is a US company with no identified Israeli origin or Israeli investor base.

Retail Execution Analytics (Trax) — Unverified

Trax Retail’s blog ¹³ and P2PI trade publication (Sep/Oct 2024) ⁴¹ reference Trax’s work with major CPG brands and retailers. Neither source names Costa Coffee as a direct Trax client. Trax was founded in Singapore (2010) with documented R&D operations in Tel Aviv, Israel — a matter of public corporate record. However, no public evidence of a confirmed Trax deployment at Costa Coffee has been identified. The prior report’s claim is unsupported by any primary source naming Costa as a Trax customer.

Facial Recognition / Biometric Payments (PopID) — Unverified at Costa

The Fintech Times references PopID’s deployment in UAE retail contexts including hypermarkets ¹⁰, and Biometric Update (April 2022) covers the PopID–Visa partnership ¹¹. Neither article names Costa Coffee as a PopID client. No public evidence of a confirmed PopID deployment specifically at Costa Coffee UAE outlets has been identified. The prior report’s claim is not supported by the cited sources.

Video Analytics (BriefCam) — No Evidence

The prior report cited a job advertisement for Milestone Systems Bulgaria that references BriefCam in a testing context ⁴⁰. BriefCam was acquired by Canon and was originally founded in Israel. However, this job advertisement has no connection to Costa Coffee whatsoever; it is an internal Milestone Systems recruitment advertisement. No public evidence of a BriefCam deployment at Costa Coffee has been identified. The prior report’s claim rests on an entirely disconnected source.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Confirmed Cloud Platforms

Costa Coffee is confirmed to use:
– Microsoft Azure — for data architecture and data-platform workloads, as documented in the Vega IT case study ¹.
– Amazon Web Services (AWS) — for BaristaBot robotic kiosk platform operations ³⁴.

Both are US-headquartered hyperscale cloud providers with global infrastructure footprints. Neither the Vega IT case study nor any other identified source specifies the Azure regions used to host Costa’s data, and no evidence places Costa’s data in Israeli Azure infrastructure ¹.

Data Centre Operations in Israel

No public evidence identified. No source in the research record documents Costa Coffee operating, leasing, or co-locating any data centre or cloud compute infrastructure within Israel.

Project Nimbus

Costa Coffee is not named in any publicly available Project Nimbus contract documentation or Israeli government procurement records. Project Nimbus is a contract between the Israeli government and Google Cloud and Amazon Web Services, awarded in 2021. While Costa is a confirmed AWS customer ³⁴, there is no evidence of any direct relationship between Costa Coffee and Project Nimbus. Costa has no documented contractual or operational link to that programme. No public evidence of Costa participation in or contractual relationship with Project Nimbus identified.

Data Sovereignty Services to Israeli State

No public evidence identified. Costa Coffee is a retail beverage company. No evidence has been found of it providing data sovereignty, infrastructure resilience, or cloud services to any state body, including Israeli government entities.

Defence, Intelligence & Security Sector Technology Relationships

Military & Intelligence Contracts

No public evidence identified. No contracts, partnerships, or service agreements between Costa Coffee and the Israeli Ministry of Defence, Israel Defense Forces, Shin Bet, Mossad, or any other Israeli or international defence or intelligence agency have been identified in any public source reviewed.

Dual-Use Technology Deployments

No public evidence identified. No public reporting, official confirmation, or researcher documentation of Costa Coffee’s commercial technology — including its frictionless checkout, robotic kiosk, or customer data systems — being deployed for military, intelligence, or law enforcement surveillance applications in Israel or the occupied Palestinian territories has been found.

Offensive Cyber & Weapons Technology

No public evidence identified. Costa Coffee has no documented involvement in offensive cyber capabilities, zero-day exploit tools, vulnerability research, or digital weapons systems of any kind.

AI, Algorithmic & Autonomous Systems

AI/ML Provision to Israeli State Bodies

No public evidence identified. No AI or machine learning products or services supplied by Costa Coffee to Israeli government, military, or intelligence entities have been documented in any public source.

Training Data & Model Development

No public evidence identified. No public information describes Costa Coffee licensing customer data, behavioural datasets, or operational data to Israeli AI development programmes or Israeli state bodies.

Autonomous Systems in Retail (Confirmed Civilian Applications)

Costa Coffee’s documented autonomous and AI-adjacent systems are limited to civilian retail applications:

• BaristaBot robotic coffee kiosks (formerly Briggo, acquired 2021) — fully automated barista operation ³⁴⁵.
• Zippin frictionless checkout using computer vision and sensor fusion at UK retail locations ⁶⁷.
• Reckon.ai smart cabinet trial for unattended retail ³⁶³⁷.
• Intel/Marlow vending machine demographic analytics (age/gender estimation via facial detection) — confirmed historically (2013) ¹²; current operational status unconfirmed.

None of these systems have any documented connection to defence, lethality, or state surveillance applications.

Infosys Agentic AI — Franchisee Level

The Infosys–Americana Restaurants engagement involves agentic AI for accounts payable automation ³¹⁴⁴. This is a franchisee-level deployment (Americana Restaurants, 12 MENA countries), not a Costa Coffee Ltd implementation. Infosys acquired Israeli software company Panaya in 2015; whether Panaya-derived modules were specifically used in the Americana engagement is not confirmed in the cited case study ³¹.

Technology Ecosystem & R&D Footprint

Israeli R&D Centres

No public evidence identified of Costa Coffee operating any R&D facility, engineering office, innovation lab, or corporate accelerator programme within Israel. Costa’s corporate R&D function is headquartered in Dunstable, UK (Global HQ and Roastery).

Acquisitions & Investments

• Briggo / BaristaBot (2021): Costa Coffee (via Coca-Cola) acquired Briggo, a robotic coffee kiosk company headquartered in Austin, Texas ³⁴. Briggo is a US company with no identified Israeli origin or Israeli investor base.
• The Bridge Accelerator (Coca-Cola parent): The Coca-Cola Company operates “The Bridge,” a Tel Aviv-based accelerator that connects Israeli technology startups to Coca-Cola’s global commercial network ²². This is an activity of the Coca-Cola parent company. No specific Costa Coffee-branded engagement with The Bridge has been documented.
• CBC Startup Investments: Central Bottling Company (CBC), the Israeli Coca-Cola and Costa Coffee franchisee, invested in Israeli food-tech startups BioMilk (cultured milk, 2021) ²³ and Brevel (microalgae protein). These are CBC-level investments by the Israeli franchisee entity, not investments by Costa Coffee Ltd.
• Assessment: No direct acquisition or equity investment by Costa Coffee Ltd in any Israeli technology company has been identified in public sources.

Patent & IP

No public evidence identified of Costa Coffee patent portfolios, IP licensing arrangements, or co-development agreements with Israeli-domiciled entities or Israeli research institutions.

Emirates Leisure Retail Partnership

A Zawya press release confirms a strengthened partnership agreement between Costa Coffee and Emirates Leisure Retail (ELR) for Costa’s expansion in the UAE ³⁸. ELR is a UAE-based hospitality and retail operator; this is a franchise/licensing relationship with no identified technology or data-sharing dimension that would fall within this audit’s scope.

Leadership Context

Board Stewardship and trade press document the resignation of Costa Coffee CEO Sreejit M. Nair and the appointment of Kamaljit S. Bedi as his successor ³⁵³⁴. These personnel movements are noted for corporate context but have no direct bearing on the technology supply chain findings of this audit.

Civil Society Scrutiny & Regulatory History

NGO Reports

• PAX for Peace (“The Private Actors Behind the Economy of Occupation and Genocide,” November 2025) ²⁸: This report covers private sector actors involved in the economy of the Israeli occupation. PAX’s “Don’t Buy Into Occupation” reporting series focuses primarily on construction, finance, and physical infrastructure companies with operations in or linked to Israeli settlements. The Coca-Cola/CBC corporate relationship falls within the scope of this type of reporting. The precise scope of any Costa-specific mention in the November 2025 PAX document requires direct document access to confirm; it is identified here as a candidate source requiring verification. The report is publicly available ²⁸.

• Who Profits Research Center ²⁴: The Who Profits database profiles companies operating in or benefiting from Israeli settlements. Central Bottling Company (CBC) — the Israeli Coca-Cola and Costa Coffee franchisee, owned by the Wertheim family — is documented in the Who Profits database in connection with its distribution activities in the occupied territories, including its regional distribution centre in the Atarot Industrial Zone in Occupied East Jerusalem. The Atarot zone is identified by the UN and the prevailing international legal consensus as an Israeli settlement in occupied Palestinian territory. Costa Coffee is not independently profiled in Who Profits, but is implicated as a franchise brand operated by CBC.

• Ethical Consumer ²⁶²⁷: Ethical Consumer rates The Coca-Cola Company and flags its Israeli operations via CBC as an ethical concern. Costa Coffee, as a wholly owned Coca-Cola subsidiary, is contextually encompassed within this assessment.

Boycott & Divestment Campaigns

• BDS Movement guidance documentation references Coca-Cola as a boycott target due to CBC’s franchise operations in Israel ²⁹. Costa Coffee is listed within the Coca-Cola corporate family subject to the same campaign rationale.
• Boycat (consumer boycott application) lists Coca-Cola and associated brands including Costa Coffee as targets for consumer boycott action, citing CBC’s Israeli operations including its Atarot distribution centre and its association with Im Tirtzu (a far-right Israeli political organisation) ²⁵. The Im Tirtzu donation claim originates in Israeli-language press reporting and has not been independently verified from English-language primary sources available in training data.
• Costa Coffee has been included in consumer boycott campaigns as a Coca-Cola subsidiary, primarily on the grounds of CBC’s franchise and distribution operations in Israel and the occupied territories ^25262729. These campaigns are directed at the Coca-Cola corporate family. No documented BDS or NGO campaign has been identified that specifically targets Costa Coffee’s technology vendor relationships — such as its cloud, cybersecurity, or analytics partnerships — as a distinct concern separate from its franchise supply chain connections via CBC.
• Costa Coffee Ltd has not issued any documented public response to these boycott campaigns in its own name. The Coca-Cola Company has issued general statements about operating within applicable law in all markets.

CBC — Franchise Supply Chain Context

The Central Bottling Company (CBC), also known as Coca-Cola Israel, holds the Coca-Cola and Costa Coffee franchise for Israel and is owned by the Wertheim family ²⁴²⁵²⁶. The following CBC-level facts are confirmed:

• CBC operates a regional distribution centre in the Atarot Industrial Zone, Occupied East Jerusalem — documented by Who Profits ²⁴ and referenced in BDS and Ethical Consumer campaign materials ²⁵²⁶²⁷.
• CBC’s subsidiary Tabor Winery has vineyards in the Golan Heights and West Bank (Gush Etzion region) — documented in Who Profits database records ²⁴.
• A Wendy’s and Costa Coffee franchisee (separate from CBC) has introduced gender equality policies, noted in Hotel & Catering News ⁴³; this is a labour practice item unrelated to the technology supply chain focus of this audit.

All CBC-level findings are framed at the franchisee level. Costa Coffee Ltd is the brand licensor; it does not directly operate CBC’s distribution infrastructure in the occupied territories.

Regulatory & Legal Actions

No public evidence identified of regulatory inquiries, export control actions, sanctions-related investigations, or legal challenges specifically involving Costa Coffee’s technology procurement, data practices, or services to Israeli state entities. No ICO enforcement action, FCA regulatory matter, or equivalent specifically naming Costa Coffee’s technology operations has been identified in available sources.

End Notes