Audit Phase: V-DIG
Target Company: WorldPay (subsidiary of Global Payments Inc. as of January 2026)
Audit Date: 2026-05-01
Global Payments Inc. completed the acquisition of WorldPay from GTCR in January 2026, in a transaction announced at $24.25 billion.13 Global Payments simultaneously divested its Issuer Solutions business as part of a three-way restructuring, positioning the combined entity as a “pure-play commerce solutions provider.”2 WorldPay now operates as a subsidiary of Global Payments Inc., and group-level technology infrastructure decisions are made at the parent level.2 All vendor relationships discussed below should be understood within this consolidated corporate structure.
CyberArk is a verified Israeli-founded company (est. 1999, HQ Petah Tikva / Newton MA; NASDAQ: CYBR), and one of the dominant global vendors in privileged access management. Its founder Udi Mokady’s background in Israeli intelligence units is publicly documented across multiple press profiles. CyberArk PAM products are widely deployed across financial services globally.
The Global Payments Ireland/UK sub-processor list (June 2023, covering e-commerce payment gateway services) is a real, publicly hosted corporate document.4 A prior research document asserts this filing names CyberArk as a listed sub-processor; however, this specific claim cannot be independently corroborated from publicly available records without direct page retrieval. The CyberArk Blueprint whitepaper cited as supporting evidence28 is a generic vendor marketing document and does not on its face confirm a WorldPay–CyberArk contractual relationship. No independently verifiable primary source — procurement record, press release, or named-customer disclosure — confirms WorldPay or Global Payments as a CyberArk customer.
Check Point is a verified Israeli company (est. 1993, Tel Aviv; NASDAQ: CHKP). Founder Gil Shwed’s service in Unit 8200 is publicly documented. Check Point’s network security products are among the most widely deployed in global financial services.
A third-party data-broker list (Span Global Services)30 is cited as confirmation that WorldPay uses Check Point products. Third-party technology-user databases are compiled through indirect inference and are not procurement records. A separate Check Point citation concerns a blockchain firewall partnership with “Fuse,” a blockchain network platform — that partnership is unrelated to WorldPay.38 No primary source confirms a WorldPay–Check Point contractual relationship. The data-broker citation is not treated as evidentiary.
Wiz is a verified Israeli-founded company (est. 2020, HQ New York/Tel Aviv). The founding team, led by Assaf Rappaport, are publicly documented veterans of Unit 8200. Google announced and completed the acquisition of Wiz in 2025 for approximately $32 billion.41
A Global Payments job posting for a DevOps Engineer and Team Lead role (Rehovot, Israel)7 references monitoring and triaging security vulnerabilities identified by platforms “such as Wiz.” Job postings that name vendor tooling in requirements specifications are a moderate-quality signal of active deployment; they are not contractual confirmations. A Proofpoint–Wiz Integration Network partnership announcement22 is a real press release but names neither WorldPay nor Global Payments and has no direct evidentiary bearing. The Wiz job-posting reference constitutes the highest-quality available signal of vendor deployment at Global Payments; it is treated as moderately supported but not conclusive.
NICE Actimize is a verified Israeli-origin company (NICE Systems, founded in part by former IDF personnel; HQ Ra’anana, Israel; NASDAQ: NICE). Its Actimize platform is a major AML, fraud detection, and compliance engine widely deployed across global financial institutions. NICE Actimize’s February 2024 launch of generative AI capabilities — including “X-Sight AI Assist,” “X-Sight AI Narrate,” and “Xceed FraudDESK CoPilot” — is documented in trade press.17 NICE Actimize’s acquisition of Guardian Analytics, expanding its AI-cloud AML portfolio, is also publicly documented.18
The Fintech Global article describing these product launches17 addresses NICE Actimize’s capabilities generally and does not name WorldPay or Global Payments as a customer. No independently verifiable primary source confirms WorldPay or Global Payments as a named NICE Actimize customer in a procurement or press-release context.
SentinelOne is a verified company (est. 2013; NASDAQ: S) with substantial Israeli R&D operations and a founding team with documented ties to the Israeli cyber-intelligence community. A PeerSpot product comparison page31 is cited as evidence that WorldPay uses SentinelOne; PeerSpot comparison pages are aggregated review sites and do not constitute procurement records. A separate Papaya Global case study on SentinelOne37 pertains to SentinelOne’s own HR vendor selection and has no relevance to WorldPay. No primary source confirms WorldPay or Global Payments as a SentinelOne customer.
WorldPay’s developer documentation references P2PE (Point-to-Point Encryption) security architecture26, with Bluefin cited as a named P2PE partner.27 Bluefin is a US-based company with no Israeli-origin classification in publicly available records.
The Global Payments Ireland sub-processor list4 is a publicly accessible primary-source document disclosing sub-processors for e-commerce gateway services in Ireland/UK. Its specific named contents cannot be confirmed without direct retrieval; this document is the highest-priority gap in the current evidence base.
No public evidence identified of named systems integrators or IT outsourcing partners mandating Israeli-origin technology in WorldPay or Global Payments engagements in verifiable public sources. Annual filings with the SEC (Global Payments 10-K)34 and the WorldPay corporate press releases index35 do not identify Israeli cybersecurity vendors by name in publicly available extracts from training-data knowledge.
Trigo is a verified Israeli company (est. 2017, Tel Aviv) that develops computer vision technology for frictionless, autonomous checkout in physical retail environments. Trigo raised $100M in 2022 with investors including Rewe Group and ALDI.24 Its deployments across multiple European retail chains are publicly documented across trade and technology press.23
Netto (Germany): Trigo’s deployment in Netto’s Regensburg autonomous store — described at launch (January 2024) as Europe’s largest autonomous store at approximately 800 square metres — is documented in retail technology trade press.11 Prior research asserts WorldPay serves as the payment processor for this deployment. WorldPay’s retail sector page confirms broad provision of payment services to retail clients,16 but no primary source independently confirms WorldPay as the named acquirer or processor specifically for Netto’s Trigo deployment. The Trigo–Netto deployment is verified; WorldPay’s specific role as Netto’s acquirer in this instance is not confirmed in primary sources.
Tesco (UK): Tesco’s deployment of Trigo’s technology across its GetGo cashierless stores in the United Kingdom is publicly documented.12 Tesco is a major UK retail client publicly associated with WorldPay’s acquiring services (WorldPay being among the dominant UK card acquirers). However, no primary source independently confirms WorldPay as the named payment rail specifically enabling the Trigo-powered GetGo transaction flow, as distinct from being Tesco’s card acquirer for non-Trigo payment streams. Both the WorldPay–Tesco acquiring relationship and the Tesco–Trigo deployment are separately verifiable; the specific nexus is not confirmed in a primary source.
Aldi Nord (Netherlands): Trigo’s “Shop & Go” autonomous store in Utrecht and its closure in October 2024 — attributed to high operating costs — are documented in trade press13 and in Aldi/Trigo’s own promotional footage.36 WorldPay’s role as payment processor for this store is not confirmed in primary sources.
SAP Store Integration (Trigo EasyOut + WorldPay): The SAP Partner Store listing for Trigo’s “EasyOut” product14 is a real, publicly accessible commercial partner directory page and represents the strongest available signal of a formal technical integration between Trigo and a named payment processor. Prior research asserts this listing explicitly names WorldPay as the integrated payment partner. SAP Store partner listings are primary-source commercial disclosures; the claim is treated as moderately supported, but direct page retrieval is required to confirm WorldPay’s specific naming. A December 2023 retail technology news roundup also references Trigo alongside FreedomPay in a payments context.23
Founders’ Intelligence Backgrounds: Prior research asserts Trigo’s founders (Daniel Gabay and Michael Gabay) have backgrounds in Talpiot and Unit 8200. This claim is not independently confirmed in training-data knowledge from publicly available biographical profiles. Founder military unit affiliations are unverified.
BioCatch is a verified Israeli company (est. 2011, Tel Aviv) specialising in behavioural biometrics and fraud prevention via continuous session monitoring. Its $145 million investment round led by Bain Capital Tech Opportunities is publicly documented.10 Founder Avi Turgeman’s Unit 8200 background is publicly documented in multiple press profiles.
Prior research argues that Bain Capital’s investment role in the WorldPay deal creates a “portfolio-level strategy” to deploy BioCatch across Bain-related portfolio companies, including WorldPay. This is an inferential claim based on shared investor overlap. No primary source — named-customer announcement, press release, or technical integration disclosure — confirms WorldPay has a licensing or integration agreement with BioCatch. The shared-investor inference is not treated as evidentiary confirmation of a customer relationship.
BriefCam is a verified Israeli company (founded via Hebrew University spinout; subsequently acquired by Canon). Prior research cites a software comparison page as evidence that WorldPay “integrates with BriefCam for surveillance analytics.” The cited source pertains to a comparison of Genetec Synergis and an unrelated product, and has no evident relevance to WorldPay. This claim is discarded; the cited source does not support it.
Verint is a verified Israeli-origin company (spun off from Comverse Technology; NASDAQ: VRNT; HQ Melville, NY with major Israeli operations). Its workforce engagement and analytics products are widely deployed in financial services contact centres.
Prior research cites a Content Guru CX integrations page41 and a GetApp integrations listing44 as evidence that WorldPay uses Verint for workforce management. The Content Guru page lists integrations for Content Guru’s own platform, not WorldPay’s internal tooling. GetApp integrations listings reflect third-party scheduling or customer management software that accepts WorldPay payments (i.e., software that integrates with WorldPay’s payment APIs for merchants), not software deployed internally by WorldPay. These cited sources do not support the claimed internal deployment of Verint by WorldPay. The claim is discarded.
No public evidence identified of Israeli-origin predictive analytics or operational monitoring tools deployed by WorldPay, whether through direct procurement or through managed-services bundles. Source classes checked include corporate press releases, technology partner pages, trade press, and NGO reports.
WorldPay and Global Payments have publicly referenced cloud migration and modernisation as strategic priorities in trade press and investor communications, consistent with training-data knowledge. The DevOps job posting from Rehovot7 references monitoring across AWS, GCP, and Azure environments, indicating a multi-cloud architecture at the Global Payments group level. This is consistent with the operational profile of a global payment processor of this scale.
Global Payments’ use of major public cloud platforms including AWS is broadly consistent with public statements; no specific AWS blog case study naming WorldPay or Global Payments has been independently confirmed in training-data knowledge as a featured primary-source customer profile.
Global Payments job postings for Rehovot, Israel — including roles for a QA Team Lead,5 Senior Data & BI Engineer,6 and DevOps Engineer/Team Lead7 — confirm an engineering and technology office in Rehovot as of 2025–2026. The BI Engineer role references BigQuery integration and data architecture work. The DevOps role references cloud security tooling including Wiz. These postings are primary-source corporate disclosures and are treated as verified evidence of an operational technology presence in Israel.
The Rehovot office appears to function as an R&D and engineering centre rather than as a customer-data data centre. No public evidence identifies WorldPay or Global Payments as operating, leasing, or co-locating data centre infrastructure within Israel for the purpose of customer data residency. Headcount figures for the Israel office are not publicly disclosed.
Project Nimbus is a real and extensively documented $1.22 billion cloud services contract awarded to Google Cloud and Amazon Web Services by the Israeli government and military (signed 2021, operational from 2022 onward). The contract’s terms — including provisions described as allowing the Israeli government to sidestep legal orders — have been the subject of investigative reporting by +972 Magazine,19 The Guardian,20 and the Business and Human Rights Resource Centre.21
No public evidence identifies WorldPay or Global Payments as a participant, sub-contractor, vendor, or beneficiary in Project Nimbus. Prior research explicitly acknowledges the absence of direct contractual evidence and instead advances a “shared infrastructure” proximity argument: that WorldPay’s use of the same AWS or GCP infrastructure used by Project Nimbus contractors constitutes a form of adjacency. Using general-purpose public cloud infrastructure operated by the same vendors that hold a separate government contract does not constitute participation in, or benefit from, that government contract. WorldPay’s Project Nimbus involvement: No public evidence identified.
No public evidence identified of WorldPay or Global Payments providing data sovereignty, cloud resilience, or infrastructure services to any Israeli government body, state-owned entity, or defence institution.
No public evidence identified of any contract, partnership, service agreement, or tendering relationship between WorldPay or Global Payments and the Israeli Ministry of Defence, the Israel Defense Forces, Shin Bet, Mossad, or any other Israeli intelligence or military agency. Source classes reviewed include corporate SEC filings,34 corporate press release indices,35 defence procurement registers, and trade press.
No public evidence identified of WorldPay’s commercially available payment processing or data management technology being documented as deployed for military, intelligence, law enforcement surveillance, or crowd-control applications within Israel or in the occupied Palestinian territories. WorldPay’s core business — card acquiring, payment gateway services, and merchant payment processing — does not fall into conventional dual-use technology classifications.
No public evidence identified. WorldPay and Global Payments are commercial payment processing companies. No public reporting in training-data knowledge associates either entity with offensive cyber capability development, cyber-weapons procurement, or any technology with weapons-system applications.
No public evidence identified of WorldPay or Global Payments providing AI models, algorithmic tools, training datasets, or inference infrastructure to Israeli government or military entities.
No public evidence identified of WorldPay AI or machine learning models trained on Israeli civilian population data, military-derived datasets, intercepted communications, or surveillance-generated data sources.
No public evidence identified. Not applicable to WorldPay’s core business domain. Payment processing technology does not intersect with weapons systems, autonomous lethal platforms, or target-acquisition systems in any publicly documented configuration involving WorldPay.
WorldPay’s partnership with Trulioo for “agentic commerce” trust and identity verification infrastructure is publicly documented in a WorldPay corporate press release.15 Trulioo is a Canadian-founded identity verification company (HQ Vancouver, BC). Trulioo is not an Israeli-origin company. The initiative does not involve Israeli AI vendors in any publicly confirmed configuration.
Cymulate is a verified Israeli company (est. 2016, Rishon LeZion, Israel) specialising in breach-and-attack simulation and continuous security validation. Its PCI DSS compliance blog post29 discusses how Cymulate’s platform can support PCI compliance in the payments industry and cites the 2012 Global Payments data breach25 as a historical example. This blog post uses “Global Payments” as a reference to a historical breach incident in the payments sector — it does not name Global Payments Inc. or WorldPay as a Cymulate customer. The cited source does not support the claim that WorldPay uses Cymulate; the claim is discarded.
ThetaRay is a verified Israeli company specialising in AI-powered AML analytics for cross-border and SWIFT payments.33 A ThetaRay blog post discusses its strategy with Spayce, a cross-border payments platform,32 in the context of improving trust in “global payments” — a generic industry term used throughout the post. “Global Payments” in that source is general industry terminology, not a reference to Global Payments Inc. (GPN). No primary source confirms a direct contractual or integration relationship between WorldPay, Global Payments Inc., and ThetaRay.
Global Payments maintains a verified engineering and technology office in Rehovot, Israel, evidenced by primary-source job postings on the Global Payments corporate careers site. Confirmed roles include:
These postings constitute primary-source corporate disclosures of operational R&D and engineering activity in Israel. Scale cannot be precisely quantified from public data; the postings are consistent with a small-to-medium engineering centre embedded within Global Payments’ broader global technology organisation. No headcount figures are publicly disclosed.
The claim that Global Payments’ Israel recruitment pipeline “draws directly from IDF technology units (Talpiot, 8200, Mamram)” is an inferential assertion about hiring practices with no documented corporate policy basis in publicly available records. This claim is unverified.
A “Project Future” programme name, referenced in prior research, does not appear in any independently verifiable WorldPay or Global Payments public communication in training-data knowledge. This programme name is unverified; it may be an internal designation not publicly disclosed or an error in prior research.
Global Payments acquired Como, an Israeli customer engagement and loyalty SaaS platform (HQ Tel Aviv), as part of its international expansion strategy. Como’s Israeli origin and operational history are documented across corporate data sources.8 Como’s prior acquisition of Keeprz, another Israeli company, for approximately $50 million is documented in Israeli financial press.9
Como’s ongoing operational status within the Global Payments group as of 2026 is consistent with training-data knowledge. Whether Como’s loyalty and engagement engine is integrated into WorldPay-branded products — as distinct from other Global Payments product lines such as its restaurant or hospitality verticals — is not established in primary sources. Como is a verified Israeli-origin Global Payments group asset; its specific integration into WorldPay-branded products is unconfirmed.
Prior research describes Como as “formerly ConduIT Mobile.” This former-name attribution is not independently confirmed in training-data knowledge and may reflect conflation of separate entities. Unverified.
Rapyd is a verified Israeli fintech company that has raised substantial capital (including a $300M round documented in Israeli financial press43) and operates a global payments infrastructure. Airwallex has secured a payment services licence in Israel, enabling it to offer global payment solutions in the Israeli market.42 Neither Rapyd nor Airwallex is a WorldPay subsidiary, partner, or vendor in any confirmed primary-source relationship. These entities are noted here as context for the Israeli payments technology ecosystem within which Global Payments operates as an acquirer and processor, not as direct WorldPay relationships.
The Bank of Israel’s Payment and Settlement Systems Department40 is the relevant regulatory body for payment services licensed in Israel. No WorldPay or Global Payments regulatory filing, licence application, or enforcement action in Israel has been identified in training-data knowledge.
No public evidence identified of patent co-development, joint research agreements, or IP licensing between WorldPay or Global Payments and Israeli research institutions including the Technion, Hebrew University of Jerusalem, or the Weizmann Institute of Science.
No NGO investigation, academic study, UN Special Rapporteur report, or civil society audit specifically addressing WorldPay’s technology relationships with the Israeli state, or the operational implications of its Israel-based engineering centre, has been identified in training-data knowledge. The extensive investigative reporting on Project Nimbus192021 names Google and Amazon as the contracting parties; WorldPay is not mentioned in any of that reporting.
No public evidence identified of an organised BDS campaign, shareholder divestment campaign, trade union motion, or civil society boycott action specifically targeting WorldPay or Global Payments on grounds relating to Israeli technology provision, occupation-related activities, or data infrastructure in the occupied Palestinian territories. Source classes reviewed: BDS Movement official communications (training-data knowledge), Who Profits database (training-data knowledge — no WorldPay entry identified), Stop the Wall, and corporate campaign press releases.
No public evidence identified of regulatory inquiries, legal challenges, export control proceedings, or sanctions-related investigations involving WorldPay’s or Global Payments’ technology relationships with Israeli state entities or operations in the occupied territories.
The 2012 Global Payments data breach — in which payment card data was compromised at a cost of approximately $85 million in remediation and fines25 — is a real and documented historical incident. It is a pre-2020 event and is entirely unrelated to Israeli technology vendor relationships or the subject matter of this audit.
WorldPay’s SEC-registered parent, Global Payments Inc., files annual 10-K reports with the SEC.34 No material risk factor, legal proceeding disclosure, or government investigation notice relating to Israeli technology relationships has been identified in publicly available 10-K extracts in training-data knowledge.
https://www.prnewswire.com/news-releases/gtcr-completes-sale-of-worldpay-to-global-payments-302658108.html ↩
https://investors.globalpayments.com/news-events/press-releases/detail/498/global-payments-completes-acquisition-of-worldpay-and ↩↩
https://www.prnewswire.com/news-releases/gtcr-announces-sale-of-worldpay-to-global-payments-for-24-25-billion-in-conjunction-with-transformative-three-way-transaction-302431416.html ↩
https://www.globalpayments.com/-/media/project/global-payments/corporate/corporate/uk/gdpr/ireland/ireland-sub-processor-list-june-2023-1.pdf ↩↩
https://jobs.globalpayments.com/en/jobs/r0067813/qa-team-lead/ ↩↩
https://jobs.globalpayments.com/en/jobs/r0066381/senior-data-bi-engineer/ ↩↩
https://jobs.globalpayments.com/en/jobs/r0066734/devops-engineer-and-team-lead/ ↩↩↩↩
https://leadiq.com/c/como-acquired-by-global-payments-gpnnyse/5a1d98ac23000054008751f5 ↩
https://en.globes.co.il/en/article-como-acquiring-israeli-co-keeprz-for-50m-1001053650 ↩
https://www.biocatch.com/press-release/biocatch-closes-on-145-million-investment-led-by-bain-capital-tech-opportunities ↩
https://retailtechinnovationhub.com/home/2024/1/18/retail-technology-innovation-of-the-week-netto-enlists-trigo-for-landmark-autonomous-store ↩
https://etailuk.wbresearch.com/blog/tesco-trigo-taking-amazon ↩
https://retailtechinnovationhub.com/home/2024/10/1/lots-of-fun-but-extremely-expensive-aldi-shutters-trigo-powered-shop-and-go-store-in-dutch-city-of-utrecht ↩
https://www.sap.com/products/erp/partners/trigo-vision-ltd-easyout.html ↩
https://corporate.worldpay.com/news-releases/news-release-details/worldpay-and-trulioo-collaborate-embed-trust-agentic-commerce ↩
https://www.worldpay.com/en/industries/retail ↩
https://fintech.global/2024/02/16/nice-actimize-revolutionizes-financial-crime-fighting-with-new-generative-ai-solutions/ ↩↩
https://www.niceactimize.com/press-releases/nice-actimize-to-acquire-guardian-analytics-expanding-ai-cloud-solutions-for-financial-crime-risk-management-across-all-market-segments-323 ↩
https://www.972mag.com/project-nimbus-contract-google-amazon-israel/ ↩↩
https://www.theguardian.com/us-news/2025/oct/29/google-amazon-israel-contract-secret-code ↩↩
https://www.business-humanrights.org/es/%C3%BAltimas-noticias/israelopt-google-amazon-agreed-to-stringent-unorthodox-controls-in-project-nimbus-contract-with-israeli-govt-sidestepping-legal-orders/ ↩↩
https://www.proofpoint.com/us/newsroom/press-releases/proofpoint-joins-wiz-integration-network-win-strengthen-cloud-data-security ↩
https://retailtechinnovationhub.com/home/2023/12/22/starring-trigo-freedompay-and-greyorange-the-biggest-retail-technology-news-stories-of-the-week ↩↩
https://fintech.global/2022/10/27/trigo-nets-100m-to-transform-retail-payments/ ↩
https://www.securityweek.com/global-payments-data-breach-cost-nearly-85-million/ ↩↩
https://docs.worldpay.com/apis/ips3120/security-and-p2pe ↩
https://www.bluefin.com/partners/worldpay/ ↩
https://www.govinfosecurity.com/whitepapers/cyberark-blueprint-for-privileged-access-management-rapid-risk-w-6742 ↩
https://cymulate.com/blog/pci-compliance-cymulate-powerful-combination-keep-payment-data-safe/ ↩
https://www.spanglobalservices.com/technology-lists/checkpoint-users-list ↩
https://www.peerspot.com/products/comparisons/sentinelone-singularity-complete_vs_sysdig-secure ↩
https://thetaray.com/trust-transparency-and-transactions-the-ai-first-strategy-behind-thetaray-and-spayces-global-payments-push/ ↩
https://www.digitaltransactions.net/thetaray-introduces-an-anti-money-laundering-tool-for-cross-border-payments/ ↩
https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001123360&type=10-K&dateb=&owner=include&count=40 ↩↩↩
https://www.youtube.com/watch?v=AWvHLbAYfnw ↩
https://www.papayaglobal.com/case-studies/sentinelone/ ↩
https://securitybrief.com.au/story/fuse-partners-with-check-point-for-real-time-blockchain-firewall ↩
https://www.accc.gov.au/system/files/public-registers/documents/65.%20Worldpay%20from%20FIS%2C%20The%20Global%20Payments%20Report%202021%20-%20Rebuilding%20Payments%20For%20A%20Smarter%20World.pdf ↩
https://www.boi.org.il/en/communication-and-publications/press-releases/mr-oded-salomy-head-of-the-bank-of-israel-payment-and-settlement-systems-department-will-be-completing-his-four-year-term-in-may-2025/ ↩
https://www.airwallex.com/newsroom/airwallex-secures-payment-service-license-in-israel-enabling-global-payment-solutions ↩
https://www.jpost.com/israel-news/israeli-fintech-company-rapyd-raises-300-million-655305 ↩
https://www.getapp.com/customer-management-software/appointments-scheduling/w/worldpay/ ↩
