Very DIGITAL

Scope note: this audit covers The Very Group, the UK online retailer and financial-services group behind Very, Littlewoods.com, Very Exclusive and Very Ireland, plus its controlling owners and named vendors. Research date is 3 November 2026. Findings are limited to what the pages cited in End Notes support, and no scores or conclusions are assigned.

Enterprise Technology Stack & Vendor Relationships

Ownership and controlling principals (context for group attribution). The Barclay family acquired Littlewoods in November 2002 and the Littlewoods and Shop Direct businesses merged in 2005 [pre-2020]; that ownership has since ended ¹. In February 2024 The Very Group took a GBP 125m loan from Carlyle (about GBP 85m) and International Media Investments (IMI), the Abu Dhabi investment firm (GBP 40m), and under the funding agreement each was to take a seat on the group’s board ². Carlyle took over the group, with the purchase described as completed on 10 November 2025, and IMI remains a key stakeholder ^{3, 1, 4}.

Systems integrator and managed-services partner: Kyndryl. On 19 September 2023 Kyndryl announced an expanded partnership with The Very Group to migrate applications and infrastructure to a multi-platform public cloud, take on application support, and combine Very’s service-management toolset with cloud-native tooling, Kyndryl Bridge and AIOps ^{5, 6}. The release says Kyndryl was chosen for its managed-services position, its history as an incumbent strategic partner and a partner ecosystem that includes Microsoft, Skytap, L3C and FPT Software ⁶. The release does not say which cloud platforms Very’s workloads will run on ⁵. On 28 February 2025 a trade report described a new multi-year agreement under which Kyndryl provides software and platform engineering support ⁷. The Very Group’s CIO Matt Grest is quoted in 2023 as welcoming the extension ⁸.

Act record: Kyndryl relationship. Acting entity: “The Very Group” as named in the release; the exact legal entity is not stated in the sources opened. Recipient: Kyndryl, with the named subcontractor ecosystem above. Channel: Kyndryl’s own press-release pages, republished by a trade site. Earliest dated observation: 19 September 2023, when the relationship is already described as incumbent; the start date is not established. Latest dated observation: 28 February 2025. Status at the research date: continuing as of the latest observation, with no exit found; status after February 2025 is unknown ^{5, 8, 7}.

Commerce platform: commercetools. On 2 March 2022 The Very Group announced it was modernising its technology stack with commercetools towards a microservices-based, API-first, cloud-native, headless architecture, migrating each stage of the customer journey in phases ⁹. The page does not state commercetools’ country of origin or any Israeli link ⁹.

Cloud and machine learning: AWS. In a release republished in November 2023 (the page is undated; its URL suggests 27 November 2023) The Very Group announced an expanded collaboration with AWS, including a Gen AI Innovation Lab using Amazon Bedrock, and said it already uses Amazon SageMaker ^{10, 11}. Amazon Web Services is one of the two companies awarded Israel’s Project Nimbus cloud contract in April 2021 (see the Cloud section); the sources do not connect Very’s AWS use to Nimbus services ^{10, 12}. Status after November 2023: unknown from the sources opened ¹⁰.

Israeli-origin vendors. No public evidence identified that the group licenses or integrates Check Point, Wiz, SentinelOne, CyberArk, Nice, Verint, Claroty or Palo Alto Networks products; the vendors the opened sources do disclose are Kyndryl, Microsoft, Skytap, L3C, FPT Software, commercetools and AWS ^{5, 9, 10}. No public evidence identified that Kyndryl, L3C, FPT Software or commercetools mandated or deployed Israeli-origin technology in Very’s programmes ^{5, 9}.

Kyndryl’s Israeli operations (vendor-side fact, not a Very relationship). On 2 December 2022 Kyndryl announced a partnership between Kyndryl Israel and CloudWize to bring cloud security and compliance to more businesses in Israel ¹³. The source does not connect that partnership to The Very Group ¹³.

Data-exposure principle. The group’s disclosed activities include online retail for about 4.4 million customers and Very Pay, a payments product regulated by the Financial Conduct Authority ⁶. No public evidence identified of where customer, payment or identity data is stored, routed or processed, or that any part of that pipeline touches Israeli jurisdiction or Israeli-controlled infrastructure ⁶.

Named-entity record (each name searched separately).

• The Very Group (target): searched against Israel, Israeli-origin vendors, government cloud, defence and boycott topics; no Israel-linked finding other than the vendor-side facts above ^{5, 1}.
• Carlyle (controlling owner since November 2025): searched for Israel, cyber and defence investments; the portion of its Wikipedia article read describes no Israeli holdings and mentions the 2022 agreement to acquire ManTech, a US government cybersecurity and IT contractor, and historical US defence investments ⁴.
• International Media Investments, IMI (lender and key stakeholder): searched for Israel, cyber and defence investments; searched, none found in the sources opened ².
• Barclay family (former owners to 2025): searched for Israel, cyber and defence investments; searched, none found in the sources opened ¹.
• Nadhim Zahawi (non-executive Chair from May 2024): the portion of his Wikipedia article read lists no Israel-related ties or Israeli technology directorships ¹⁴.
• Robbie Feather (Group CEO, retained under Carlyle): searched with Israel; searched, none found ³.
• Kyndryl: has an Israeli operation, Kyndryl Israel, per the CloudWize announcement; no MoD or IDF contract identified ¹³.
• Microsoft, Skytap, L3C and FPT Software (Kyndryl ecosystem partners): the release names them, and Skytap, L3C and FPT Software were not separately cleared on Israel topics beyond a joint search that found no link ⁶.

Surveillance, Biometrics & Retail Technology

Facial recognition and biometrics. No public evidence identified of the group using Trigo, BriefCam, AnyVision/Oosto, Trax or comparable Israeli-origin vendors; the technology programmes the sources describe concern cloud migration, headless commerce and generative AI for online retail ^{5, 9, 10}.

Predictive analytics and monitoring. No public evidence identified of Israeli-origin predictive policing, sentiment analysis, social-media monitoring or workforce-surveillance tools at the group; the generative-AI lab announced in 2023 is described as aimed at online shopping, product descriptions and imagery, and internal decisions ¹⁰.

Third-party deployment. No public evidence identified that Israeli-origin surveillance or biometric technology reaches the group through Kyndryl, its partners or bundled suites ⁵.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data centres in Israel. No public evidence identified that the group operates, leases or co-locates data-centre infrastructure in Israel; its disclosed cloud work is a migration of applications to a multi-platform public cloud with Kyndryl ⁵.

Government cloud contracts. No public evidence identified of the group participating in Project Nimbus or any comparable government cloud programme. The contract was announced on 21 April 2021, awarded to Amazon Web Services and Google at an initial value of NIS 4 billion (about USD 1.2 billion) for Israel’s government, defence system and other bodies, with Microsoft, Oracle and IBM named as losing bidders ¹². The Wikipedia entry on Project Nimbus names Google and Amazon as the contracted companies and does not mention Carlyle, The Very Group, Kyndryl or Skytap in the portion read ¹⁵.

Reported Nimbus contract terms (context on a vendor, not on the target). The Guardian, with +972 Magazine and Local Call, reported on 29 October 2025 from leaked Finance Ministry documents that Google and Amazon agreed not to restrict Israel’s use of their services, and that a payment-based “winking mechanism” would signal foreign court orders for Israeli data; both companies denied wrongdoing ^{16, 17}. A Globes republication of the report states that Israel’s Finance Ministry called the claims baseless ¹⁷. These are allegations by the publishers and are not findings about The Very Group ¹⁶.

Microsoft (a Kyndryl ecosystem partner named in the release). On 25 September 2025 Microsoft President Brad Smith announced that Microsoft had disabled some Azure storage and AI services used by one Israeli Ministry of Defence unit after a review that “supports elements of the Guardian’s reporting”; the activist group No Azure for Apartheid said most of the contract remained in place ¹⁸. Ynetnews reported that Microsoft maintained a broader commercial relationship with the IDF and that the stored data was reported to be moving to Amazon Web Services, which the IDF did not comment on ¹⁹. The sources do not establish that The Very Group uses Azure or any service affected by this action ^{6, 18}.

Constructive notice (post-19 July 2024 and post-November 2024). The group’s Kyndryl multi-year agreement was reported on 28 February 2025, after both dates; no public evidence identified that it involves Israeli state bodies or any Israeli-origin technology ⁷.

Data sovereignty and resilience services. No public evidence identified that the group provides data-residency, sovereignty or resilience services to Israeli state institutions or military bodies; it is a consumer retailer and payments provider ⁶.

Defence, Intelligence & Security Sector Technology Relationships

Military and intelligence contracts. No public evidence identified of any contract, partnership or service agreement between the group, Carlyle’s holding of it, or IMI and the Israeli Ministry of Defence, IDF or intelligence agencies, in the sources reviewed; the ownership and vendor facts are set out above ^{3, 1, 2}.

Dual-use technology provision. No public evidence identified that technology sold by the group has been deployed for military, intelligence or law-enforcement surveillance in Israel or the occupied territories; its disclosed technology is used internally for online retail ^{5, 9}.

Offensive cyber and weapons technology. No public evidence identified of any development, sale, licensing or maintenance of offensive cyber tools by the group. Carlyle’s Wikipedia entry describes the 2022 ManTech agreement and past defence investments in the US, with no Israeli holding mentioned in the portion read ⁴.

AI, Algorithmic & Autonomous Systems

AI/ML provision to state bodies. No public evidence identified of the group providing AI, machine-learning, computer-vision or decision-support systems to Israeli state, military or security bodies; the group is a consumer of AI services, including Amazon SageMaker and a generative-AI lab with AWS ^{10, 11}.

Training data and model development. No public evidence identified that any model or platform of the group was trained on, or given access to, population data, intercepted communications or surveillance datasets from Israel or the occupied territories ¹⁰.

Autonomous systems and lethality. No public evidence identified of the group providing autonomous target generation, automated threat detection or tracking systems to Israeli forces ¹⁰.

Technology Ecosystem & R&D Footprint

Israeli R&D centres. No public evidence identified of any research and development facility, engineering office, innovation lab or accelerator operated by the group in Israel; the innovation lab disclosed is a Gen AI Innovation Lab with AWS specialists ¹⁰.

Acquisitions and investments. No public evidence identified of the group acquiring Israeli technology companies or investing in Israeli startups or funds. Its technology-related corporate acts in the sources reviewed are vendor engagements and the 2024 financing and 2025 change of control ^{1, 2}.

Patents and IP. No public evidence identified of patent portfolios, licences or co-development arrangements between the group and Israeli entities or institutions such as Technion, Hebrew University or Weizmann Institute ¹.

Civil Society Scrutiny & Regulatory History

NGO and academic reports. The landing page of the Who Profits corporate database lists companies linked to the Israeli occupation and showed no entry for the group, Carlyle or Kyndryl on its first page of 20 entries (A to Agrotop, page 1 of 24); the database search was not run, so this does not establish absence ²⁰. The landing page of the AFSC Investigate database (288 companies) names Chevron, Palantir, Microsoft, NVIDIA and Logitech as highlights and does not name the group, Carlyle or Kyndryl on that page; its company search was not run, so this does not establish absence ²¹. Microsoft and Amazon, vendors of the group or members of Kyndryl’s ecosystem, are subjects of the reporting summarised above ^{18, 16}.

UN reports and the OHCHR database. No public evidence identified in the pages that could be read of the group or its owners being named in A/HRC/59/23 or in the OHCHR settlement database; the primary texts could not be read in full, so this is not a negative finding ^{20, 21}.

Boycott and divestment campaigns. No public evidence identified of an organised boycott, divestment or sanctions campaign against the group relating to technology provision ¹.

Regulatory and legal actions. No public evidence identified of regulatory inquiries, legal challenges, export-control actions or sanctions investigations involving the group’s technology sales or services to Israeli state entities; the group’s reported regulatory context is FCA regulation of Very Pay ⁶.

Act record: ownership and board changes (corporate acts). February 2024: Carlyle and IMI lent GBP 125m to the Barclay-owned group, with a board seat each (channel: Enterprise AM, a UAE business publication, quoting the retailer) ². Earliest observation 28 February 2024; Carlyle control completed 10 November 2025 per Wikipedia (channel: Wikipedia) and reported by FashionUnited without a date; status: continuing as of November 2025, with later status unknown ^{3, 1, 2}.