Audit Phase: V-DIG (Digital Forensics / Technology Supply Chain)
Audit Date: 2026-05-01
Prepared by: V-DIG Research Unit
Wayfair’s most significant and thoroughly documented technology relationship is its multi-year strategic partnership with Google Cloud Platform (GCP), announced in January 2020 1. GCP serves as Wayfair’s primary cloud infrastructure, data analytics, and machine learning environment. This relationship has been continuously confirmed by Google’s own customer case study pages 3, Wayfair’s public engineering blog 45, and GCP workload optimisation documentation 2. Wayfair has publicly detailed its use of Google Cloud Spanner (distributed relational database), Vertex AI (machine learning operations), and broader GCP data infrastructure across its e-commerce platform 45. Wayfair engineers participated in Google Cloud Next 2023, reinforcing an active and deepening partnership at the engineering level 5.
The GCP relationship is the single most material and independently verifiable vendor dependency in this audit. Its relevance to Section 3 (Project Nimbus and sovereign cloud participation) is addressed in full below.
Wiz is a real company: founded approximately 2020, Israeli in origin, with co-founders (including Assaf Rappaport) who are confirmed alumni of Israeli military intelligence (Unit 8200). The company is headquartered in New York with significant R&D operations in Tel Aviv. These corporate facts are publicly documented 10.
A prior research draft alleged that a Wayfair Platform Product Manager and a Wiz Field CTO co-presented at GraphQL Summit 2025, citing the Apollo GraphQL Summit 2025 announcement 10. Review of that announcement does not confirm the identity of those specific speakers. The specific co-presentation claim is [UNVERIFIED — REQUIRES LIVE SEARCH].
No independently verifiable public record — press release, vendor case study, SEC filing, or confirmed engineering blog post — confirming that Wayfair is a Wiz customer has been located. No public evidence identified of a Wayfair–Wiz commercial relationship.
A prior research draft claimed Wayfair uses Check Point firewall and VPN appliances. The sources cited in support of that claim were a Reddit community thread discussing a generic Check Point technical feature and a 2010 financial article about Check Point’s earnings — neither of which references Wayfair. No press release, case study, procurement record, or credible news article confirming a Wayfair–Check Point relationship has been located in available sources.
Check Point and Wiz entered a documented strategic partnership in 2024 7, and Check Point is a well-established Israeli-origin cybersecurity company. However, inter-vendor partnerships do not establish Wayfair as an end customer of either firm.
No public evidence identified of a Wayfair–Check Point vendor relationship. [UNVERIFIED — REQUIRES LIVE SEARCH]
A prior research draft alleged that Wayfair is a CyberArk customer, citing a commercial market intelligence database (appsruntheworld.com) and a partner directory listing (Cloudtango). Partner directories list resellers and integration partners — not confirmed end-customers — and market intelligence databases of this class are not independently verifiable without a live paid subscription. Neither source constitutes verifiable public evidence of Wayfair holding a CyberArk licence.
The CyberArk–Wiz technical integration 8 and CyberArk–SentinelOne technical integration 9 are real, publicly documented inter-vendor partnerships. These documents discuss integrations between those security products; they say nothing about Wayfair’s procurement.
No public evidence identified of a Wayfair–CyberArk vendor relationship. [UNVERIFIED — REQUIRES LIVE SEARCH]
A prior research draft claimed Wayfair’s security job descriptions reference familiarity with SentinelOne. Job postings are ephemeral and cannot be verified from archived sources. The CyberArk–SentinelOne integration press release 9 confirms an inter-vendor product partnership; it does not identify Wayfair as a customer of either company.
Wayfair career postings for retail asset protection 16 and warehouse security 17 confirm that Wayfair employs physical and digital security staff, but no named cybersecurity vendor is identifiable from these public postings.
No public evidence identified of a Wayfair–SentinelOne vendor relationship. [UNVERIFIED — REQUIRES LIVE SEARCH]
No Wayfair–Palo Alto Networks relationship has been identified in any source available for this audit. No public evidence identified.
A prior research draft characterised Publicis Sapient as a digital transformation partner for Wayfair. The source cited was a general industry commentary article that references Publicis Sapient in a sector-wide context; it does not identify Wayfair as a Publicis Sapient client. No public evidence identified of any integrator relationship mandating Israeli-origin technology for Wayfair. [UNVERIFIED — REQUIRES LIVE SEARCH]
Wayfair’s annual 10-K filings, accessible through SEC EDGAR 24, do not name specific cybersecurity vendors in technology risk disclosures. No Israeli-origin vendor is named in any Wayfair 10-K known from available sources.
Wayfair opened its first physical retail store in Wilmette, Illinois in 2024, marking its entry into brick-and-mortar retail 3. This expansion creates a new operational domain in which point-of-sale, loss prevention, and in-store analytics vendors become material to any technology supply chain assessment.
A prior research draft claimed that Wayfair’s Head of Physical Retail, Kevin O’Riordan, confirmed deployment of the Toshiba ELERA commerce platform at NRF 2023 26. The cited sources are Retail Today Magazine’s NRF 2023 trade feature 26 and Toshiba’s NRF 2023 Business Wire announcement 12. These are trade media features covering Toshiba’s exhibition presence at NRF; they do not unambiguously confirm a signed Wayfair–Toshiba ELERA deployment contract. This specific claim remains [UNVERIFIED — REQUIRES LIVE SEARCH] and direct reading of the original article for verbatim attribution.
The ELERA platform’s relevance to this audit is material if the vendor relationship is confirmed, because:
However, the pathway from Toshiba ELERA to active Trigo deployment at Wayfair involves two unconfirmed steps: (1) the Wayfair–ELERA deployment itself, and (2) Wayfair’s activation of any Trigo-powered module within ELERA (frictionless checkout, AI-driven loss prevention). Wayfair has not publicly announced “Just Walk Out” or any comparable autonomous checkout capability.
Finding: Toshiba ELERA–Trigo technology integration is documented in industry sources 2527. The Wayfair–Toshiba ELERA deployment claim is [UNVERIFIED]. No confirmed Trigo deployment at Wayfair has been identified. The pathway represents a conditional risk vector, not a confirmed deployment.
Trax Retail was co-founded by Joel Bar-El and Dror Feldheim in 2010, with founding operations in Israel; it is currently headquartered in Singapore 14. The company closed a USD $125 million investment round led by Boyu Capital 15. Trax provides AI-powered shelf monitoring and image recognition for fast-moving consumer goods retail.
A prior research draft inferred a Wayfair–Trax relationship from shared conference attendance between named executives. Shared conference appearance is not evidence of a commercial relationship and is inadmissible as such. No press release, case study, or procurement record confirming a Wayfair–Trax commercial relationship has been located.
No public evidence identified of a Wayfair–Trax commercial relationship.
A prior research draft characterised Wayfair’s use of BriefCam or AnyVision/Oosto as “high probability” based on industry norms. Inference from industry adoption patterns does not constitute verifiable evidence and is inadmissible in this audit.
Wayfair’s Retail Asset Protection & Loss Prevention career posting 16 and Warehouse Security Agent posting 17 confirm that Wayfair employs staff to manage physical security technology including CCTV and access control systems. Neither posting names a specific video analytics or facial recognition vendor.
No public evidence identified of Wayfair deploying BriefCam, AnyVision/Oosto, or any other named Israeli-origin video analytics platform in its retail or warehouse operations.
No evidence has been located of Wayfair using Israeli-origin predictive analytics, social media monitoring, sentiment analysis, or workforce surveillance tools. No public evidence identified.
No evidence of Israeli surveillance technologies entering Wayfair’s environment indirectly through managed security service providers or bundled enterprise security suites has been identified in available sources. No public evidence identified.
Wayfair’s cloud infrastructure is built substantially on Google Cloud Platform, a relationship publicly confirmed since January 2020 1 and documented in ongoing detail through 2023–2024 2345. Wayfair’s engineering team has published technical documentation describing GCP workload optimisation across compute, storage, and database tiers 2. The use of Google Cloud Spanner — GCP’s globally distributed relational database — is confirmed by Wayfair’s own technical publications, which describe active work on multi-region latency profiling 4. Wayfair engineers attended and spoke at Google Cloud Next 2023, indicating a continuing and active technical partnership 5.
Project Nimbus is a documented $1.2 billion contract awarded jointly to Google Cloud and Amazon Web Services by the Israeli government in 2021 to provide cloud computing infrastructure to Israeli government ministries and military institutions 23. The existence, scope, and parties to this contract are confirmed by multiple credible news sources 23.
Google Cloud workers publicly protested Project Nimbus in April 2024 under the “No Tech For Apartheid” banner; a number of participating employees were subsequently dismissed 2122. These events are independently verified.
The structural relationship between Wayfair’s GCP dependency and Project Nimbus is as follows:
The distinction between being a commercial customer of a vendor that also holds government contracts, versus being a participant in those government contracts, is material. On current evidence, Wayfair sits in the former category only.
Google Cloud’s Israel region, designated me-west1 and located in Tel Aviv, became operational in 2022 6. It is a standard GCP multi-region offering available to any GCP customer.
Wayfair’s tech blog documents active use of a multi-region Spanner configuration 4, focused on latency optimisation across geographically distributed nodes. The published technical content discusses US-based and European regions; it does not reference me-west1 or any Israeli data residency. No public configuration disclosure, architecture document, or privacy policy from Wayfair specifies whether me-west1 has been enabled in any Wayfair Spanner instance or other GCP workload.
The claim that Wayfair’s data “probably” transits or resides in the me-west1 region is an inference, not an evidenced finding. No public evidence identified that Wayfair routes data to or stores data in the GCP me-west1 (Tel Aviv) region. [UNVERIFIED — REQUIRES INTERNAL TECHNICAL DISCLOSURE OR INFRASTRUCTURE AUDIT]
No evidence of Wayfair operating, leasing, co-locating, or contracting for data centre infrastructure physically within Israel has been identified. No public evidence identified.
No evidence of Wayfair participating in Project Nimbus, any Israeli government cloud procurement programme, or any sovereign cloud initiative in Israel in any capacity — as prime contractor, subcontractor, technology partner, or reseller — has been identified. No public evidence identified.
Wayfair is an e-commerce retailer. It is not a cloud services provider and does not sell or resell cloud infrastructure to government or third-party entities. This category is not applicable to Wayfair’s business model.
No evidence of any contract, memorandum of understanding, partnership agreement, or service engagement between Wayfair and the Israeli Ministry of Defence, Israel Defense Forces (IDF), Shin Bet, Mossad, Unit 8200, or any other Israeli state security body has been identified in any source available for this audit. No public evidence identified.
No instance of Wayfair’s commercially available technology — including its e-commerce platform, logistics systems, or data infrastructure — being deployed for military, intelligence, or law enforcement surveillance purposes in Israel or in occupied territories has been publicly reported, documented by investigative researchers, or confirmed by official sources. No public evidence identified.
Wayfair’s primary commercial output is retail e-commerce and home goods logistics. The company’s technology products (search algorithms, recommendation engines, 3D visualisation tools, logistics optimisation software) are commercial in nature and are not known to be subject to US Export Administration Regulations (EAR) controls related to military end-use. No export control action, licence condition, or controlled-technology designation involving Wayfair has been identified in available regulatory records. No public evidence identified.
Wayfair has no known involvement in offensive cyber capability development, zero-day vulnerability research, digital weapons systems, or cyber-intelligence tooling. No such claim appears in any source available for this audit. No public evidence identified. Not applicable to Wayfair’s business model.
Wayfair uses artificial intelligence and machine learning extensively for internal commercial purposes. This is confirmed by Google Cloud’s customer case study 3 and Wayfair’s own engineering blog posts describing Vertex AI usage 5. Known internal AI applications include product search and recommendation personalisation, demand forecasting, logistics and routing optimisation, pricing algorithms, and 3D room visualisation tools. These applications serve Wayfair’s commercial operations and are documented as consumer-facing or supply-chain-facing in nature.
No evidence of Wayfair providing AI or machine learning systems, models, training data, or inference infrastructure to Israeli government ministries, military entities, security services, or intelligence agencies has been identified. No public evidence identified.
No publicly reported instance of Wayfair’s AI models being trained on civilian population data, intercepted communications, surveillance-derived datasets, or data originating from occupied territories has been identified. No public evidence identified.
Wayfair has no known involvement in autonomous weapons systems, lethal autonomous systems, military robotics, or any AI applications with potential for application to lethal force. No public evidence identified. Not applicable to Wayfair’s business model.
No investigation, regulatory finding, or credible published report has identified Wayfair’s algorithmic systems as contributing to discriminatory outcomes in contexts related to the subject matter of this audit. No public evidence identified in this domain.
No evidence of Wayfair operating any research and development facility, engineering office, satellite campus, innovation lab, or accelerator programme physically located within Israel has been identified in training data, corporate filings, or the prior research draft. Wayfair’s confirmed engineering and corporate hubs are in Boston (global headquarters), Berlin, and Galway. No public evidence identified.
Wayfair’s publicly known acquisition history includes brand expansions (Birch Lane, AllModern, Perigold, Joss & Main) and technology acquisitions in logistics and 3D product visualisation. None of these acquisitions are Israeli-origin companies. No strategic acquisition of an Israeli-founded or Israel-domiciled technology company by Wayfair has been publicly announced or reported. No public evidence identified.
No strategic investment by Wayfair in Israeli technology startups, Israeli venture funds, Israel-focused technology accelerators, or Israeli university commercialisation programmes has been publicly announced. No public evidence identified.
No significant patent filing, licensing agreement, co-development arrangement, or joint IP ownership between Wayfair and Israeli-domiciled entities — including academic institutions such as the Technion, Hebrew University, or Weizmann Institute — has been identified in patent databases or public corporate disclosures available in training-data sources. Wayfair’s SEC filings 24 do not disclose material IP relationships with Israeli entities. No public evidence identified.
Wayfair ships products internationally, including to Israel, via third-party international freight forwarding services 18. The existence of this shipping pathway is confirmed by consumer-facing logistics information. Whether Wayfair’s fulfilment network actively facilitates delivery to Israeli settlements in occupied territories — as distinct from delivery within Israel’s internationally recognised borders — is not determinable from publicly available shipping policy documentation. [UNVERIFIED — REQUIRES POLICY DOCUMENTATION REVIEW]
No published NGO investigation, academic study, UN report, or civil society research document specifically addressing Wayfair’s technology relationships with Israeli state entities, military institutions, or its commercial footprint in occupied territories has been identified. No public evidence identified of NGO or academic scrutiny specifically targeting Wayfair’s Israeli technology relationships.
The most significant documented instance of civil society pressure on Wayfair is the June 2019 employee walkout, in which hundreds of Wayfair employees staged a protest against the company’s sale of bedroom furniture to contractors operating migrant detention facilities at the US-Mexico border under US government contracts 19. This event is confirmed by contemporaneous major news coverage 19 and appears in the Collective Actions in Tech data repository 20. This incident is substantively unrelated to Israeli technology relationships or occupied territories, but establishes a documented precedent of employee-led civil society action targeting Wayfair’s commercial relationships on human rights grounds.
The No Tech For Apartheid campaign 22 has publicly identified and targeted Google 21, Amazon, and specific enterprise software vendors over their participation in Project Nimbus and related Israeli government technology contracts. Wayfair does not appear in any publicly documented No Tech For Apartheid campaign material as a named target. The campaign has not, on available evidence, identified Wayfair as a technology provider to Israeli state entities. No public evidence identified of organised BDS or No Tech For Apartheid activity specifically targeting Wayfair for its technology relationships with Israel.
No regulatory inquiry, government investigation, export control enforcement action, OFAC sanctions matter, FTC or DOJ proceeding, or legal challenge involving Wayfair’s technology sales, services, or commercial relationships with Israeli state entities has been identified. Sources examined include SEC EDGAR filings 24, training-data knowledge of DOJ/FTC enforcement actions, and OFAC public sanctions records. No public evidence identified.
No data protection enforcement action by a regulatory authority (including the EU’s Data Protection Authorities, the Irish DPC, or US state privacy regulators) specifically concerning Wayfair’s data flows to or from Israeli entities or infrastructure has been identified. No public evidence identified in this specific sub-domain.
https://www.googlecloudpresscorner.com/2020-01-10-Wayfair-Chooses-Google-Cloud-to-Help-Scale-Its-Growing-Business,-While-Creating-Engaging-Consumer-and-Seller-Experiences ↩↩↩
https://cloud.google.com/blog/products/application-modernization/wayfair-identified-strategies-to-optimize-cloud-workloads-part-1 ↩↩↩
https://www.aboutwayfair.com/tech-innovation/quantifying-google-cloud-spanners-geographic-latency ↩↩↩↩↩↩
https://www.aboutwayfair.com/careers/tech-blog/wayfair-descends-on-google-cloud-next-2023 ↩↩↩↩↩↩↩
https://cloud.google.com/blog/products/infrastructure/google-cloud-region-in-israel ↩
https://www.checkpoint.com/press-releases/check-point-software-technologies-and-wiz-enter-strategic-partnership-to-deliver-end-to-end-cloud-security/ ↩
https://investors.cyberark.com/news/news-details/2024/CyberArk-and-Wiz-Team-Up-To-Provide-Complete-Visibility-and-Control-for-Cloud-Created-Identities/default.aspx ↩
https://www.cyberark.com/press/cyberark-and-sentinelone-team-up-to-enable-step-change-in-endpoint-and-identity-security/ ↩↩
https://www.apollographql.com/blog/announcing-graphql-summit-by-apollo-2025-connect-everything-build-anything ↩↩
https://commerce.toshiba.com/wps/portal/marketing/?urile=wcm:path:/en-us/home/company/newsmedia/news/weis-elera-security-suite-2&mapping=tgcs_new.portal.company.newsdetails.new ↩
https://www.businesswire.com/news/home/20230105005402/en/NRF-2023-Guests-Will-Be-Immersed-in-How-Toshiba-Global-Commerce-Solutions-is-YOUnifying-Experiences-at-Retails-Big-Show-in-Booth-3323 ↩
https://pomeroy.com/wp-content/uploads/2025/04/Pomeroy-Toshiba-Case-Study-Grocery-AI-SCO.pdf ↩
https://en.wikipedia.org/wiki/Trax_Retail ↩
https://www.prnewswire.com/in/news-releases/trax-closes-us125-million-investment-round-led-by-boyu-capital-687068341.html ↩
https://www.wayfair.com/careers/job/specialist–retail-asset-protection—loss-prevention–wayfair-retail-stores/2-9929 ↩↩
https://www.wayfair.com/careers/job/warehouse-security-agent/2-11951 ↩↩
https://www.myus.com/stores/how-to-ship-wayfair-us/ ↩
https://www.nytimes.com/2019/06/26/business/wayfair-walkout-protest.html ↩↩
https://data.collectiveaction.tech/ ↩
https://www.theguardian.com/technology/2024/apr/19/google-workers-protest-project-nimbus-israel-contract ↩↩
https://www.haaretz.com/israel-news/tech-news/2021-05-02/ty-article/google-amazon-win-1-2-billion-israel-cloud-contract/0000017f-e078-d804-a37f-e27f74610000 ↩↩↩
https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001616533&type=10-K&dateb=&owner=include&count=10 ↩↩↩
https://omnitalk.blog/2024/01/10/inside-nettos-frictionless-grocery-store-the-magic-of-real-time-receipts-cashierless-checkout/ ↩↩
https://magazine.retail-today.com/nrf_2023/store_experience ↩↩
https://www.retailinsider.com/wp-content/uploads/2022/10/Digital-Retail-Innovations-2022-Report-3.pdf ↩↩
