Audit Phase: V-DIG (Digital Forensics — Cyber-Intelligence & Technology Supply Chain)
Target: SodaStream International Ltd. (wholly owned subsidiary of PepsiCo Inc. since August 2018)
Research Date: 2026-05-01
SodaStream International Ltd. has operated as a wholly owned subsidiary of PepsiCo Inc. since the acquisition was completed on 29 August 2018 for approximately USD 3.2 billion 18. As a consequence of full acquisition, SodaStream does not operate an independent IT procurement function or publish standalone technology vendor disclosures. Its enterprise IT infrastructure falls within PepsiCo’s consolidated global technology estate 23. All technology vendor relationships attributed to SodaStream must therefore be assessed against PepsiCo’s group-level procurement, which is not itemised at the subsidiary level in any publicly accessible filing 322.
At the PepsiCo group level, two major enterprise technology relationships are publicly documented and would in principle extend to SodaStream as a business unit:
No public evidence has been identified of SodaStream or PepsiCo holding verified, named licensing or subscription relationships — specifically in the context of SodaStream’s operations — with any of the following Israeli-origin or Israeli-founded vendors: Check Point Software, Wiz, SentinelOne, CyberArk, NICE Systems, Verint, Claroty, or Palo Alto Networks. PepsiCo’s security vendor stack is not publicly itemised at the subsidiary level in SEC filings, investor relations publications, or trade press coverage reviewed 322.
One contextual note from additional research: Check Point Software Technologies is Israel’s largest publicly listed cybersecurity company and holds a substantial global enterprise market share in network security, endpoint protection, and cloud security. PepsiCo operates a large global enterprise IT estate. While it would be statistically common for a company of PepsiCo’s scale to use Check Point products — Check Point reports hundreds of Fortune 500 clients — no named contract, case study, vendor announcement, or procurement disclosure linking PepsiCo or SodaStream to Check Point has been identified in any public source. The same applies to all other named Israeli-origin vendors. Statistical likelihood of commercial relationship does not constitute verified evidence and is not treated as such here 24.
SodaStream’s Israeli R&D and manufacturing operations are headquartered in Be’er Sheva, Israel, following the closure of its Mishor Adumim (West Bank) facility in September 2015 712. Be’er Sheva is Israel’s designated “Cyber Capital” and hosts a dense cluster of Israeli cybersecurity companies and the Israeli National Cyber Directorate. Geographic co-location in the same city does not, however, constitute a verified vendor relationship, and no such relationship has been documented in any source class reviewed 21.
No public evidence has been identified of named systems integrators or digital transformation consultancies engaged specifically by SodaStream for major technology programmes separate from PepsiCo’s global IT governance. PepsiCo at the group level has used large-scale IT partners including Accenture and IBM (widely reported in trade press), but no SodaStream-specific IT integrator engagements are documented in corporate filings, trade press, or civil society investigations 3. IBM has a significant Israel presence — the IBM Research Lab in Haifa is one of the company’s oldest research centres — but no SodaStream-specific IBM engagement through the Israeli entity has been identified in any source class reviewed 24.
Daniel Birnbaum (CEO, SodaStream 2007–2020): Birnbaum served as CEO from approximately 2007 through 2020, including through the PepsiCo acquisition 818. Following his departure from SodaStream/PepsiCo in 2020, his activity has been documented in Israeli business press in connection with entrepreneurial and advisory roles. No verified equity stake, board role, or personal investment in Israeli surveillance, cyber, AI, SIGINT, or military-technology firms — including but not limited to NSO Group, Cellebrite, Carbyne, AnyVision/Oosto, Wiz, Palantir, Check Point, SentinelOne, or Verint — has been identified in any public source, including corporate filings, Israeli press, or civil society databases 32. Birnbaum was not a ≥10% shareholder in SodaStream at the time of the PepsiCo acquisition; the company was publicly traded on NASDAQ with no single controlling non-institutional shareholder identified in 20-F filings 2.
PepsiCo executive leadership and board: PepsiCo’s executive leadership and board composition are disclosed in annual DEF 14A proxy filings 29. No member of PepsiCo’s board or executive leadership team has been identified in public sources as holding verified personal investments or board roles in Israeli surveillance, cyber, or military-technology firms. PepsiCo’s largest institutional shareholders — Vanguard, BlackRock, State Street — are diversified index fund managers whose portfolios include Israeli technology companies; this represents passive index exposure, not directed investment in Israeli tech or military firms, and does not constitute a “controlling principal” relationship under the audit rubric 2229.
No public evidence has been identified of SodaStream deploying facial recognition, biometric identification, behavioural analytics, or gait analysis technologies at any of its facilities — including its Be’er Sheva manufacturing and R&D campus. No verified relationships with Israeli-origin vendors in this category — including Trigo, BriefCam, AnyVision/Oosto, or Trax — have been identified in any source class reviewed, including corporate filings, NGO reports, trade press, or civil society investigations 511.
Additional source checks confirm this finding: Amnesty International’s “Outsourcing Occupation” (2023) report 34, which addresses Israeli state use of private technology companies for surveillance in the occupied territories, does not name SodaStream or PepsiCo. Access Now’s telecommunications and surveillance reporting (2024) 35 similarly does not identify SodaStream or PepsiCo in connection with surveillance technology deployment or procurement. BriefCam (acquired by Canon) and AnyVision/Oosto’s documented client bases do not include consumer appliance manufacturers in any source reviewed.
No public evidence has been identified of SodaStream deploying Israeli-origin predictive analytics, social media monitoring, sentiment analysis, or workforce surveillance tools at its Israeli or international facilities. The Business & Human Rights Resource Centre and Who Profits Research Center corporate profiles for SodaStream do not reference any digital surveillance technology deployment 511.
No public evidence has been identified of Israeli-origin surveillance technologies reaching SodaStream’s operations indirectly through managed security services or bundled enterprise software suites. No vendor case studies, NGO supply-chain audits, or procurement disclosures referencing such arrangements have been identified. SOMO’s 2023 investigations into Israeli tech companies and settlement economy digital infrastructure 33 focus on telecommunications companies, cloud providers, and enterprise software vendors with documented Israeli government or settlement contracts; SodaStream and PepsiCo are not named in any SOMO investigation accessible through available sources.
SodaStream operates manufacturing and R&D infrastructure at its Be’er Sheva facility in Israel 12. No public evidence has been identified that SodaStream operates, leases, or co-locates dedicated data centre infrastructure within Israel distinct from general office and manufacturing IT systems. SodaStream’s corporate website describes its operations in terms of physical manufacturing and consumer product delivery, not technology hosting or data processing services 17.
PepsiCo’s globally documented Azure partnership (2020) does not include publicly disclosed Israel-specific data residency clauses or in-country sovereign cloud commitments for SodaStream’s operations 13. The specific cloud infrastructure serving SodaStream’s Israeli entity — whether Microsoft Azure, AWS, Google Cloud, or an Israeli sovereign cloud provider — has not been publicly documented in any source class reviewed.
One contextual note from additional research: Microsoft Azure opened its Israel Central data centre region in 2023 30. PepsiCo’s preferred cloud partner is Microsoft Azure 13. If SodaStream’s Israeli operations use Azure for cloud workloads, they would — under Microsoft’s standard data residency model — have the option to specify the Israel Central region for data localisation. However, no public evidence of SodaStream or PepsiCo selecting the Azure Israel Central region, entering a data residency arrangement for Israeli operations, or routing SodaStream data through Israeli-domiciled cloud infrastructure has been identified in any source. This remains an evidence gap requiring direct investigation of PepsiCo/SodaStream Azure subscription configurations, which are not publicly disclosed 30.
SodaStream’s consumer-facing digital assets include its website (sodastream.com), a mobile application (SodaStream+ / sparkling water tracker app), and connected appliance features on certain product lines (e.g., the SodaStream Art and Duo series include some connectivity features). Consumer app and connected appliance features collect limited user data: beverage carbonation tracking, product usage metrics, and CO₂ cylinder level monitoring. This is low-sensitivity consumer product telemetry, not location, biometric, communications, or financial data. The data controller for SodaStream’s consumer digital products is PepsiCo / SodaStream International Ltd.; privacy policy disclosures on the SodaStream website reference compliance with GDPR for EU users and applicable data protection laws. No public evidence has been identified that SodaStream’s consumer app data, product telemetry, or user account data is stored, processed, or routed through Israeli-domiciled infrastructure or that it is subject to Israeli law enforcement access mechanisms 17.
No public evidence has been identified that SodaStream or its parent PepsiCo participates in Project Nimbus, the Israeli government’s national cloud infrastructure programme for which contracts were awarded to Google Cloud and Amazon Web Services in 2021. PepsiCo and SodaStream are not identified as participants, sub-contractors, or tier-two suppliers in any publicly available Project Nimbus documentation. Consumer goods manufacturers are not among the programme’s named commercial participants.
No public evidence has been identified that SodaStream provides services marketed or contracted to ensure digital sovereignty or infrastructure resilience for Israeli state institutions or military bodies. SodaStream’s commercial identity is that of a consumer goods manufacturer of home carbonation appliances and consumables, not a technology services provider 117.
No public evidence has been identified of SodaStream holding contracts, partnerships, or service agreements with the Israeli Ministry of Defence, the Israel Defence Forces, Mossad, Shin Bet, or any Israeli military or intelligence agency. SodaStream’s business is the manufacture and sale of home carbonation systems, beverage appliances, and CO₂ cylinders 172. No defence procurement record, contract tender, or corporate disclosure in any jurisdiction references SodaStream as a defence or intelligence technology supplier. This finding is confirmed against the UN A/HRC/59/23 Special Rapporteur report (Albanese, 2025) 23, which names technology companies with Israeli defence and intelligence relationships — SodaStream and PepsiCo are not among them — and against the AFSC Investigate PepsiCo profile 26, which references the SodaStream acquisition in its historical settlement manufacturing context but does not identify PepsiCo or SodaStream as technology vendors to Israeli state or military bodies.
No public evidence has been identified, in any NGO, academic, or official source, of SodaStream’s commercial technology being deployed or adapted for military, intelligence, or law enforcement surveillance purposes. Who Profits Research Center, the principal Israeli civil society organisation documenting settlement economy corporate relationships, does not attribute dual-use technology provision to SodaStream 5. SodaStream’s product domain (consumer beverage carbonation) places it outside the scope of dual-use technology provision as documented in any source reviewed.
No public evidence has been identified. SodaStream does not operate in the cybersecurity, defence technology, or weapons manufacturing sectors. Its technology assets consist of patents in carbonation mechanics and appliance engineering rather than any dual-use or cyber-offensive domain 2.
No public evidence has been identified of SodaStream providing artificial intelligence, machine learning, computer vision, natural language processing, or autonomous decision-support systems to Israeli state, military, or security bodies. No AI product or platform developed by SodaStream has been identified in any source class reviewed. The UN A/HRC/59/23 report (Albanese, 2025) 23, which specifically addresses AI, cloud infrastructure, and surveillance systems in the context of Israeli occupation and military operations in §§36–43, does not name SodaStream or PepsiCo.
PepsiCo at the parent level has made publicly documented investments in AI and data analytics for supply chain optimisation, demand forecasting, and consumer behaviour analytics, widely reported in trade press from 2021 through 2024 24. These are general consumer goods applications. No AI capability deployed by PepsiCo at the group level has been identified as provided to or used by Israeli state, military, or security bodies. SodaStream’s contribution to PepsiCo’s AI and data estate — if any — is not independently documented.
No public evidence has been identified of SodaStream’s operations involving AI model development, training pipelines, or datasets derived from surveillance or operational monitoring contexts. SodaStream’s documented R&D activity is centred on physical product engineering — carbonation technology, appliance design, and CO₂ delivery systems 12.
No public evidence has been identified. SodaStream’s product domain — home and professional beverage carbonation — does not intersect with autonomous weapons systems, drone technology, or any application falling within the scope of lethal autonomous systems assessment.
SodaStream operates an R&D and manufacturing facility in Be’er Sheva (Omer Industrial Zone), which became its global headquarters and primary innovation centre following the closure of the Mishor Adumim West Bank factory in September 2015 712. Israeli business press reported the Be’er Sheva R&D relocation at the time, framing it as part of the company’s operational consolidation in southern Israel 12. The facility’s documented focus is on physical product engineering: carbonation technology, appliance design, CO₂ cylinder and exchange systems, and sustainable packaging — not software, digital platforms, or cybersecurity products 17.
Be’er Sheva hosts Ben-Gurion University of the Negev’s cybersecurity research programmes, the Israeli National Cyber Directorate’s headquarters, and a concentration of Israeli cyber companies. SodaStream’s location in this ecosystem is geographic. No verified R&D collaboration, joint venture, or technology transfer arrangement between SodaStream and any of these proximate institutions has been identified 21.
No public evidence has been identified of SodaStream acquiring Israeli-origin technology companies or making strategic investments in Israeli technology startups or venture capital funds, either before or after the PepsiCo acquisition in 2018. PepsiCo’s broader corporate development activity — reviewed through SEC 10-K filings for 2019 through 2024 — includes food and beverage portfolio acquisitions but no identified Israeli tech investments attributable to the SodaStream business unit 32229.
SodaStream holds patents primarily in carbonation technology, beverage dispensing mechanisms, and CO₂ cylinder design — consumer product patents filed across multiple jurisdictions, consistent with its manufacturing identity as disclosed in SEC Form 20-F filings 2. No significant software, AI, machine learning, or cybersecurity-related patent portfolio has been identified through review of USPTO filings or trade press.
No public evidence has been identified of licensing agreements or co-development arrangements between SodaStream and Israeli academic institutions — including the Technion–Israel Institute of Technology, Hebrew University of Jerusalem, or the Weizmann Institute of Science — in any technology domain covered by this audit 2.
SodaStream has attracted sustained NGO and civil society scrutiny, concentrated in the period 2012–2018, with the primary focus on its settlement manufacturing operations at Mishor Adumim in the occupied West Bank. The following organisations have published findings referencing SodaStream:
No published NGO investigation, academic study, or UN report has been identified that specifically addresses SodaStream’s digital technology vendor relationships, IT supply chain, or cybersecurity procurement in connection with the Israeli state.
SodaStream has been one of the most prominent targets of the BDS (Boycott, Divestment, Sanctions) movement, with organised campaigns running from approximately 2012 through 2018 and continuing in residual form thereafter 3916.
The publicly documented grounds for BDS targeting were:
The campaign gained widespread international attention through the Scarlett Johansson/Oxfam controversy of January–February 2014, in which Johansson resigned as an Oxfam ambassador after declining to withdraw from SodaStream’s Super Bowl advertising campaign, generating sustained media coverage of the settlement manufacturing debate 2.
SodaStream announced the closure of its Mishor Adumim factory in October 2014 6 and completed the relocation to Be’er Sheva in September 2015 7. BDS campaigners characterised this as a partial outcome while maintaining that relocation to Israel proper did not end the basis for the boycott, given continued operations within Israel and the subsequent PepsiCo acquisition 3.
SodaStream’s documented responses included: CEO Daniel Birnbaum’s repeated public statements defending the West Bank factory as a source of employment for Palestinian workers; framing of the factory closure as a business-driven decision rather than a concession to BDS; and post-acquisition integration into PepsiCo’s global ESG and sustainability framework 6818.
The BDS campaign against SodaStream is based entirely on its settlement manufacturing history and associated labour practices. No BDS or civil society campaign has been identified that specifically targets SodaStream’s digital technology vendor relationships, IT procurement, or cybersecurity supply chain.
The ICJ Advisory Opinion of 19 July 2024 27 held that Israel’s continued presence in the Occupied Palestinian Territory is unlawful under international law and that all states and international organisations have obligations not to render aid or assistance that maintains that presence. The ICC Pre-Trial Chamber issued arrest warrants for Benjamin Netanyahu and Yoav Gallant on 21 November 2024 28.
For constructive notice purposes:
The settlement nexus for SodaStream is historical (Mishor Adumim, pre-September 2015). No evidence has been identified of any post-2015 SodaStream digital product, service, or platform being provided in or to Israeli settlements, whether directly or via licensees or franchisees. SodaStream markets and sells consumer carbonation appliances and CO₂ cylinder exchange services in Israeli retail markets, including through Israeli retail chains that may operate in settlements; however, no evidence has been identified of SodaStream operating digital infrastructure, platforms, or services specifically deployed within settlement territories, or of SodaStream’s e-commerce or digital consumer platforms being specifically targeted at or operated for settlement consumers as a distinct category 35.
https://www.pepsico.com/news/press-release/pepsico-completes-acquisition-of-sodastream08292018 ↩↩
https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001412095&type=20-F&dateb=&owner=include&count=40 ↩↩↩↩↩↩↩↩
https://www.hrw.org/report/2016/01/19/occupation-inc/how-settlement-businesses-contribute-israels-violations-palestinian-rights ↩↩
https://www.reuters.com/article/us-sodastream-factory/sodastream-to-move-factory-from-west-bank-as-bds-pressure-grows-idUSKBN0IJ1KK20141030 ↩↩
https://www.theguardian.com/world/2015/sep/04/sodastream-moves-its-israeli-factory-out-of-the-west-bank ↩↩↩
https://www.haaretz.com/israel-news/business/2018-08-20/ty-article/pepsico-buys-sodastream-for-3-2-billion/0000017f-db8c-d3ff-a7ff-fffc4b360000 ↩↩↩
https://electronicintifada.net/content/how-bds-brought-sodastream-its-knees/14314 ↩↩
https://www.ohchr.org/en/hr-bodies/hrc/regular-sessions/session43/list-of-reports ↩
https://www.business-humanrights.org/en/companies/sodastream/ ↩↩
https://en.globes.co.il/en/article-sodastream-moves-rd-to-beer-sheva-1001056000 ↩↩↩↩↩
https://news.microsoft.com/2020/01/15/pepsico-partners-with-microsoft-azure/ ↩↩↩↩
https://www.sap.com/uk/industries/consumer-products/customers.html ↩
https://www.alhaq.org/advocacy/7937.html ↩
https://www.stopthewall.org/2013/01/21/five-reasons-boycott-sodastream ↩↩↩
https://www.sodastream.com/en-us/pages/about-sodastream ↩↩↩↩↩
https://complaints.oecdwatch.org/cases ↩
https://www.behindthebrands.org/companies/pepsico ↩
https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=PEP&type=10-K&dateb=&owner=include&count=10 ↩↩↩↩
https://www.ohchr.org/en/documents/thematic-reports/ahrc5923-economy-occupation-economy-genocide-report-special-rapporteur ↩↩↩
https://www.cio.com/article/searchresults?q=pepsico+digital+transformation ↩↩↩↩
https://dontbuyintooccupation.org/reports/ ↩
https://www.icj-cij.org/case/163 ↩
https://www.icc-cpi.int/news/pre-trial-chamber-i-rejects-state-of-israels-challenges-jurisdiction-and-issues-warrants-arrest ↩
https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=PEP&type=10-K&dateb=&owner=include&count=10 ↩↩↩
https://azure.microsoft.com/en-us/explore/global-infrastructure/geographies/#choose-your-region ↩↩
https://www.business-humanrights.org/en/companies/pepsico/ ↩
https://www.linkedin.com/in/danielbirnbaum/ ↩
https://www.amnesty.org/en/latest/campaigns/2023/11/outsourcing-occupation/ ↩↩
https://www.accessnow.org/campaign/ ↩