V-DIG Audit: Marriott International, Inc.

Audit Phase: V-DIG (Digital Forensics / Technology Supply Chain) Prepared: 2026-05-01 Target: Marriott International, Inc. (NASDAQ: MAR)

Enterprise Technology Stack & Vendor Relationships

Confirmed Vendor Relationships (Publicly Documented)

Microsoft Azure is Marriott’s primary cloud platform under a multi-year strategic partnership announced in January 2021 ¹. The agreement covers migration of enterprise workloads to Azure, development of cloud-native hotel management systems, and deployment of Microsoft 365 across the enterprise — indicating a deep, critical infrastructure dependency. Google Cloud was announced as a partner in 2019 for guest-facing personalisation, data analytics, and AI-enabled guest experience tooling ², with ongoing status confirmed through 2023 references ³. For China-market operations, Marriott deepened a partnership with Alibaba Cloud in 2019 for data hosting and digital services specific to that geography ⁴.

Oracle OPERA is widely reported as Marriott’s primary property management system (PMS) backbone, deployed across thousands of properties globally ⁵. This constitutes a critical operational dependency at the property level. Akamai Technologies is deployed for content delivery network (CDN) services and web application firewall (WAF)/DDoS protection functions ⁶. Salesforce is referenced in industry technology analyses as used by Marriott for CRM functions ⁷. CrowdStrike has published customer engagement materials referencing Marriott in the context of endpoint detection and response (EDR) ⁸; CrowdStrike is U.S.-headquartered with no Israeli-origin classification. (Note: the CrowdStrike customer page should be independently verified as case study content may have been updated or removed ⁸.)

Accenture is referenced in hospitality digital transformation literature as a systems integrator for Marriott technology programmes ⁹. IBM has historically provided managed services and infrastructure to major hotel chains including Marriott ³, though no specific Israeli-origin technology deployment via either integrator in a Marriott context appears in public records. No named systems integrator has been documented as mandating Israeli-origin software as part of a Marriott technology programme.

Israeli-Origin Vendors: Assessment

Each of the following vendors was assessed against corporate filings, press releases, procurement records, regulatory materials, and vendor-published customer references for the period 2020–2025. In every case, no named Marriott contract, licensing announcement, or confirmed case study was identified.

• NICE Systems (NICE Ltd): Israeli-founded and headquartered in Ra’anana, Israel. NICE CXone and NICE Workforce Management are widely deployed in enterprise contact centres and are marketed to the hospitality vertical ¹⁰. No publicly disclosed, named Marriott–NICE contract has been located in any corporate filing, press release, or procurement record reviewed. No public evidence of a named Marriott–NICE contract identified.

• Verint Systems: Israeli-founded (now Melville, NY / dual-listed). Verint markets call recording, workforce engagement, and quality management products to the hotel sector ¹¹. No named Marriott contract, press release, or case study has been located. No public evidence of a named Marriott–Verint contract identified.

• Check Point Software: Israeli-founded and headquartered in Tel Aviv. Check Point markets network firewall and endpoint security to enterprise hospitality ¹². No named Marriott–Check Point contract, licensing announcement, or regulatory filing has been located. No public evidence of a named Marriott–Check Point contract identified.

• CyberArk: Israeli-founded, headquartered Newton, MA / Tel Aviv. CyberArk’s privileged access management (PAM) platform is widely used in large enterprises. CyberArk’s public customer reference library does not name Marriott as of data available through 2025 ¹³. No public evidence of a named Marriott–CyberArk contract identified.

• SentinelOne: Israeli co-founded, headquartered Mountain View, CA. No named Marriott case study or contract is disclosed in SentinelOne’s public customer pages ¹⁴. No public evidence identified.

• Wiz: Israeli-founded, headquartered New York. No named Marriott–Wiz contract is identified in public materials ¹⁵. No public evidence identified.

• Palo Alto Networks: Co-founded by Nir Zuk, an Israeli national; headquartered Santa Clara, CA. No named Marriott–Palo Alto Networks contract has been disclosed in public records reviewed. No public evidence of a named contract identified.

• Claroty: Focuses on OT/IoT security — not a primary hospitality enterprise IT product. No named Marriott–Claroty contract or integration identified. No public evidence identified.

Structural Evidence Gaps

Marriott’s enterprise security and contact-centre vendor relationships are not comprehensively disclosed in public corporate filings. Three structural gaps are noted. First, whether any named security vendor — including Check Point, CyberArk, SentinelOne, Wiz, or Palo Alto Networks — is deployed cannot be confirmed or denied from public records; such commercial agreements do not require public disclosure. Second, Marriott operates large global contact-centre and workforce management infrastructure where NICE and Verint hold dominant market positions among comparable hotel chains; whether either is deployed is neither confirmed nor denied in any public record reviewed, and verification would require direct procurement disclosure or a confirmed vendor case study. Third, where Accenture or IBM have deployed bundled enterprise security or analytics stacks for Marriott, sub-vendor composition is not publicly disclosed; Israeli-origin components could be present without being separately named — this gap is structural and cannot be closed from public sources alone.

Surveillance, Biometrics & Retail Technology

Facial Recognition & Biometrics

No verified deployment of facial recognition or biometric identification technology by Marriott International using Israeli-origin products — including AnyVision/Oosto, Trigo, BriefCam, or Trax — has been identified in corporate filings, press releases, or investigative reporting through 2025. Marriott’s annual reports ¹⁶ disclose use of biometric-adjacent technologies such as mobile key and digital identity verification for loyalty programme members, but these disclosures are not attributed to Israeli-origin vendors. The FTC 2024 consent order materials ¹⁷¹⁸¹⁹ describe Marriott’s information security programme obligations comprehensively but do not identify any Israeli-origin surveillance technology vendor. NGO databases (Who Profits ²⁰, BDS Movement ²¹) likewise contain no named Marriott–Israeli biometrics relationship. No public evidence identified.

A residual gap exists at the individual-property level: Marriott has been expanding mobile key and digital ID capabilities, and whether any Israeli biometric technology — for example AnyVision/Oosto for access control — is deployed at specific properties, particularly within Israel, is not documented in any public corporate filing or trade press reviewed.

Predictive Analytics & Monitoring

Marriott deploys guest data analytics through its Marriott Bonvoy loyalty platform using Google Cloud and first-party data tools ²²². No Israeli-origin analytics or social media monitoring platform has been identified in this context. No public evidence identified.

Third-Party Deployment

The FTC 2024 consent order ¹⁷¹⁸¹⁹ does not identify any specific third-party surveillance technology vendor of Israeli origin in its published materials. No Israeli-origin surveillance technology reaching Marriott via third-party managed services or bundled suites has been identified. No public evidence identified.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data Centre Operations in Israel

No public evidence has been identified that Marriott International operates, leases, or co-locates data centre infrastructure within Israel. Marriott is a hospitality and franchise company, not a cloud infrastructure provider; its data centre operations are primarily outsourced to Microsoft Azure ¹ and Google Cloud ². No public evidence identified.

Government Cloud Contracts

Project Nimbus is an Israeli government cloud computing contract awarded to Google Cloud and AWS in 2021. Marriott International is a hospitality and franchise company; it is not a cloud infrastructure vendor and has no documented role in Project Nimbus or comparable Israeli state-backed cloud programmes. No public evidence identified. Source classes checked: Israeli government procurement records, Project Nimbus reporting, SEC filings.

Data Sovereignty & Resilience Services to Israeli State

Marriott does not publicly market or contract cloud sovereignty or data resilience services to state institutions; this is outside its core business model. No public evidence identified.

China Data Residency

The Alibaba Cloud partnership ⁴ is specifically scoped to China-market operations. Marriott’s 10-K risk disclosures ¹⁶ identify data localisation obligations in multiple jurisdictions as a regulatory compliance consideration, consistent with this structure. No Israeli-state-related data residency arrangement of any kind has been identified.

Defence, Intelligence & Security Sector Technology Relationships

Military & Intelligence Contracts

No verified contracts or service agreements between Marriott International and the Israeli Ministry of Defence, the Israel Defense Forces (IDF), or Israeli intelligence agencies have been identified in any public record, procurement database, or investigative report. No public evidence identified.

Dual-Use Technology Provision

No publicly reported instances of Marriott’s commercially available technology being deployed for military, intelligence, or law enforcement surveillance in Israel or the occupied Palestinian territories have been identified. Marriott’s core commercial products — property management systems, loyalty programme platforms, and hotel management applications — have no publicly documented dual-use application in this context. No public evidence identified.

Offensive Cyber & Weapons Technology

Marriott International is a hospitality and franchise company with no publicly documented development, sale, or licensing of offensive cyber capabilities or digital weapons systems of any kind. No public evidence identified.

AI, Algorithmic & Autonomous Systems

AI/ML Deployment Scope

Marriott’s publicly disclosed AI and machine learning investments are oriented toward guest personalisation, dynamic pricing (revenue management), and hotel operations optimisation, delivered through its Marriott Bonvoy platform and partnerships with Google Cloud and Microsoft ¹²²²³. Marriott’s Q4 2024 earnings call ²³ and investor day materials ²² confirm continued investment in AI-enabled personalisation within the loyalty and direct-booking context. No provision of AI or ML systems to Israeli state, military, or security bodies has been identified in any public record. No public evidence identified.

Training Data & Model Development

No publicly reported instances of Marriott’s AI models being trained on surveillance-derived data, intercepted communications, or civilian population data from Israel or the occupied Palestinian territories have been identified. No public evidence identified.

Autonomous Systems & Lethality

Marriott International has no publicly documented involvement in autonomous targeting, fire-control AI, or weapons-effect systems of any kind. No public evidence identified.

Technology Ecosystem & R&D Footprint

Israeli R&D Centres

No R&D facility, engineering office, innovation laboratory, or accelerator programme operated by Marriott International within Israel has been identified in corporate filings, press releases, or technology press coverage through 2025. Source classes checked: Marriott 10-K ¹⁶, Marriott Serve360 ESG Report ²⁴, Marriott Investor Day materials ²², Crunchbase, LinkedIn corporate pages. No public evidence identified.

Acquisitions & Investments

Marriott’s most significant technology-adjacent acquisition in the audit window is the 2016 acquisition of Starwood Hotels & Resorts, which brought legacy Starwood IT infrastructure and was the origin of the widely reported data breach affecting up to 500 million guests ¹⁷¹⁸. Starwood had no identified Israeli-origin technology subsidiary. No acquisitions of Israeli-origin technology companies by Marriott have been identified in M&A databases, press reports, or SEC filings through 2025. No public evidence identified.

Patent & Intellectual Property

No significant patent portfolios, licensing agreements, or co-development arrangements between Marriott International and Israeli-domiciled entities or research institutions (Technion, Hebrew University, Weizmann Institute) have been identified in USPTO filings, press releases, or academic publications. No public evidence identified.

Branded Properties in Israel

Marriott operates branded properties within Israel — including Sheraton Tel Aviv, W Jerusalem, and others listed on its corporate portfolio ²⁵ — and the Israel hotel market has been the subject of industry reporting ²⁶. These properties rely on local IT vendors and property management systems. Whether local Israeli technology vendors supply property-level infrastructure is not documented in any corporate filing or trade press reviewed. This gap is noted but is outside the scope of enterprise-level technology supply chain assessment.

Civil Society Scrutiny & Regulatory History

NGO & Academic Reports

Who Profits Research Center ²⁰ maintains a database of companies operating in Israeli-occupied territories. Marriott’s branded hotel properties in Israel are within scope of Who Profits’ general documentation of international hotel brands in the occupation economy. However, no dedicated investigative report specifically targeting Marriott’s technology relationships with the Israeli state has been identified in Who Profits’ published materials through 2025.

BDS Movement ²¹ published campaign targets do not include Marriott International as a primary named technology-sector target as of data available through 2025. Marriott appears in general hospitality boycott discussions related to its hotel properties in Israel, but not specifically due to technology supply chain relationships.

No dedicated NGO, academic, or UN report specifically addressing Marriott’s technology relationships with the Israeli state has been identified. Source classes checked: Who Profits, BDS Movement campaign lists, Human Rights Watch reports, Amnesty International technology reporting, academic databases. No technology-specific civil society scrutiny identified.

Boycott & Divestment Campaigns

Marriott International has appeared in general BDS-adjacent consumer campaigns relating to its operation of branded hotels within Israel (including properties in or near Jerusalem) ²¹²⁵. These campaigns are focused on physical hospitality operations, not on technology supply chain relationships with the Israeli state. No organised BDS campaign specifically citing Marriott’s technology procurement or vendor relationships with Israeli-origin technology firms has been identified in public records through 2025. No technology-specific BDS campaign identified. General hospitality-operations-based campaigns are noted but are outside V-DIG scope.

Regulatory & Legal Actions

The major regulatory actions against Marriott in the 2020–2025 period relate to data protection and cybersecurity failures arising from the 2014–2018 Starwood data breach and subsequent incidents; none involves Israeli-nexus technology relationships.

• March 2020 Breach Disclosure: Marriott disclosed that a data breach had exposed records of up to 5.2 million guests via a compromise of login credentials used to access a third-party application ¹⁸. This incident was a continuation of vulnerability exposure originating from the Starwood acquisition.

• FTC Settlement (October 2024): Marriott International and Starwood Hotels & Resorts agreed to pay $52 million and implement a comprehensive information security programme to settle investigations by the FTC and multi-state attorneys general ¹⁷. The FTC consent order ¹⁸¹⁹ mandates specific technical and organisational security controls, a customer portal for loyalty-card data deletion, and third-party security assessments. No Israeli-nexus technology relationship is referenced in the complaint or proposed order.

• UK ICO Fine (2020): The UK Information Commissioner’s Office fined Marriott £18.4 million under GDPR relating to the Starwood breach. No Israeli-technology nexus was referenced.

• No regulatory inquiries, export control actions, or sanctions-related investigations involving Marriott’s technology sales or services to Israeli state entities have been identified in any jurisdiction. No relevant regulatory or legal actions identified in this domain.

End Notes