Digital Audit - Waitrose

Domain: Digital - Digital / Technology Entity scope: Waitrose & Partners, the UK employee-owned supermarket chain; its JLP parent-level systems, John Lewis department-store sibling technology, and former delivery-platform partner Ocado are documented below and attributed at parent/sibling level except where directly attributable to the Waitrose brand. Compiled: 2026-06-26 Method: Live web search only

Enterprise Technology Stack & Vendor Relationships

Waitrose operates a layered, multi-vendor enterprise technology stack. The primary e-commerce platform (waitrose.com) runs on Amazon Web Services (AWS), a relationship documented in AWS case-study materials from at least 2016. Waitrose migrated its observability stack to Elastic Cloud (a managed service on AWS) in 2018, ingesting over 2 TB of logs and metrics per day.¹²

For in-store point-of-sale and mobile self-scanning, Waitrose’s long-standing vendor is Flooid (formerly PCMS), a Birmingham-headquartered UK company.³ Approximately 40% of all in-store transactions are self-service via Flooid’s ScanPayGo platform.⁴ In February 2026, Waitrose extended its Flooid POS contract for a further five years.⁵ Flooid was subsequently acquired by Glory Global Solutions (Tokyo-listed; Japan-domiciled), and in December 2025 Waitrose separately selected Glory’s CI-100X cash-recycling devices for 285 stores.⁶

Workforce and delivery scheduling uses ORTEC (Netherlands-domiciled) for Waitrose.com’s fleet of over 800 delivery vans across 160+ shops.⁷ For store inventory management, in May 2024 Waitrose selected Trust Retail (retail division of London-based Trust Payments) to replace legacy stock systems.⁸

AI-powered online search and product discovery is provided by Netcore Unbxd (partnership announced January 2024). Netcore Unbxd is incorporated in San Mateo, California (US-domiciled) with significant India-based operations; it is not Israeli-domiciled.⁹¹⁰ Enterprise resource planning at JLP level runs on Oracle (US-domiciled).¹¹ IT infrastructure outsourcing - cloud hosting, networks, end-user compute - is handled at JLP level by Wipro (India-domiciled), extended in August 2024 for a further four years to cover the partnership’s Google Cloud migration.¹² Robotic process automation uses Blue Prism (acquired by SS&C Technologies; US-domiciled).¹³

Domicile summary: AWS (US), Elastic (US/NL-listed), Flooid/Glory (UK/Japan), ORTEC (Netherlands), Trust Retail (UK), Netcore Unbxd (US/India), Oracle (US), Wipro (India), Blue Prism/SS&C (US). No Israeli-domiciled vendor identified in this category.

Surveillance, Biometrics & Retail Technology

CCTV rollout: Waitrose confirmed in 2025 it had deployed in-store CCTV in more than half of its 315+ stores, prioritising high-risk areas (alcohol aisles, fresh-meat counters, self-checkout zones), using visible deterrence - large monitors at entrances displaying shoppers’ live images with a recording warning.¹⁴ A spokesperson confirmed footage is shared with police only on formal request.¹⁴

No facial recognition deployed: Waitrose’s privacy notice states its CCTV does not employ facial recognition or collect biometrics, distinguishing it from competitors such as Sainsbury’s (which trialled Facewatch).¹⁵ No facial-recognition vendor has been identified in connection with Waitrose stores.

Project Pegasus: Waitrose is one of 10–15 retailers (with Tesco, Co-op, Sainsbury’s, Next) that co-funded Project Pegasus (£600,000), a police operation matching CCTV images of suspected shoplifters against a national police database using facial-recognition software.¹⁶ Waitrose’s footage may therefore indirectly feed a police biometric matching system, but Waitrose itself does not operate the matching technology; the operator is a law-enforcement arrangement, not an Israeli-domiciled vendor.

Shopic smart trolley trial (IN-SCOPE FINDING - Israeli-domiciled vendor): In a “very small scale” trial at its Bracknell store, Waitrose deployed AI smart-trolley devices supplied by Shopic, a company founded in 2015 and headquartered at 156 Menachem Begin Road, Tel Aviv-Yafo, Israel - Israeli-registered and Israeli-domiciled.¹⁷¹⁸ Shopic uses computer vision to identify products placed in or removed from trolleys and enables frictionless payment; it maintains a New York office for US operations but its corporate HQ and R&D are in Tel Aviv.¹⁸ The trial was reported in The Grocer and is a single pilot store.¹⁹ This is the only Israeli-domiciled technology vendor identified in this audit. Shopic’s investors include Claridge Israel and IBI Tech Fund.²⁰ No other in-store surveillance, biometrics, or loss-prevention technology company with Israeli domicile has been identified.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Waitrose’s primary public cloud provider is AWS, used since at least 2016; the Elastic Cloud observability/search stack runs as a managed service on AWS.¹ No public documentation specifies which AWS regions Waitrose uses (standard UK e-commerce deployment would be London/eu-west-2); no evidence of data residency outside the UK/EU was found.

At JLP level, the partnership signed a £100m, five-year Google Cloud agreement in August 2023, covering both John Lewis and Waitrose, for infrastructure migration, AI/ML workloads, and analytics, co-delivered by Wipro.²¹¹² The JLP analytics ecosystem uses Snowflake (US-domiciled) as its data warehouse, visualised through Tableau (Salesforce; US), orchestrated by Dataiku (France-domiciled) for MLOps, with 18 production-grade models.²²

No UK sovereign-cloud contract or NCSC-secure-cloud participation specific to Waitrose was found. No Israeli cloud infrastructure, data centre, or sovereign-cloud participation has been identified.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of Waitrose or JLP holding defence contracts, intelligence-sector technology relationships, or partnerships with defence-sector vendors. Waitrose’s participation in Project Pegasus (see Surveillance) is a retail-crime co-funding arrangement with UK police, not a defence or intelligence relationship.¹⁶ IT outsourcing to Wipro, Google Cloud, and AWS involves vendors that separately hold government contracts elsewhere, but no Waitrose-specific defence or intelligence nexus has been identified.

AI, Algorithmic & Autonomous Systems

Demand forecasting (Blue Yonder): In June 2024 Waitrose announced an extended collaboration with Blue Yonder (Scottsdale, Arizona; US-domiciled; formerly Panasonic-owned) for AI-based demand forecasting, analysing signals such as weather, promotions and sporting events.²³ Not Israeli-domiciled.

Online personalisation (Netcore Unbxd): The January 2024 partnership enables AI-driven product discovery on waitrose.com.⁹¹⁰

MLOps at JLP level (Dataiku / Snowflake / Tableau): JLP’s AI platform - encompassing Waitrose operational models - runs on a Dataiku/Snowflake/Tableau stack with 18 productionised models (checkout optimisation, availability forecasting, pricing, labour planning).²²

Smart trolley AI (Shopic): The Bracknell trial uses Shopic’s computer-vision AI to identify trolley contents and enable checkout-free payment, also generating store-level behavioural data (aisle dwell times, shelf interactions).¹⁹ As noted, Shopic is Israeli-domiciled.

Retail media AI (Epsilon): JLP’s offsite retail-media network, which includes Waitrose loyalty data, is powered by Epsilon (Irving, Texas; US-domiciled; Publicis Groupe), targeting loyalty-scheme customers via CTV, online video and display.²⁴

No autonomous-weapons, defence-AI, or Israeli-AI vendor relationship has been identified.

Technology Ecosystem & R&D Footprint

Waitrose has no dedicated external R&D lab disclosed publicly; its internal digital engineering team maintains the waitrose.com platform on a Java/Spring Boot/Kubernetes stack.²⁵ In September 2024 Waitrose launched BrandsNew, a £2m+ supplier-brand innovation programme incorporating the product-discovery platform RangeMe (US-domiciled) and consultancy YF.²⁶ In April 2025 Waitrose joined Polytag’s Ecotrace Programme (UK-domiciled), becoming the first UK supermarket to roll out invisible UV recycling tags at scale on own-label milk.²⁷ The JLP-level Insights Platform (launched with dunnhumby - London-domiciled, Tesco-majority-owned - October 2024) gives Waitrose supplier brands loyalty analytics.²⁸ No Israeli R&D partner, accelerator, or incubator connection has been identified for Waitrose.

Civil Society Scrutiny & Regulatory History

Project Pegasus / biometrics: Waitrose’s co-funding of Project Pegasus was reported by Biometric Update (September 2023) and raised civil-liberties questions about the private/state-surveillance boundary.¹⁶ No ICO enforcement action relating to Waitrose’s Pegasus participation has been identified.

ICO / GDPR: No ICO enforcement notice, fine, or formal regulatory action against Waitrose under UK GDPR or the Data Protection Act 2018 was identified from public ICO records or GDPR enforcement-tracker databases (searched and not found).

Smart trolley data concerns: Press coverage of the Shopic trial (The Grocer, 2025) noted the system generates granular in-store behavioural data usable by Shopic as well as Waitrose.¹⁹ No formal regulatory complaint or civil-society objection to the trial was identified.

Retail media / loyalty data and cookies/consent: No civil-society complaint or ICO action concerning Waitrose’s use of myWaitrose loyalty data for Epsilon-powered targeting, or its cookie/consent management, has been identified.

Activist/social-media claims: Social-media content making general claims about Waitrose and Israel relates to the stocking of Israeli produce (a Economic / Political matter) rather than technology-vendor relationships; such claims are unverified for Digital purposes.²⁹

End Notes