V-DIG Domain Audit: Screwfix (Kingfisher plc)

Audit Phase: V-DIG Technographic Audit Prepared: 2025-05-01 Audit Scope: Screwfix, as the primary trading brand and subsidiary of Kingfisher plc (LSE: KGF), the UK-headquartered home improvement retail group. Evidence is drawn exclusively from the research memo and its cited sources. Where no public evidence was identified, this is stated explicitly.

Enterprise Technology Stack & Vendor Relationships

Strategic Technology Partners

TCS (Tata Consultancy Services) is Kingfisher’s primary and publicly confirmed strategic technology transformation partner.¹ The relationship spans at least 15 years per TCS’s own published case study, covering omnichannel platform development and enterprise systems integration.¹ In October 2025, an expanded mandate was publicly announced — confirmed via both trade press² and a BSE India regulatory filing³ — establishing a deepened AI-powered transformation programme across the Kingfisher group, inclusive of Screwfix. TCS is an Indian multinational headquartered in Mumbai; no Israeli technology connection within the TCS–Kingfisher relationship is established by any identified public document.

Google Cloud Platform (GCP) is confirmed as Kingfisher’s strategic multi-cloud infrastructure partner.⁴ The relationship involves migration of SAP workloads and other enterprise systems to GCP and is publicly documented in trade press⁴ and the Kingfisher Annual Report 2023/24.⁵ Kingfisher has additionally disclosed use of Google Cloud’s generative AI suite as part of its “Powered by Kingfisher” data and technology strategy.⁶⁷

Converteo, a French data consultancy, is named as Kingfisher’s partner for the Core IQ retail data platform, launched in France in 2025.⁸ No Israeli technology connection has been identified in relation to this partnership.

Gophr is identified as the delivery technology partner for Screwfix Sprint, the group’s rapid delivery service.⁹ Gophr is a UK-based courier platform. No Israeli technology connection has been identified.

Israeli-Origin Technology Vendors

The research memo evaluated all vendor claims from a prior report. The findings are as follows:

Palo Alto Networks — The only Israeli-origin technology vendor for which any form of deployment evidence at the Kingfisher/Screwfix level has been identified is Palo Alto Networks. A job advertisement posted by Kingfisher for a “Network Design Engineer” (Southampton, permanent contract) explicitly listed “Expertise in Palo Alto firewall and security design” as a required skill.¹⁰ Palo Alto Networks was co-founded by Nir Zuk, a veteran of the Israeli Defence Forces and early engineer at Check Point, though the company is incorporated and headquartered in Santa Clara, California.¹¹ The job specification is the sole publicly identified document linking Kingfisher/Screwfix infrastructure to Palo Alto products; no contract, licensing agreement, or corporate disclosure has been identified that confirms scope or deployment scale.

CyberArk — CyberArk is an identity security company founded in Israel, headquartered in Newton, Massachusetts, with R&D centred in Petah Tikva, Israel.¹² A claim in a prior analysis attributed a CyberArk skills requirement to a Kingfisher engineering role, citing a third-party job aggregator (Jobright.ai). This source cannot be independently validated via a primary document. No corporate filing, press release, or procurement notice from Kingfisher or Screwfix names CyberArk as a vendor. No public evidence identified.

Check Point Software Technologies — Founded by Gil Shwed (a veteran of Israeli Unit 8200) and headquartered in Tel Aviv.¹³ A prior report attributed a “Check Point CloudGuard” relationship to Kingfisher, citing a source described internally as a Uganda-focused security news page — a source that is manifestly irrelevant to a Kingfisher procurement relationship. No Check Point–Kingfisher relationship is confirmed in any corporate filing, trade press article, or procurement notice identified in the research. No public evidence identified.

SentinelOne — Founded by Tomer Weingarten with R&D operations in Tel Aviv.¹⁴ A prior report attributed a Kingfisher investment in SentinelOne to a Goldman Sachs fund holdings document. The cited source reflects a passive index-fund vehicle holding both Kingfisher shares and SentinelOne shares — this is a coincidental co-holding in a fund, not a Kingfisher corporate investment decision. An additionally cited CIO.com article pertaining to a “Graham Benson” concerns Marks & Spencer, not Screwfix or Kingfisher, and does not reference SentinelOne. The claimed connection is unsupported by its own cited sources. No public evidence identified.

Wiz — Israeli-founded cloud security company (co-founders include Assaf Rappaport, formerly IDF/Microsoft); Google announced acquisition intent in early 2025.¹⁵ Wiz operates as a prominent Google Cloud security partner.¹⁵ Given Kingfisher’s confirmed GCP relationship,⁴ a prior report characterised Wiz deployment as “high probability / inferred.” No public document names Wiz as a Kingfisher or Screwfix vendor. No public evidence identified.

NICE, Verint, Claroty, Trigo, BriefCam, Trax — No public evidence identified linking any of these Israeli-origin vendors to Screwfix or Kingfisher in any corporate filing, press release, procurement notice, or credible trade publication.

AI & Platform Tooling (Non-Israeli)

Kingfisher’s disclosed AI and data platform includes Google Cloud AI services⁴⁶ and an internally developed retail media data platform, Core IQ, built with Converteo.⁸ The Kingfisher Annual Report 2023/24 confirms the group’s “Powered by Kingfisher” technology strategy, encompassing data-led omnichannel development.⁵⁷ Screwfix Sprint — a rapid (60-minute) delivery proposition — is a live operational service.⁹ No Israeli AI or analytics vendor is named in any Kingfisher group corporate disclosure identified in the research.

Surveillance, Biometrics & Retail Technology

Confirmed Retail Crime Platform: Auror

Screwfix is confirmed as an Auror customer. The Retail Week Innovation Report 2024 includes Screwfix among Auror’s named retail clients.¹⁶ Auror is a New Zealand-founded company (Auckland) providing a retail crime intelligence platform. Auror has developed and commercialised a “Subject Recognition” add-on feature that integrates third-party facial recognition technology (FRT) to identify known high-risk individuals across participating retailers.¹⁷¹⁸¹⁹

Auror’s own published documentation states that Subject Recognition connects to third-party FRT provider(s), but Auror does not publicly name which FRT engine(s) any specific retailer uses, nor whether every listed customer has activated the Subject Recognition add-on.¹⁷¹⁸¹⁹ No public document confirms that Screwfix has activated the Auror Subject Recognition (FRT) feature. The identity of any FRT engine used within Auror’s platform at Screwfix has not been established by any identified primary source.

Claimed FRT Engine Candidates: Oosto and Corsight

Oosto (formerly AnyVision) is an Israeli facial recognition company. AnyVision’s involvement in West Bank surveillance — referred to in reporting as “Project Sharp Eyes” — was documented by NBC News and Haaretz in 2020,²⁰ and led directly to Microsoft’s divestment from the company in 2021.²¹ Oosto is active in the retail sector FRT market. However, no public document links Oosto or AnyVision to Screwfix, Kingfisher, or to Auror’s technology stack in any confirmed contract, integration announcement, or named partnership. No public evidence identified.

Corsight AI is an Israeli facial recognition company, Tel Aviv-headquartered, founded by individuals with backgrounds in Israeli intelligence.²² Corsight is active in the retail and security FRT market.²² No public document confirms any Corsight relationship with Auror, Screwfix, or Kingfisher. No public evidence identified.

Body-Worn Cameras

The Retail Week Innovation Report 2024 references deployment of body-worn cameras in association with the Screwfix retail crime programme.¹⁶ Reveal Media, a UK-based body-worn camera supplier, is consistent with this context, though no specific contract document has been identified. No public document confirms that BWC footage from Screwfix stores is routed to any biometric processing or facial recognition system.

Zinc Systems / National Crime Centre

Kingfisher has confirmed — in a Zinc Systems press release²³ — the migration of its National Crime Centre operations to Zinc’s IRIS platform, consolidating crime and incident data from both B&Q and Screwfix. Zinc Systems is a UK-based physical security and incident management software company.

A trade publication, Counter Terror Business issue 55,²⁴ references a Zinc Systems–Cognyte collaboration on a product referred to as “CityINTEL.” Cognyte Software Ltd (NASDAQ: CGNT) is an Israeli cyber-intelligence analytics company, spun off from Verint Systems in 2021²⁵²⁶²⁷ and headquartered in Herzliya, Israel. The published reference to a Zinc–Cognyte product is a real trade-press citation.²⁴ However, no document confirms that Kingfisher’s or Screwfix’s deployment of Zinc IRIS includes any Cognyte component. The Cognyte relationship cited in the trade press pertains to a separate product (CityINTEL) developed for a different customer segment; its relevance to the Kingfisher IRIS implementation has not been established. The Cognyte sub-vendor connection to the Kingfisher/Screwfix Zinc deployment is not verified.

Predictive Analytics, Workforce Monitoring & Social Media Surveillance

No public evidence identified of Screwfix or Kingfisher deploying Israeli-origin predictive policing tools, sentiment analysis platforms, social media monitoring services, or workforce surveillance systems.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Kingfisher / GCP Partnership

Kingfisher’s multi-year strategic partnership with Google Cloud is confirmed in trade press⁴ and in the Kingfisher Annual Report 2023/24.⁵ The partnership involves migration of SAP workloads and other enterprise systems to GCP, as well as adoption of Google Cloud AI services for customer-facing and internal use cases.⁶

Project Nimbus

Project Nimbus is a confirmed $1.2 billion Israeli government and military cloud infrastructure contract awarded jointly to Google Cloud and Amazon Web Services in 2021.²⁸ The contract has been subject to sustained controversy, including internal employee protests at Google in 2024.²⁹ Kingfisher is a commercial GCP customer. Google Cloud is a single entity that provides commercial retail services and, separately, provides services to the Israeli government and military under Project Nimbus.

No public document establishes any contractual, operational, or legal linkage between Kingfisher’s GCP commercial contract and Project Nimbus. Kingfisher is not a party to Project Nimbus. The structural relationship — that Kingfisher’s commercial cloud fees contribute to the revenue of a provider that also holds the Project Nimbus contract — is a factual consequence of using GCP, shared equally with all GCP commercial customers globally.

Data Residency

Kingfisher has not publicly disclosed which GCP regions host Screwfix customer or operational data. No corporate filing, ICO submission, or cloud architecture document confirms or denies UK-only data residency for Screwfix workloads. No public evidence identified on data residency configuration.

Israeli Data Centre Operations

No public evidence identified of Screwfix or Kingfisher operating, co-locating, or contracting data centre capacity within Israel.

Sovereign Cloud / Government Cloud Participation

No public evidence identified of Screwfix or Kingfisher participating in any Israeli sovereign cloud programme, government cloud framework, or defence-adjacent infrastructure contract.

Defence, Intelligence & Security Sector Technology Relationships

Military & Intelligence Contracts

No public evidence identified of any contract, partnership, or service agreement between Screwfix, Kingfisher plc, or any of their named technology vendors — in their Kingfisher-specific capacity — and the Israeli Ministry of Defence, Israel Defence Forces (IDF), Mossad, Shin Bet, or any other Israeli intelligence or security agency.

Dual-Use Technology Provision

No public evidence identified of Screwfix or Kingfisher providing technology, services, or infrastructure with confirmed dual civilian/military use to any Israeli state body.

Unit 8200 / Israeli Intelligence Alumni Ecosystem

Several vendors in Screwfix’s broader technology ecosystem have founders or senior alumni with IDF or Unit 8200 backgrounds. These include Palo Alto Networks co-founder Nir Zuk (IDF veteran, Check Point alumni),¹¹ Wiz co-founders (IDF/Microsoft),¹⁵ Check Point founder Gil Shwed (Unit 8200),¹³ and Corsight AI (founded by former intelligence officers).²² In each case, the relevance to Screwfix is either limited to a single job-specification reference (Palo Alto) or is entirely unverified as a Screwfix vendor relationship (Wiz, Check Point, Corsight). No direct organisational or contractual relationship between Screwfix/Kingfisher and the Israeli intelligence ecosystem has been identified in any primary source.

Offensive Cyber Capabilities

No public evidence identified. Screwfix is a specialist trade and DIY retailer; it does not develop, sell, license, or deploy offensive cyber capabilities.

AI, Algorithmic & Autonomous Systems

AI Provision to Israeli State Bodies

No public evidence identified of Screwfix or Kingfisher providing AI systems, machine learning models, training data, or analytical platforms to any Israeli state, military, or security body.

General AI Deployment (Commercial Context)

Kingfisher has publicly disclosed the deployment of generative AI across multiple use cases as part of its “Powered by Kingfisher” strategy.⁷⁶ Confirmed AI use cases include:

• Product recommendations and personalisation for Screwfix and B&Q customers, powered by Google Cloud AI.⁶
• Internal operational and supply chain analytics, disclosed in the Kingfisher Annual Report 2023/24.⁵
• AI-powered transformation under the expanded TCS mandate, confirmed October 2025.²³
• The Core IQ retail media data platform, enabling first-party data sharing and retail media targeting, launched in France in 2025.⁸

No Israeli AI vendor is named in any Kingfisher corporate disclosure, investor filing, or technology press release identified in the research.

Algorithmic Decision-Making & Profiling

No public evidence identified of Screwfix deploying algorithmic systems for customer profiling, workforce management, or pricing in ways that have attracted regulatory or civil society scrutiny.

Autonomous Systems & Lethal Technology

Not applicable. Screwfix is a retail business. No public evidence identified of any engagement with autonomous weapons systems, lethal autonomous systems, or related military AI programmes.

Technology Ecosystem & R&D Footprint

R&D Centres & Technology Hubs

Kingfisher’s disclosed technology and data engineering hubs are located in London (UK), Krakow (Poland), and Cluj-Napoca (Romania).⁶ No Israeli R&D centre, technology lab, or engineering hub has been publicly identified in any Kingfisher or Screwfix corporate communication.

Acquisitions & Investments

No public evidence identified of Kingfisher plc having acquired or made a corporate equity investment in any Israeli technology company. Claims in a prior report that Kingfisher held investments in Palo Alto Networks and SentinelOne were traced to passive index-fund vehicle holdings — a Goldman Sachs fund and a Voya fund — that hold shares in multiple companies, including both Kingfisher and those technology stocks. This structure reflects coincidental co-holding within a diversified fund; it does not represent a Kingfisher corporate investment decision in either company. These claims have been discarded as misrepresentations of the underlying sources.

Patent Filings & IP Co-Development

No public evidence identified of patent filings, licensing agreements, or co-development arrangements between Kingfisher/Screwfix and Israeli-domiciled entities, universities (e.g. Technion, Hebrew University), or Israeli government research programmes.

Israeli Supply Chain (Product Procurement)

PPE Procurement (2020): Kingfisher confirmed in a 2020 press release³⁰ that it “ordered a further three million face masks from suppliers in China and Israel” as part of a pandemic PPE donation programme to European health services. This is a confirmed, dated, and documented instance of Kingfisher procuring goods from Israeli suppliers. The procurement is explicitly framed as a charitable/emergency supply action during the COVID-19 pandemic. This event dates to 2020 and has not been confirmed as reflecting an ongoing supplier relationship.

Hardware product lines (Mul-T-Lock/Assa Abloy, Risco Group, Keter): A prior report speculated that Israeli-origin brands may appear in the Screwfix product catalogue. Assa Abloy (Swedish conglomerate) owns Mul-T-Lock, which is of Israeli origin. Risco Group and Keter are Israeli companies active in security hardware and storage products respectively. Whether any of these brands appear in the live Screwfix product range is an empirical question requiring a catalogue-level audit. No public document confirms or denies this. Not verified.

Civil Society Scrutiny & Regulatory History

NGO & Academic Investigation

No NGO investigation, academic study, UN report, or civil society publication specifically examining Screwfix’s or Kingfisher plc’s technology relationships with the Israeli state, IDF, or Israeli intelligence apparatus has been identified. The broader BDS movement has published retailer-level campaigning materials, but no Screwfix-specific technology audit from a named civil society organisation has been identified in the research.

Boycott, Divestment & Sanctions Campaigns

No organised BDS or divestment campaign specifically targeting Screwfix for its technology provision — as distinct from general retail boycott activity — has been publicly identified in any named publication, campaign document, or press release.

UK Regulatory Actions

No ICO investigation, FCA inquiry, CMA review, Home Office enforcement action, or export control proceeding involving Screwfix or Kingfisher’s technology relationships or data practices has been identified in the research.

Legal Proceedings

No civil litigation, judicial review, or criminal investigation relating to Screwfix or Kingfisher’s technology supply chain and Israeli connections has been identified.

Data Protection & Biometric Regulation

The UK ICO’s Biometrics and Surveillance Camera Commissioner has issued guidance on FRT deployment in retail contexts. Screwfix’s confirmed use of the Auror retail crime platform¹⁶ places it within scope of that guidance framework, but no ICO enforcement action, reprimand, or formal inquiry relating to Screwfix’s use of Auror or any other surveillance technology has been identified in the research. Whether Screwfix has conducted a Data Protection Impact Assessment (DPIA) specifically covering Auror Subject Recognition is not known from any public document.

End Notes