V-DIG Audit: Asda

Audit Phase: V-DIG Audit Target Company: Asda Stores Ltd. Date: 2025

Enterprise Technology Stack & Vendor Relationships

Microsoft Azure serves as Asda’s primary cloud platform under the “Project Future” initiative, described as one of the UK’s largest retail technology deals and covering approximately 1,200 stores ¹². Tata Consultancy Services operates as Asda’s IT and digital transformation partner under a multi-year engagement valued at approximately £189 million ³. ServiceNow expanded its collaboration with Asda in October 2024 to deliver employee and customer workflow automation across operations ⁴. SailPoint provides identity security services to Asda, having implemented its Identity Security Cloud platform in 2024 ⁵. Deliverect partners with Asda for Express delivery management across delivery marketplaces ⁶.

Asda partnered with Wayve for autonomous delivery trials operational at the Park Royal store from 2021 to 2023 ⁷. Wayve AI Technologies Israel Ltd. was incorporated in Herzliya, Israel in June 2024 ⁸. Wayve’s investor base includes Eclipse Ventures, Balderton, SoftBank, Microsoft, NVIDIA, AMD, Qualcomm, Sir Richard Branson, and Yann LeCun ⁹. No documented evidence has been identified that the Israeli subsidiary was operational during the Asda trial period or that Israeli infrastructure processed Asda delivery data.

Bringg (Israeli-origin last-mile delivery platform). In May 2022 Asda selected Bringg — an Israeli (Tel Aviv-headquartered) omnichannel and last-mile delivery orchestration platform — alongside Blue Yonder to modernise its order-management and home-delivery/click-and-collect operations; the relationship is corroborated across multiple independent trade-press sources ¹⁰¹¹. As an Israeli-jurisdiction company processing Asda’s UK consumer delivery data (order details, address data, routing events), Bringg constitutes a confirmed Israeli-origin technology dependency with a data-exposure dimension — a genuine V-DIG procurement nexus (civilian commercial software, not surveillance/military). Currency caveat: Asda’s May 2026 Ocado Group partnership for online grocery ¹²¹³¹⁴ may be displacing the Blue Yonder/Bringg stack; the live status of the Bringg relationship as of 2026 is not confirmed and should be re-checked. (Distinct from the out-of-scope domestic FaiceTech facial-recognition deployment, which has no Israel nexus.)

No public evidence identified of Asda holding direct licensing, subscription, or integration relationships with Check Point, Wiz, SentinelOne, CyberArk, Nice, Verint, Claroty, or Palo Alto Networks ³. No public evidence identified of Asda’s enterprise technology stack including any of these vendors.

Israeli-Origin Technology Dependencies & Data-Exposure Vectors

The vendor-by-vendor negatives recorded above address direct first-party licensing relationships. This section records the Israeli-origin relationships that do exist in Asda’s digital and fulfilment supply chain, distinguishing one confirmed deployment (Bringg) from three structurally plausible but first-party-unconfirmed dependencies (Trax Retail, Quicklizard, and SentinelOne via Cyderes), and assesses the current status of the confirmed deployment in light of Asda’s May 2026 Ocado Group partnership.

Bringg — confirmed Israeli last-mile delivery platform (data-exposure vector)

In May 2022, Asda selected Bringg as its last-mile delivery and omnichannel fulfilment partner, deployed alongside Blue Yonder’s Luminate Commerce order-management platform ^15161718. Bringg is an Israeli company headquartered at 132 Derech Menachem Begin, Tel Aviv, founded in 2013 by Raanan Cohen and Lior Sion, and reached unicorn status (valued at approximately $1 billion) following a 2021 Series E funding round ¹⁹²⁰. Trade-press coverage describes Bringg as adding “a last-mile component to the supply chain, allowing Asda to better serve its customers through support for Asda’s home delivery service, click-and-collect option, as well as new channels such as express commerce platforms” ¹⁵¹⁶.

Bringg’s last-mile orchestration necessarily processes UK consumer delivery data — including delivery addresses, order and contact details, driver assignment, and routing and timing events — for Asda’s home-delivery, click-and-collect, and express-commerce channels ¹⁵¹⁷. As an Israeli-headquartered company, Bringg and its processing infrastructure fall in part under Israeli legal jurisdiction. This constitutes a confirmed data-exposure vector: UK consumer delivery and address data is handled by a company domiciled in, and subject to the laws of, Israel. Whether Bringg contractually guarantees UK/EU-localised data residency for Asda, or whether Asda data may transit Israeli-based processing infrastructure, has not been established in public sources and remains an open question ¹⁹.

Plausible but unconfirmed Israeli-origin dependencies

The following three relationships are documented at the level of trade-press reference or indirect corporate linkage but have not been confirmed by an Asda first-party statement or a counterparty press release naming Asda. Each is recorded as plausible/unconfirmed pending first-party confirmation.

• Trax Retail (shelf analytics) — plausible, unconfirmed. A Path to Purchase Institute publication (September/October 2024) reported that Trax “won the Asda partnership” for in-store shelf analytics ²¹. Trax is a company with Israeli founders and Israeli R&D origins, now domiciled in Singapore ²². The reference postdates the ICJ Advisory Opinion of 19 July 2024. No Asda corporate statement or Trax press release confirming a live deployment — as opposed to a sales-pipeline reference — has been identified ²¹²².

• Quicklizard (dynamic pricing, via Publicis Sapient) — plausible, unconfirmed. Asda appointed Publicis Sapient as its online-grocery transformation partner in February 2023 ²³. Publicis Sapient separately holds a confirmed equity stake in, and board representation at, Quicklizard — a Tel Aviv-headquartered AI dynamic-pricing platform listed on the Tel Aviv Stock Exchange ²⁴. This creates a structural pathway by which Quicklizard could be introduced into Asda’s pricing operations, but no Asda procurement disclosure or TASE material-event filing confirming an Asda–Quicklizard contract has been identified ²³²⁴.

• SentinelOne (endpoint security, via Cyderes MDR) — plausible, unconfirmed. A December 2024 ASDA Technology interview confirmed Cyderes as a managed-security integration partner ²⁵. Cyderes lists SentinelOne — an Israeli-founded endpoint-security company co-founded by Tomer Weingarten and Almog Cohen, with R&D in Tel Aviv — as a primary managed-detection-and-response (MDR) technology partner ²⁶²⁷. Whether SentinelOne tooling is specifically deployed within Asda’s environment (Cyderes also partners with US vendor CrowdStrike) has not been disaggregated in any public source. This does not contradict the first-party negative recorded above: no direct Asda–SentinelOne licensing or subscription relationship is evidenced, and the plausible exposure arises only indirectly through the Cyderes MDR stack ²⁵²⁶.

Temporal / current status: the May 2026 Ocado Group partnership

On 29 May 2026, Asda announced a partnership with Ocado Group under which Ocado’s Smart Platform will be deployed across Asda’s online grocery operation, going live from early 2027 ²⁸¹². The Ocado Smart Platform provides front-end webshop technology, in-store fulfilment and picking systems, and — directly overlapping Bringg’s function — “software to support last mile planning and route efficiency” ¹³. Trade-press coverage characterises the deal as intended to “quickly replace and upgrade Asda’s existing e-commerce infrastructure,” with in-store picking and last-mile delivery addressed in a later phase of the rollout ¹³¹⁴.

Neither Asda’s nor Ocado’s announcements name Blue Yonder or Bringg as the system being displaced, and no public statement confirming termination or wind-down of the Bringg relationship has been identified ²⁸¹³. On the available evidence, the Bringg last-mile deployment — and its associated UK-consumer-data-exposure vector — should be treated as LIVE as of this addendum (June 2026), but on a publicly announced displacement path: Ocado’s Smart Platform is scheduled to assume last-mile route planning and in-store fulfilment from 2027, which would supersede the Blue Yonder/Bringg last-mile layer if the migration proceeds as announced. This distinction is material to scoring — the Bringg exposure is current rather than historical — and any re-score after the 2027 Ocado go-live should re-verify whether Bringg has by then been wound down.

Scope note (domain placement)

• The Bringg deployment is an Israeli-origin digital procurement with a data-exposure dimension and is therefore an in-scope V-DIG finding.
• Asda’s March 2025 FaiceTech live facial-recognition trial (detailed in the Surveillance, Biometrics & Retail Technology section below) is a UK-domestic privacy and data-protection matter. FaiceTech is a UK-incorporated company, and no Israeli founders, investors, R&D operations, or algorithm-licensor chain has been confirmed; the deployment therefore does not constitute Israeli digital complicity and should not be scored as such within V-DIG.
• Asda’s sourcing of settlement-linked produce (e.g. via Mehadrin) is an economic and political supply-chain matter recorded in the V-ECON and V-POL audits; it is not a V-DIG matter and is not assessed here.

Surveillance, Biometrics & Retail Technology

Asda launched live facial recognition technology in five Greater Manchester stores—Ashton, Chadderton, Eastlands, Harpurhey, and Trafford Park—in March 2025 ¹. The system scans customer faces against an internal watchlist of individuals suspected of theft, violence, or fraud ¹. The system is provided by FaiceTech Ltd, a UK-incorporated company with Company No. 13392772, incorporated on 13 May 2021, and active status ²⁹. FaiceTech’s registered address is 292 Hale Road, Hale Barns, Altrincham WA15 8SP ²⁹. Directors listed include David Pain (Operations & Compliance Director), Chris Noden (CTO), and Eli Walters (Business Development) ³⁰.

FaiceTech states on its compliance page: “We own every line of code… We don’t license algorithms from overseas providers or white-label someone else’s technology” ³¹. FaiceTech holds ISO 27001 and Cyber Essentials Plus certifications ²⁹. No independent audit of algorithmic provenance has been publicly identified ³¹.

Big Brother Watch filed a legal complaint with the UK Information Commissioner’s Office in May 2025 alleging Asda’s facial recognition trial is unlawful and infringes data rights ³². Approximately 5,425 consumer emails were sent to Asda as part of the campaign ³². No ICO ruling or enforcement action has been documented as of this memo’s date ³².

Corsight AI, headquartered in Tel Aviv, Israel, developed an AI-powered facial recognition tool for the Israeli military that has been used to surveil Palestinians during the Gaza conflict ³³. Corsight AI is linked to Awz Ventures/Cortica, which operates in partnership with the Israeli Ministry of Defence’s Research & Development Directorate ³³. Corsight AI has been deployed by UK police forces via the intermediary Digital Barriers ³³. No public evidence identified linking Corsight AI directly to Asda or FaiceTech ³³.

No evidence identified of Asda deploying Trigo, BriefCam, AnyVision/Oosto, Trax, or comparable Israeli-origin biometric or retail technology vendors ⁷. Search results indicate Trigo powers Tesco’s GetGo frictionless stores; no Trigo-Asda partnership has been found. No evidence identified of Asda using Israeli-origin predictive policing, sentiment analysis, social media monitoring, or workforce surveillance tools.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Microsoft Azure Israel Central exists as a live Azure region, having launched in 2023 ³⁴. Microsoft holds the Project Nimbus contract with the Israeli government, a $1.2 billion cloud services agreement ³⁵. No public evidence identified that Asda operates, leases, or co-locates data centre infrastructure within Israel.

No public evidence identified that Asda participates directly in Project Nimbus or comparable Israeli state-backed digital infrastructure programmes ³⁵. The Project Nimbus contract is between Microsoft/Amazon and Israeli government entities; Asda’s Azure usage is for UK retail operations ²³⁵. No public evidence identified that Asda provides services explicitly marketed to ensure digital sovereignty, data residency, or infrastructure resilience for Israeli state institutions or military bodies.

Data routing uncertainty exists regarding Asda’s cloud architecture: while Asda’s primary cloud platform is Microsoft Azure UK regions (UK South-London, UK West-Cardiff), no public confirmation has been identified that Asda’s data processing agreements explicitly exclude Microsoft Azure Israel Central from any data transit, backup, or disaster recovery routing ³⁴.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of contracts, partnerships, or service agreements between Asda and the Israeli Ministry of Defence, Israel Defence Forces, intelligence agencies, or other Israeli state security bodies. No public evidence identified of Asda’s commercially available technology being publicly reported, confirmed by official sources, or documented by researchers as being deployed for military, intelligence, or law enforcement applications within Israel or occupied territories. No public evidence identified of Asda developing, selling, licensing, or maintaining offensive cyber capabilities, zero-day exploit tools, or digital weapons systems.

AI, Algorithmic & Autonomous Systems

Asda partnered with Wayve for what was described as the UK’s largest self-driving grocery delivery trial, operational at the Park Royal store from 2021 to 2023 ⁷. Wayve operates Wayve AI Technologies Israel Ltd., incorporated in June 2024 in Herzliya ⁸. No documented evidence identified that this Israeli subsidiary was operational during the Asda trial period or that Israeli infrastructure was used for processing Asda delivery data ⁷⁸. Asda’s expanded ServiceNow partnership (2024) includes workflow automation and AI-assisted processes ⁴. No public evidence of AI systems provided to Israeli state, military, or security bodies ⁴.

No public evidence identified of Asda providing AI/ML, computer vision, or autonomous decision-support systems to Israeli state, military, or security bodies. No public evidence identified of Asda’s AI models being trained on, or provided access to, civilian population data, intercepted communications, or surveillance-derived datasets originating from Israel or occupied territories.

Technology Ecosystem & R&D Footprint

Wayve AI Technologies Israel Ltd. was incorporated in June 2024 in Herzliya ⁸. The purpose of this Israeli entity is not publicly specified and may involve R&D, sales, or engineering support ⁸. No public evidence identified of Asda operating research and development facilities, engineering offices, innovation labs, or accelerator programmes within Israel.

No public evidence identified of Asda acquiring Israeli-origin technology companies. No public evidence identified of Asda making strategic investments in Israeli technology startups or venture funds. No public evidence identified of Asda holding significant patent portfolios, licensing agreements, or co-development arrangements with Israeli-domiciled entities or research institutions such as Technion, Hebrew University, or Weizmann Institute.

Civil Society Scrutiny & Regulatory History

No evidence identified of Asda appearing in the UN OHCHR database of business enterprises involved in Israeli settlement activity under HRC resolutions 31/36 and 53/25 ³⁶. No entry identified for Asda in the Who Profits company database on settlement involvement ³⁷.

Asda has been targeted by BDS campaign activities citing stocking of products described as “Israeli apartheid produce,” including dates, avocados, and similar agricultural goods ³⁸. Consumer announcements were recorded in Asda Manchester stores as part of these campaigns ³⁸. Asda appears in broader BDS movement guidance but has not been specifically identified in available “Don’t Buy Into Occupation” company lists as a technology provider to Israeli settlements ³⁸.

Big Brother Watch filed a legal complaint in May 2025 challenging the lawfulness of Asda’s facial recognition trial under UK data protection law ³². The outcome of this complaint remains pending ³².

The Asda Foundation operates as an independent UK charity (Charity No. 326742) with a history spanning over 30 years, focusing on UK community grants including Local Community Spaces, Young Futures, and Foodbank Fundamentals programmes ³⁹⁴⁰. No settlement-linked recipients have been identified in Asda Foundation grant disbursements ³⁹⁴⁰.

No regulatory inquiries, export control actions, or sanctions-related investigations involving Asda’s technology sales or services to Israeli state entities have been publicly identified.

Ownership Structure & Controlling Principals

TDR Capital holds 67.5% majority ownership of Asda ⁴¹⁴²⁴³. TDR Capital’s portfolio includes EG Group (global forecourt retail), David Lloyd Leisure, Stonegate Pub Company, Constellation Automotive Group, Hurtigruten, Jollyes, Popeyes, NKD, and Acqua & Sapone ⁴⁴. Mohsin Issa holds a 22.5% stake in Asda ⁴¹⁴⁵. Walmart retains a 10% stake in Asda ⁴¹⁴³.

No public evidence identified of TDR Capital, the Issa brothers (Mohsin or Zuber), or Walmart having equity stakes, board roles, or personal investments in Israeli surveillance, cyber, AI, SIGINT, or military-tech firms including NSO, Cellebrite, Carbyne, AnyVision/Oosto, Wiz, Palantir, Check Point, SentinelOne, Verint, Nice, or comparable entities ⁴²⁴⁴⁴⁵.

Asda’s Executive Board for 2024–2025 comprises Allan Leighton (Executive Chairman, appointed November 2024), Gary Lindsay (Managing Partner, TDR Capital), Rob Hattrell (Partner/Head of Digital, TDR Capital), Jo Whitfield (Non-Executive Director, Audit Committee Chair), and John Laney (Walmart representative) ⁴⁶. No defence-industry backgrounds have been publicly identified for current board members ⁴⁶.

End Notes