V-DIG Audit: Burberry Group plc

Audit Phase: V-DIG (Digital Forensics / Technology Supply Chain) Target: Burberry Group plc (LSE: BRBY) Audit Date: 2026-05-01 Methodology Note: All findings are drawn exclusively from the research memo below. Live web retrieval was unavailable during research; all claims reflect training-data knowledge through April 2026. Where primary-source confirmation is absent, findings are explicitly qualified. No scores, tiers, or scoring conclusions are assigned.

Enterprise Technology Stack & Vendor Relationships

Core Digital Engineering & Commerce Platform

Burberry’s publicly documented technology stack is primarily the product of a deliberate MACH-architecture (Microservices, API-first, Cloud-native, Headless) transformation, executed with external engineering partners.

EPAM Systems is publicly confirmed as Burberry’s primary digital engineering partner. Two EPAM-published case studies describe the engagement in material detail: one covering the redesign of Burberry’s e-commerce and digital product architecture toward a cloud-native, microservices model ¹, and a second describing remote delivery methodology during the 2020–2021 period ². EPAM describes itself as having implemented the MACH-aligned front-end architecture for Burberry’s digital estate and holds Google Cloud Premier Partner status ¹. EPAM’s published case study materials do not name specific security, analytics, or optimisation sub-vendors deployed within the Burberry engagement.
Contentstack is confirmed as Burberry’s headless CMS provider, deployed as a component of the MACH architecture transition, per a published Contentstack case study describing the implementation in terms of global scale and editorial speed ³. Contentstack is a US-domiciled company (San Francisco); no Israeli ownership or origin has been identified.
Farfetch was publicly named as a luxury e-commerce partner in a 2018 Burberry press release, covering fulfilment and digital retail integration ⁴. No Israeli-origin technology component of this partnership has been publicly documented.
Amazon Web Services (AWS) is publicly confirmed as Burberry’s primary cloud infrastructure provider. The AWS Partner Network blog and AWS retail technology pages reference Burberry’s SAP workloads running on AWS as part of an “Evergreen SAP” migration programme ⁵⁶, placing core ERP functions — inventory management, supply chain, finance — on AWS infrastructure.
The “Burberry Forward” strategic reset announced in November 2024 reaffirms continued digital investment as a central pillar of the group’s recovery plan ⁷, consistent with the technology commitments described in the 2023/24 Annual Report ⁸ and 2024 Strategic Report ⁹.

Israeli-Origin Software Vendors

CyberArk (Privileged Access Management)

CyberArk is an Israeli-founded cybersecurity company specialising in Privileged Access Management (PAM), headquartered in Newton, Massachusetts, and listed on NASDAQ ¹⁰. It was founded in Israel in 1999 and retains significant R&D operations there.

The strongest available public signal of a Burberry–CyberArk relationship derives from industry event materials: John Meakin, identified as Burberry’s former Group Chief Risk & Security Officer, appears on the speaker list for the CISO360 Congress Barcelona hosted by Pulse Conferences, where CyberArk and privileged account security programme design are referenced in the conference context ¹¹. This confirms Meakin’s professional engagement with PAM architecture in his Burberry role but does not constitute a signed contract or a CyberArk-published customer case study naming Burberry ¹¹.

A secondary staffing signal exists: the Trust in SODA nearshore staffing agency website references placing IAM Operations engineers with CyberArk experience at client engagements ¹². The prior AI document asserted that Burberry is specifically named as a client on this page; that specific claim could not be directly verified against the page text in this research session and should be treated as unconfirmed until the page is reviewed ¹².

Assessment: A CyberArk deployment at Burberry is plausible given the seniority of the CISO-level engagement signal, but is not conclusively evidenced by any primary-source customer case study, annual report disclosure, or confirmed job posting. If confirmed, PAM tooling occupies a critical infrastructure role — governing administrative credential access across the enterprise — and would represent a deeply embedded, non-peripheral deployment. No public quantification of scope (seats, covered systems) has been identified.

Palo Alto Networks

Palo Alto Networks (PANW) is a US-headquartered cybersecurity company incorporated in Delaware with founding roots and R&D operations in Israel ¹³.

The only publicly verifiable connection between Burberry and Palo Alto Networks is that both organisations appear as separate members or supporters of the Unloc Changemaker Alliance, a UK youth employment and social mobility charity ¹⁴. This is a shared philanthropic membership, not a technology procurement relationship.

A G-Cloud 14 service definition document filed by a third-party Managed Service Provider on the UK Government Digital Marketplace ¹⁵ was cited by the prior AI document as evidence of a Burberry–PANW contract. That document is a supplier’s own service catalogue filing; a reference to “Burberry” within a third-party MSP’s asset/configuration item listing does not constitute confirmed evidence that Burberry has procured Palo Alto Networks products directly or through that MSP.

Assessment: No confirmed technology procurement relationship between Burberry and Palo Alto Networks is publicly evidenced. The Unloc co-membership ¹⁴ is the sole verifiable connection, and it is philanthropic, not commercial.

Check Point Software Technologies

No public evidence of a direct licensing, subscription, or integration relationship between Burberry and Check Point Software Technologies has been identified. A Check Point–Wiz strategic partnership press release ¹⁶ cited in the prior AI document contains no reference to Burberry; it documents a Check Point–Wiz commercial arrangement unrelated to Burberry. No public evidence identified.

Other Israeli-Origin Vendors (Wiz, SentinelOne, Verint, Claroty, NICE, AnyVision/Oosto, Trigo, Trax, BriefCam)

No public evidence of licensing, subscription, integration, or procurement relationships between Burberry and any of these vendors has been identified. No corporate disclosure, press release, case study, or credible trade press report naming Burberry as a customer of any of these vendors was located in training data. No public evidence identified for each.

Non-Israeli Vendor Relationships of Note

IntelliQ (loss prevention / exception-based reporting analytics) is publicly listed as a loss prevention provider with Burberry cited as a customer ¹⁷. IntelliQ is headquartered in London, UK, and was subsequently acquired by Agilence, a US company ¹⁸¹⁹. No Israeli-origin component of IntelliQ’s technology stack has been identified.
Capgemini is referenced in the prior AI document in connection with SAP migration and AI demand forecasting at Burberry ²⁰²¹. The cited Capgemini source is a 2014 general digital transformation review that references Burberry illustratively; it does not document a specific Capgemini–Burberry contract for SAP or AI services. Capgemini’s UK operations page does not name Burberry as a client ²¹. Assessment: A Capgemini–Burberry engagement is not confirmed from primary sources available in training data; the cited sources do not establish a direct commercial engagement.

Surveillance, Biometrics & Retail Technology

Facial Recognition & Biometric Systems

“Burberry Kisses” campaign (2013): This Google-partnered marketing campaign used browser-based webcam technology to detect and animate a user’s lip shape for a stylised digital “kiss” sharing feature ²²²³. This was a consumer marketing experience, not a biometric identification or facial recognition system. The campaign involved no biometric enrolment, identity matching, or persistent data capture of facial geometry. No biometric identification system deployed; marketing webcam feature only.

Shenzhen “Social Retail” store / Tencent: Burberry announced a partnership with Tencent to open a “Social Retail” concept store in Shenzhen, China, in 2019, subsequently opened in 2020 ²⁴²⁵. The store integrates with WeChat for customer engagement, gamified loyalty mechanics (“Social Currency”), and interactive product experiences. Published accounts confirm that the store links a customer’s WeChat digital identity to their in-store product interactions via QR codes and the WeChat mini-program ecosystem ²⁴²⁵.

No verified public source confirms that the Shenzhen store deploys facial recognition technology. The Caixin Global article ²⁴ and retail analysis sources ²⁵ describe WeChat-based digital identity linkage and QR-code-mediated interactions; neither confirms biometric facial recognition. Whether Tencent’s broader platform infrastructure includes facial recognition capabilities in other deployments is a separate question from Burberry’s specific store configuration. Assessment: WeChat-linked digital identity tracking confirmed; biometric facial recognition in Burberry’s Shenzhen deployment not confirmed from cited or independent sources.

Israeli-origin retail biometric/surveillance vendors (Trigo, BriefCam, AnyVision/Oosto, Trax): No public evidence of any procurement or deployment relationship between Burberry and these vendors has been identified. No public evidence identified.

RFID & Inventory Intelligence

“Magic Mirrors” / RFID (Regent Street flagship, c. 2012–2014): Burberry deployed RFID-enabled interactive mirrors at its Regent Street flagship store, enabling garments with embedded RFID tags to trigger contextual product video content when brought near the mirror display ²⁶²⁷. This is item-level RFID tracking of products enabling personalised in-store digital experiences. No biometric or person-identification component has been documented for this deployment ²⁷²⁶. Assessment: Product-level RFID confirmed; no biometric component identified.

Burberry is also listed among major retail brands adopting RAIN RFID (UHF RFID for inventory management) in a RAIN Alliance industry report ²⁷, confirming ongoing use of RFID technology in supply chain and inventory contexts.

Predictive Analytics & Workforce Monitoring

Burberry’s annual reports and digital transformation materials reference use of data analytics and AI capabilities for demand forecasting and customer personalisation ⁹²⁸. No specific Israeli-origin analytics, sentiment analysis, social media monitoring, or workforce surveillance vendor has been publicly named in this context. No public evidence identified of Israeli-origin predictive analytics, customer monitoring, or workforce surveillance tool deployment.

Loss Prevention Technology

IntelliQ, the confirmed loss prevention analytics partner ¹⁷¹⁸¹⁹, is UK/US-origin. No Israeli-origin loss prevention technology has been identified in Burberry’s documented estate.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Primary Cloud Infrastructure

Amazon Web Services (AWS) is Burberry’s confirmed primary cloud infrastructure provider, with SAP/ERP workloads running on AWS as part of the “Evergreen SAP” migration documented in AWS partner materials ⁵⁶. This places core enterprise systems — inventory, supply chain, finance — on AWS infrastructure.

Google Cloud Platform (GCP): EPAM’s published case study references GCP capabilities within EPAM’s practice and notes EPAM’s Google Cloud Premier Partner status ¹. The 2013 “Burberry Kisses” campaign was a Google marketing partnership ²³, predating GCP’s current enterprise analytics portfolio. No independently published Google–Burberry enterprise cloud case study has been identified in training data. A GCP relationship for current analytics or AI workloads is plausible given EPAM’s partner status but is not confirmed by any primary Burberry or Google corporate disclosure. Assessment: AWS confirmed as primary cloud host. GCP relationship plausible but not confirmed from primary sources.

Project Nimbus

Project Nimbus is a confirmed Israeli government and Israel Defence Forces cloud contract awarded jointly to Google Cloud and AWS in May 2021, valued at approximately $1.2 billion, requiring both vendors to build dedicated data centre infrastructure within Israel for Israeli state and military workloads ²⁹.

Burberry’s relationship to Project Nimbus is indirect and financial only: as an AWS enterprise customer, Burberry’s cloud expenditure contributes to AWS’s global revenue base, a portion of which funds AWS’s overall capital programme including Project Nimbus obligations. This is a structural feature of any large AWS customer relationship, not a Burberry-specific arrangement.

No public evidence has been identified that Burberry has any direct contractual relationship with Project Nimbus.
No public evidence has been identified that Burberry selects the AWS Israel (Tel Aviv) il-central-1 region for any workloads or has data residency arrangements in Israel.
No public evidence has been identified that Burberry co-locates, operates, or leases data centre infrastructure within Israel.
No public evidence has been identified that Burberry participates in any Israeli government cloud initiative or sovereign cloud programme.
The No Tech for Apartheid campaign ³⁰, which has focused on AWS and Google Cloud workers’ objections to Project Nimbus, has not — in publicly available training data — published any report specifically naming Burberry in connection with Project Nimbus or Israeli state cloud infrastructure.

Data Residency

No public disclosure by Burberry identifies specific data residency configurations for customer data, employee data, or ERP data, beyond the confirmed AWS hosting relationship ⁵⁶⁸. Burberry’s Annual Report and Strategic Report do not specify AWS regional configurations ⁸⁹.

Defence, Intelligence & Security Sector Technology Relationships

Direct Military & Intelligence Sector Contracts

No public evidence of any contract, partnership, memorandum of understanding, or service agreement between Burberry and the Israeli Ministry of Defence, Israel Defence Forces, Israeli intelligence agencies (including Unit 8200, Mossad, Shin Bet), or any Israeli state security body has been identified. Burberry is a luxury fashion and retail company; its publicly documented business activities are entirely in the consumer goods, retail, and brand licensing domain. No public evidence identified.

Dual-Use Technology

No public evidence that any Burberry commercial technology — including its retail analytics, RFID systems, or e-commerce infrastructure — has been reported, confirmed, or documented as deployed for military, intelligence, or law enforcement surveillance purposes within Israel, the occupied West Bank, or Gaza. No public evidence identified.

Offensive Cyber & Weapons Technology

Burberry does not operate in the cybersecurity product development, weapons manufacturing, or offensive technology sector. No public evidence of any such activity exists. No public evidence identified.

Security Vendor Ecosystem — Defence Nexus

To the extent that a CyberArk procurement relationship at Burberry is ultimately confirmed ¹¹¹², it is relevant to note that CyberArk’s PAM technology has broad civilian enterprise adoption globally ¹⁰ and is not specific to Israeli state or military clients. No evidence links any potential Burberry–CyberArk deployment to Israeli defence or intelligence sector infrastructure. No public evidence identified of a defence or intelligence sector nexus via any vendor relationship.

AI, Algorithmic & Autonomous Systems

AI Strategy & Disclosed Deployments

Burberry’s 2024 Strategic Report and Annual Report reference data analytics and AI capabilities as enablers of demand forecasting, personalisation, and operational efficiency ⁹²⁸. The “Burberry Forward” strategy (November 2024) reaffirms digital and AI investment as core to the group’s recovery trajectory ⁷.

Demand Forecasting AI

The prior AI document references a Capgemini-delivered “Naive Advisor” AI demand forecasting tool incorporating image analytics and deep learning as a confirmed Burberry deployment ²⁰²¹. The cited Capgemini source — a 2014 general Digital Transformation Review — uses Burberry as an illustrative example of digital retail ambition; it does not constitute a project deliverable or a specific contract disclosure for any named AI product ²⁰. Capgemini’s UK research library ²¹ does not identify a current Burberry AI engagement. Assessment: Demand forecasting AI use is credible given Burberry’s documented digital investment ⁹, but the specific vendor, technology origin, and programme scope are not confirmed from primary sources available in training data.

AI Provision to State or Security Bodies

No public evidence that Burberry provides AI, machine learning, computer vision, or autonomous decision-support systems to Israeli state bodies, military formations, or security services has been identified. Burberry’s AI activities, to the extent publicly documented, are internally focused on retail demand, personalisation, and brand operations. No public evidence identified.

Training Data Provenance

No public evidence that Burberry’s AI or machine learning systems have been trained on or provided access to population surveillance data, intercepted communications, or datasets derived from Israeli state intelligence collection has been identified. No public evidence identified.

Autonomous & Lethal Systems

Not applicable to Burberry’s business domain. No public evidence identified.

Technology Ecosystem & R&D Footprint

Israeli R&D Facilities & Engineering Offices

No public evidence of Burberry operating research and development facilities, engineering offices, innovation labs, technology accelerators, or incubator partnerships within Israel has been identified. Burberry’s primary technology innovation activities are documented as centred on its London headquarters, with engineering work executed through third-party partners including EPAM ¹². Burberry’s investor relations and corporate strategy materials ⁸⁹²⁸ contain no reference to Israeli R&D or technology office operations. No public evidence identified.

Acquisitions & Strategic Investments in Israeli Technology

No public evidence of Burberry acquiring an Israeli-origin technology company or making strategic investments in Israeli technology startups, Israeli venture funds, or Israeli technology accelerators has been identified. Burberry’s documented acquisition and divestiture activity is confined to the luxury fashion and brand licensing domain. No public evidence identified.

Academic & Research Institution Partnerships

No public evidence of collaboration, joint development, patent co-filing, or research funding relationships between Burberry and Israeli research institutions — including the Technion–Israel Institute of Technology, Hebrew University of Jerusalem, or the Weizmann Institute of Science — has been identified. Burberry’s IP filings are predominantly in trade dress, textile design, and brand protection domains ³¹. No public evidence identified.

Retail Presence in Israel

Burberry opened a flagship retail store in Israel, reported by Ynet News at the time of opening (approximately 2010–2011) ³². The store’s continued operation is referenced in travel and luxury retail directories ³³³⁴. However, these sources do not constitute recent corporate disclosures; Burberry’s investor materials do not provide store-by-store operational detail for individual locations ⁸. The current operational status of the Tel Aviv location cannot be confirmed from an authoritative corporate source in training data.

Civil Society Scrutiny & Regulatory History

NGO & Academic Investigations

No published NGO investigation, academic study, or UN Special Rapporteur report specifically addressing Burberry’s technology relationships with the Israeli state has been identified in training data. Source classes reviewed include: BDS Movement published campaign materials ³⁵, Who Profits Research Centre (training data), Stop the Wall, Amnesty International technology sector reports, and Human Rights Watch corporate accountability investigations. None contain a Burberry-specific technology supply chain investigation. No public evidence identified.

Boycott, Divestment & Sanctions Campaigns

No organised BDS or civil society campaign specifically targeting Burberry’s technology provision to Israeli state entities has been identified ³⁵. Burberry’s retail presence in Israel (documented store in Tel Aviv ³²³³³⁴) may appear in broader BDS retail-sector listings, but no campaign specifically targeting Burberry’s digital supply chain, cloud infrastructure, or software vendor relationships has been documented in training data. No public evidence identified of a technology-specific BDS campaign targeting Burberry.

The No Tech for Apartheid campaign ³⁰ focuses on technology sector workers objecting to AWS and Google Cloud’s Project Nimbus obligations. Its published materials do not, in training data, name Burberry as a target or participant.

Burberry’s Humanitarian Statement

Burberry’s corporate impact pages reference a donation to the British Red Cross in connection with humanitarian appeals related to the Israel-Gaza conflict in late 2023 ³⁶. This is framed in neutral humanitarian terms and does not constitute a corporate position on BDS, technology divestment, or political recognition. No corporate statement by Burberry on technology-related divestment obligations, Israeli procurement policy, or supply chain screening for Israeli-origin vendors has been identified.

Regulatory & Legal Actions

No regulatory inquiries, export control actions, sanctions-related investigations, or legal proceedings involving Burberry’s technology sales, services, or supply chain relationships with Israeli state entities have been identified. Burberry’s documented regulatory and legal history relates to intellectual property enforcement (trademark), supply chain compliance under the UK Modern Slavery Act ³¹, and standard financial and securities regulation. No public evidence identified.

Investor & ESG Pressure

No shareholder resolution, institutional investor letter, or ESG rating agency action specifically concerning Burberry’s Israeli technology relationships or procurement practices has been identified in training data. Burberry’s ESG disclosures ⁹²⁸³⁶ address sustainability, supply chain ethics, and community investment but contain no disclosures specific to Israeli technology vendor screening. No public evidence identified.

Evidence Gaps

The following material gaps were identified during research and limit the conclusiveness of findings in several domains:

CyberArk–Burberry contract confirmation: The CISO360 speaker listing ¹¹ and the Trust in SODA staffing reference ¹² are the only available signals. Neither is a primary-source customer disclosure. Confirmation would require a CyberArk-published Burberry case study, an annual report technology disclosure, or a verified job posting naming CyberArk as a required tool within Burberry’s environment.
AWS regional configuration: Whether Burberry routes any workloads through the AWS il-central-1 (Israel/Tel Aviv) region is not publicly documented ⁵⁶⁸.
GCP as confirmed analytics/AI platform: EPAM’s Google Cloud Premier status ¹ creates a plausible inference; no primary Burberry–Google Cloud case study or corporate disclosure has been identified.
Capgemini–Burberry engagement scope: The available Capgemini citation ²⁰ is a 2014 illustrative reference, not a contract disclosure. Current engagement details, if any, are not publicly documented ²¹.
Shenzhen store biometric configuration: Whether the Tencent/WeChat integration includes facial recognition (as opposed to QR/digital identity linkage) is not confirmed by any primary source reviewed ²⁴²⁵.
Full technology vendor stack: Burberry does not publish a comprehensive technology vendor list. The cybersecurity, analytics, and cloud tooling estate is not fully accessible from public sources.
Integrator sub-vendor selections: EPAM’s specific technology sub-vendor choices within the Burberry engagement — particularly for security, observability, and optimisation microservices — are not publicly documented ¹².
Tel Aviv store current operational status: The most recent authoritative source for the store opening dates to approximately 2010–2011 ³²; travel directory references ³³³⁴ are not corporate disclosures.
NGO digital supply chain investigation: No NGO or academic body has published a technology-supply-chain-specific investigation of Burberry comparable to those produced for technology-sector companies. This is an absence of evidence, not evidence of absence.