V-DIG Cyber-Intelligence & Technology Supply Chain Audit

Target Company: Hublot SA Parent Group: LVMH Moët Hennessy Louis Vuitton SE Audit Phase: V-DIG — Cyber-Intelligence & Technology Supply Chain Audit Audit Date: 2026-05-01 Corporate Domicile: Nyon, Canton of Vaud, Switzerland Prepared From: Training-data records current to April 2026; no live internet research conducted.

Enterprise Technology Stack & Vendor Relationships

Confirmed Vendor Relationships

Hublot SA’s documented e-commerce infrastructure runs on Salesforce Commerce Cloud ¹, a US-origin platform (Salesforce Inc., San Francisco, CA). This relationship is confirmed as active as of 2022–2023 ²³. In June 2023, LVMH Group formalised a broader strategic partnership with Salesforce encompassing CRM, commerce, and AI tooling across its portfolio of maisons ⁴, under which Hublot’s existing Commerce Cloud deployment sits.

LVMH Group — Hublot’s parent — holds a documented strategic cloud partnership with Google Cloud, announced in May 2021 and deepened in January 2023, spanning multiple LVMH watches and jewellery maisons ⁵⁶. Whether Hublot specifically is covered under the enterprise agreement has not been confirmed at the brand level in any public filing or press release. LVMH also selected Microsoft Azure as a preferred cloud provider in 2019 ⁷, though brand-level attribution to Hublot is likewise unconfirmed. Both Google Cloud and Microsoft are US-origin corporations; neither constitutes an Israeli-origin vendor relationship.

LVMH Group uses SAP for retail and supply chain operations ⁸. SAP is of German origin. No Israeli-origin ERP or supply chain software vendor relationship has been identified in relation to Hublot or its parent group.

LVMH Group also maintains a documented AWS relationship ⁹, further described under Cloud Infrastructure below.

Cybersecurity Vendor Stack

LVMH Group established a Cyber Defense Center (CDC) in 2019 ¹⁰. The CDC’s vendor composition — including any Israeli-origin cybersecurity platform vendors — has not been publicly disclosed. No public corporate filing, press release, procurement record, or credible news report confirms a direct licensing, subscription, or integration relationship between Hublot SA and any of the following specifically named Israeli-origin cybersecurity vendors: Check Point Software, Wiz, SentinelOne, CyberArk, NICE Systems, Verint Systems, Claroty, or Palo Alto Networks ^11121314. Cross-referencing was conducted against LVMH’s 2023 Universal Registration Document (URD) ¹¹, Hublot’s corporate communications ¹⁴, and available vendor customer-list snapshots. No public evidence identified.

Microsoft Azure, deployed at LVMH group level, maintains Israeli R&D facilities and has participated in Israel’s Project Nimbus government cloud contract; however, Microsoft is a US corporation and this does not constitute Israeli-origin vendor use by Hublot. This is noted for completeness only.

Procurement & Systems Integrators

No systems integrator, digital transformation consultancy, or IT outsourcing partner engaged by Hublot has been publicly documented as having deployed Israeli-origin technology as part of any Hublot-specific engagement ¹¹¹⁵¹⁶. LVMH’s Information Systems & Technology Group provides central IS coordination across maisons ¹⁵, but brand-by-brand vendor attribution is not disclosed at that level. No public evidence identified.

Scale of Dependency

Because no primary Israeli-origin software relationship has been verified at the Hublot brand level, the scope of any such integration cannot be characterised. No public evidence identified.

Surveillance, Biometrics & Retail Technology

Facial Recognition & Biometric Systems

No verified deployment by Hublot of facial recognition, biometric identification, behavioural analytics, or gait analysis technology of Israeli origin has been identified. Targeted checks were conducted against known Israeli-origin retail AI and surveillance vendors including Trigo Vision, AnyVision/Oosto, and BriefCam (Canon). No public evidence identified.

Hublot operates approximately 100 standalone boutique retail locations globally as of 2024 ¹⁴. No documented deployment of Israeli-origin loss-prevention technology, frictionless checkout AI, or computer-vision shelf analytics has been identified at any of these locations. No public evidence identified.

Predictive Analytics, Workforce & Social Monitoring

No verified use by Hublot of Israeli-origin predictive analytics, sentiment analysis, social media monitoring, or workforce surveillance tools has been identified. Vendor checks included Verint Systems and NICE Systems, both publicly traded Israeli-origin technology companies with significant retail and enterprise monitoring product lines. No public evidence identified.

Third-Party & Bundled Platform Reach

No evidence has been identified that Israeli-origin surveillance or analytics technology reaches Hublot via third-party platform providers, managed security service providers, or bundled enterprise suites. No public evidence identified.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Israeli Data Centre Operations

No evidence that Hublot operates, leases, or co-locates data centre infrastructure within Israel has been identified. Cross-referenced against Hublot’s corporate website ¹⁴, LVMH’s 2023 URD ¹¹, and LVMH’s 2023 ESG Report ¹⁷. No public evidence identified.

Group-Level Cloud Partnerships

LVMH Group holds commercial enterprise agreements with Google Cloud ⁵⁶, Microsoft Azure ⁷, and AWS ⁹. These are standard commercial enterprise cloud agreements. They are legally and operationally distinct from sovereign cloud programmes or government-directed contracts.

Project Nimbus is a contract between the Israeli government, the Israel Defence Forces, Google Cloud, and Amazon Web Services. LVMH’s group-level relationships with Google Cloud ⁵⁶ and AWS ⁹ are commercial enterprise agreements entered into independently of Project Nimbus. Hublot SA is not named as a party to or beneficiary of Project Nimbus in any public record. No public evidence identified of Hublot’s participation in Israeli government cloud infrastructure.

An unresolved sub-question (see Evidence Gaps) is whether Google Cloud sub-services used by Hublot under the LVMH enterprise agreement route data through Google’s Israeli infrastructure assets or involve Israeli-acquired technologies (e.g., Mandiant, acquired 2022). This cannot be resolved on available public evidence.

Sovereign Cloud & Data Sovereignty Services

Hublot does not provide cloud infrastructure, data sovereignty, or managed hosting services to any third party. Its business is consumer luxury goods manufacture and retail. No public evidence identified — not applicable by business model.

GDPR & Data Governance

LVMH Group maintains a published privacy and data policy governing GDPR compliance across its maisons, including Hublot ¹⁸. No regulatory findings, data protection authority enforcement actions, or cross-border data transfer incidents involving Hublot customer data and Israeli entities have been identified.

Defence, Intelligence & Security Sector Technology Relationships

Military & Intelligence Contracts

No verified contracts, partnerships, service agreements, or memoranda of understanding between Hublot SA and the Israeli Ministry of Defence, the Israel Defence Forces, Shin Bet, Mossad, Unit 8200, or any other Israeli state security body have been identified. No public evidence identified.

Dual-Use Technology & Product Diversion

No instance has been publicly reported, confirmed by official sources, or documented by civil society researchers in which Hublot’s commercially available products or associated technology have been deployed for military, intelligence, or law enforcement surveillance applications within Israel or the Occupied Palestinian Territory. No public evidence identified.

Hublot’s commercially sold “connected” watch products (e.g., the Big Bang e series running Wear OS) are consumer electronics products using standard off-the-shelf chipsets and operating systems. No evidence of any export control classification, dual-use designation, or restricted technology component has been identified in relation to these products. No public evidence identified.

Offensive Cyber Capabilities

Hublot’s core business is mechanical and electronic luxury watchmaking. It does not develop, sell, license, maintain, or provide professional services for offensive cyber tools, zero-day exploit frameworks, interception systems, or digital weapons systems. No public evidence identified — not applicable by business domain.

AI, Algorithmic & Autonomous Systems

AI/ML Provision to State or Security Bodies

Hublot does not provide artificial intelligence, machine learning, computer vision, or autonomous decision-support systems to any governmental, military, or security body. Its documented AI and digital activity is limited to consumer-facing applications: e-commerce recommendation engines (via Salesforce Commerce Cloud ²³⁴), digital product personalisation, and blockchain-based product authentication (discussed under Technology Ecosystem below). No public evidence identified of AI provision to Israeli or any other state or security body.

Training Data, Model Development & Surveillance Datasets

No publicly reported instances of Hublot AI models or platforms being trained on, or provided access to, civilian population data, intercepted communications, or surveillance-derived datasets originating from Israel or the Occupied Palestinian Territory have been identified. No public evidence identified.

Autonomous Systems & Lethal Applications

Not applicable by business domain. Hublot manufactures luxury timepieces and associated consumer wearables. It has no documented autonomous systems programme. No public evidence identified.

Generative AI & LVMH Group Initiatives

LVMH Group has engaged with generative AI tooling at the group level, including through its Salesforce partnership (Einstein AI) ⁴ and Google Cloud partnership (Vertex AI) ⁵⁶. No documentation exists attributing Israeli-origin AI models, large language models, or autonomous decision systems to Hublot’s operational infrastructure. No public evidence identified.

Technology Ecosystem & R&D Footprint

R&D and Manufacturing Base

Hublot’s manufacturing and R&D operations are headquartered in Nyon, Canton of Vaud, Switzerland ¹⁹. Its core R&D is in horology: movement mechanics, proprietary alloy development (notably the MAGIC GOLD composite), carbon fibre case engineering, and ceramic materials science ¹⁴¹⁹. No Israeli R&D facilities, engineering offices, innovation labs, or co-development partnerships with Israeli universities or research institutions (including the Technion, Hebrew University of Jerusalem, or Weizmann Institute of Science) have been identified. No public evidence identified.

Blockchain, NFT & Digital Product Authentication

Hublot has been active in blockchain-based product authentication and NFT initiatives. Key documented relationships include:

• Arianee Protocol: Hublot partnered with Arianee (a French Web3 startup) to issue NFT-based digital product passports for watches, announced 2021 ²⁰. Arianee is a French company; it is not of Israeli origin.
• AURA Blockchain Consortium: LVMH co-founded the AURA consortium with Prada Group and Richemont (Cartier) in April 2021 ²¹, which provides blockchain-based product authentication across luxury brands. Hublot, as an LVMH maison, participates in AURA. The AURA blockchain runs on ConsenSys Quorum (an enterprise Ethereum implementation). No Israeli-origin technology vendors in the AURA technical stack have been publicly identified ²¹. Full vendor attribution for AURA’s backend is not publicly disclosed.
• “Hublot Connects” NFT initiative: Covered in press as a 2022 digital collectibles programme ²². Technology stack details are not publicly disclosed beyond confirmed use of blockchain. No Israeli-origin technology vendor identified.

LVMH Accelerator & Innovation Ecosystem

LVMH operates “La Maison des Startups” accelerator programme ²³. Published cohort partners are primarily French and European technology companies. No Israeli-origin startup participants specifically connected to Hublot’s operations have been identified in available cohort disclosures. No public evidence identified.

Acquisitions & Investment Activity

Hublot SA itself has not made technology company acquisitions. Its corporate history is defined by its 2008 acquisition by LVMH ¹⁴. LVMH Ventures ²⁴, the group’s investment vehicle, has not publicly disclosed investments in Israeli-origin technology startups as of the most recent available records (2023–2024) ²⁵. No Hublot-specific investment vehicle exists. No public evidence identified at the brand level.

Patent Portfolio & IP Relationships

Hublot holds patents concentrated in horology — movement engineering, composite materials, and case construction ¹⁴¹⁹. No significant co-development arrangements, joint patent applications, or technology licensing agreements between Hublot and Israeli-domiciled entities or Israeli academic institutions have been identified. No public evidence identified.

Civil Society Scrutiny & Regulatory History

NGO Documentation & Academic Research

The Who Profits Research Center — an Israeli civil society organisation that maintains a database of companies with documented economic relationships with the Israeli occupation — was checked ²⁶. No entry for Hublot SA was identified in its published database as of available training data. No public evidence identified of inclusion.

No reference to Hublot SA or its technology relationships with Israeli state, military, or security entities appears in published reports by Human Rights Watch, Amnesty International, the UN Office of the High Commissioner for Human Rights, or in peer-reviewed academic literature indexed to available training data. No public evidence identified.

Boycott, Divestment & Sanctions (BDS) Campaigns

The BDS National Committee’s published campaign target lists and industry sector listings were reviewed ²⁷. Hublot SA does not appear as a named target of any organised BDS campaign specifically relating to technology provision or Israel-related commercial activity as of available training data. No public evidence identified.

Contextual note on retail presence: Hublot opened a branded retail boutique in Tel Aviv, Israel, documented in 2015 ²⁸. Retail commercial presence in Israel is a distinct matter from technology supply chain relationships and falls outside the V-DIG domain scope. The current operating status of the Tel Aviv boutique as of 2025–2026 is not confirmed in available records.

Regulatory & Export Control History

No regulatory inquiries, legal challenges, export control enforcement actions, sanctions-related investigations, or customs proceedings involving Hublot’s technology products or services in the context of Israeli state entities have been identified in Swiss, EU, US, UK, or international regulatory records. Switzerland is not a member of the EU but broadly aligns with EU dual-use export control frameworks; no Swiss State Secretariat for Economic Affairs (SECO) enforcement actions involving Hublot have been identified. No public evidence identified.

Data Protection Enforcement

No enforcement actions by the Swiss Federal Data Protection and Information Commissioner (FDPIC), the French CNIL, or any EU supervisory authority specifically naming Hublot in relation to data transfers to Israeli entities or Israeli-origin technology platforms have been identified. No public evidence identified.

Evidence Gaps

The following lines of inquiry remain unresolved from publicly available records and would require active investigation to close:

1. LVMH Cyber Defense Center vendor stack — The specific cybersecurity platforms embedded in LVMH’s CDC (established 2019) ¹⁰ are not publicly disclosed. It is unknown whether Israeli-origin platforms (e.g., Check Point, CyberArk) form part of the group infrastructure applicable to Hublot.

2. Hublot-specific IT procurement — Hublot does not publish brand-level IT procurement data. The LVMH URD ¹¹ aggregates technology commitments at group level without brand-by-brand vendor attribution.

3. Boutique surveillance technology — Hublot’s in-store surveillance, loss-prevention, and POS technology vendors are not publicly disclosed across any of its approximately 100 global boutique locations. No independent audit has been published.

4. LVMH Ventures full portfolio — LVMH Ventures’ investment portfolio is not comprehensively disclosed. A minority position in an Israeli-origin startup that also supplies Hublot operationally cannot be ruled out on available evidence.

5. Salesforce sub-processor chain — Salesforce’s GDPR-required sub-processor list encompasses a range of third-party technology vendors. Whether any Israeli-origin sub-processor handles Hublot customer data via the Commerce Cloud deployment has not been confirmed.

6. Google Cloud sub-services in Hublot’s data path — The LVMH–Google Cloud agreement ⁵⁶ does not specify which services individual maisons consume. Google Cloud’s Israeli infrastructure assets and Israeli-acquired technologies (e.g., Mandiant) may or may not be in Hublot’s data path; this is unresolved.

7. Tel Aviv boutique current status and technology vendor — The 2015 boutique opening ²⁸ is the only Israel-specific commercial record found. Its 2024–2026 operating status and associated technology stack (POS, surveillance, access control) are unconfirmed.

8. AURA Blockchain Consortium full vendor list — The complete technical vendor roster underpinning AURA’s infrastructure is not publicly disclosed ²¹. No Israeli-origin components have been identified, but exhaustive confirmation is not possible on available evidence.

9. Live vendor customer-list verification — Due to null web search results in this research session, real-time customer lists for SentinelOne, CyberArk, Wiz, Check Point, Verint, BriefCam, Oosto, and Trigo were cross-referenced from training-data snapshots only, not live databases.

10. Swiss commercial register IT data — The Canton of Vaud commercial register ¹⁹ confirms corporate identity and registered officers but does not contain IT procurement or vendor relationship disclosures.

End Notes