V-DIG Audit: Upwork, Inc.

Audit Phase: V-DIG Domain Audit Target Entity: Upwork, Inc. (NASDAQ: UPWK) Audit Date: May 2026 Jurisdiction of Incorporation: Delaware, USA Primary Business: Online freelance labour marketplace intermediating contracts between independent talent and client organisations globally

Enterprise Technology Stack & Vendor Relationships

Confirmed Infrastructure

Upwork’s S-1 (2018) ¹ and subsequent 10-K filings ²³ identify AWS as the company’s primary cloud infrastructure provider. This is corroborated by a Tigera/Calico engineering case study ⁴ confirming Upwork migrated its legacy systems to Kubernetes on AWS EKS and implemented zero-trust network security using Calico. No secondary cloud provider or on-premises data centre arrangement is disclosed in public filings. Google Cloud is confirmed as an additional platform used specifically for Upwork’s generative AI workloads (see §AI, Algorithmic & Autonomous Systems below) ⁵⁶.

Israeli-Origin Cybersecurity Vendors

The prior research stage surfaced claims that Upwork uses multiple Israeli-origin cybersecurity products internally. Each claim was assessed against primary sources:

• Wiz (CSPM/cloud security): Wiz is Israeli-founded (Tel Aviv R&D), co-founded by Assaf Rappaport and colleagues following the sale of Adallom to Microsoft. Google announced an approximately $32 billion acquisition of Wiz in March 2025 ⁷. The claim that Upwork uses Wiz internally originates in a prior AI memo citing Upwork marketplace job postings listing “Wiz Cloud Engineer” as a client-sought skill. Job postings by clients on the Upwork marketplace reflect skills those clients wish to hire, not the skills or tools deployed within Upwork’s own infrastructure. No Upwork 10-K, 10-Q, DPA subprocessor list, or engineering case study names Wiz as an internal vendor. No public evidence identified of Upwork holding a Wiz licensing or deployment relationship.

• Check Point Software Technologies: Check Point is Israeli-founded (Gil Shwed, Tel Aviv, 1993) ⁸. The claim that Upwork uses Check Point for network segmentation and VPN rests solely on Upwork marketplace listings for Check Point specialist freelancers, which are skills categories on the platform — not evidence of Upwork’s own IT procurement. No Upwork corporate filing or engineering disclosure confirms this vendor relationship. No public evidence identified.

• SentinelOne (XDR/endpoint): SentinelOne is headquartered in Mountain View, CA, with substantial R&D in Israel and co-founders with reported IDF backgrounds. The claim of internal Upwork deployment cited a generic “Network Engineer Job Description” page on Upwork’s website — not a vendor relationship disclosure. No Upwork 10-K, 10-Q, DPA subprocessor list, or engineering blog post names SentinelOne as an Upwork vendor. No public evidence identified.

• CyberArk (Privileged Access Management): CyberArk is headquartered in Petah Tikva, Israel ⁹. The claim that Upwork uses CyberArk for privileged access management was traced back to an Upwork page listing CyberArk as a freelancer skill category — a marketplace listing for clients seeking CyberArk specialists, not a disclosure of Upwork’s own internal procurement. No 10-K, 10-Q, or subprocessor list names CyberArk. No public evidence identified.

• Palo Alto Networks: Palo Alto Networks is US-headquartered (Santa Clara, CA), though co-founded by Israeli national Nir Zuk. No verified evidence of a specific Upwork–Palo Alto Networks vendor relationship was identified in any public corporate filing, press release, or credible news report. No public evidence identified.

• NICE, Verint, Claroty: No evidence of Upwork licensing relationships with NICE, Verint, or Claroty was identified in any public corporate filing, press release, or credible news report. No public evidence identified.

• Wiz/Avalor/Cyberstarts VC ecosystem alignment: The prior AI memo asserted alignment between Upwork’s procurement and the Cyberstarts VC ecosystem. No board disclosures, CISO statements, or partnership announcements substantiate this inference. Speculative; No public evidence identified.

Payment Infrastructure Vendors

• Payoneer: Payoneer is an Israeli-founded company ¹⁰, now NYSE-listed. Payoneer’s role as a Upwork payment withdrawal option is confirmed by multiple sources: the official Payoneer/Upwork partnership page ¹¹, Upwork Support articles on Payoneer withdrawals ¹²¹³¹⁴, and a Payoneer Q1 2021 investor release referencing the Upwork relationship ¹⁵. The arXiv study on gig economy payment infrastructure (2024) ¹⁶ also identifies Payoneer as a structural financial intermediary in data/gig work including Upwork. The relationship is confirmed as a payment integration allowing freelancers to withdraw earnings to Payoneer accounts. Whether this constitutes a formal “strategic partnership” with commercial revenue-sharing beyond standard payment integration is not established in public filings or press releases.

• Tipalti: Tipalti is Israeli-founded and headquartered, with offices in Tel Aviv and the US ¹⁷. Tipalti’s marketing page describes capabilities for gig economy operators ¹⁸. The prior AI memo cited an Upwork marketplace job posting for a “NetSuite to Tipalti” workflow project — a posting created by an unknown third-party client on the Upwork marketplace, not evidence of Upwork’s internal use of Tipalti. No public evidence identified of a confirmed Upwork–Tipalti vendor relationship from primary sources.

Acquisitions & Key Client Relationships (2025)

Upwork’s 10-Q (filed November 2025) ¹⁹ and multiple press sources ²⁰²¹²² confirm two acquisitions completed in 2025:

• Bubty: A Dutch (Netherlands-based) Freelance Management System ²¹. Not Israeli-origin.
• Ascen: A US-based employer-of-record and compliance company ²². Not Israeli-origin.

No acquisitions of Israeli-origin technology companies by Upwork were identified in SEC filings ¹⁹²³²⁴, press releases, or credible news reporting.

Humanitarian Initiative

In July 2022, Upwork partnered with the Tent Partnership for Refugees on an initiative named “Opportunity Unlimited” to connect Ukrainian displaced professionals with remote work opportunities ²⁵. This initiative is noted for completeness; it has no bearing on Israeli technology vendor relationships.

Surveillance, Biometrics & Retail Technology

Identity Verification & Biometric Data Processing

Identity verification is a material operational function for Upwork, which is required to verify contractor identities to maintain platform integrity, comply with KYC/AML obligations, and detect fraud. Upwork’s Trust & Safety page ²⁶ and privacy documentation ²⁷²⁸ acknowledge the use of third-party identity verification services. A Reddit thread from 2022 ²⁹ shows user-level concern and inquiry about which third parties receive biometric data shared during Upwork’s ID verification process, indicating biometric data has been collected as part of platform onboarding for a substantial period.

AU10TIX — Confirmed Historical Vendor (Israeli-origin):

AU10TIX is an Israeli identity intelligence company and a subsidiary of ICTS International (Amsterdam-listed), headquartered in Hod Hasharon, Israel. AU10TIX provides document forensics and multi-modal biometric face-matching for identity verification.

In June 2024, Wired reported ³⁰ that AU10TIX had suffered a serious credential exposure: administrative login credentials for a logging platform had been left publicly accessible for approximately 18 months. Dark Reading ³¹ confirmed the exposure. A TrustCloud breach summary ³² — as well as separate CyberInsider reporting — identified Upwork, alongside Fiverr and Uber, as named clients whose user identity verification data appeared in the exposed AU10TIX logs. The exposed data included biometric metadata and document verification records ³². This constitutes the strongest verified Israeli-origin technology vendor relationship identified in this audit, established through multiple independent sources ³⁰³¹³².

Public reporting suggests Upwork transitioned away from AU10TIX following the breach disclosure, approximately mid-2024 ³². The current post-AU10TIX identity verification vendor is not publicly named in any Upwork press release, support article, legal center document, or SEC filing reviewed. The live version of Upwork’s subprocessor list ³³ and current Data Processing Agreement ²⁷ would be the authoritative sources, but no current live version confirming a named replacement vendor was retrievable during research. The 2023 archived DPA ³⁴ provides partial historical subprocessor information only.

Summary status: AU10TIX — confirmed historical relationship, active up to approximately mid-2024; described as discontinued following breach disclosure. Current IDV vendor: not publicly identified.

Other IDV Vendors Assessed

• Jumio: Jumio is a US-incorporated (Palo Alto, CA) identity verification company with AI-driven liveness detection and document verification ³⁵. Jumio is a confirmed Upwork client, using Upwork’s Lifted staffing service to hire IT staff across ten countries and resolve an 800-ticket IT backlog ³⁶³⁷. The prior AI memo conflated this client relationship with the claim that Upwork uses Jumio’s IDV product internally. No independent source confirms that Upwork has procured Jumio’s biometric/IDV product for deployment on the Upwork platform. Jumio is US-incorporated and not Israeli-origin. No public evidence identified that Upwork uses Jumio’s IDV product internally.

• Persona (Persona Identities, Inc.): US company (San Francisco). The prior AI memo’s cited evidence for a Persona–Upwork IDV integration was an Upwork job posting for UX testing of an unspecified website — not a confirmation of a Persona integration. No public evidence identified of a confirmed Upwork–Persona vendor relationship.

• Onfido (now Entrust): UK-founded, acquired by Entrust in 2024 ³⁸. Not Israeli-origin. No confirmed Upwork–Onfido vendor relationship identified in public records. No public evidence identified.

Retail Surveillance Technology

Upwork is a digital marketplace with no physical retail stores or facilities. Israeli-origin retail and physical surveillance analytics vendors — including Trigo (computer vision checkout), BriefCam (video analytics), AnyVision/Oosto (facial recognition), and Trax (retail shelf analytics) — have no applicability to Upwork’s business model. No public evidence identified; vendor category structurally inapplicable.

Predictive Analytics & Workforce Monitoring

No verified use of Israeli-origin predictive analytics, sentiment analysis, social media monitoring, or workforce surveillance tools was identified in any public Upwork filing, press release, or credible investigative report. No public evidence identified.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Primary Cloud Infrastructure

Upwork’s cloud infrastructure is confirmed as AWS-primary, as disclosed in its S-1 ¹, 2023 10-K ²³, and most recent annual report ²³. The Tigera/Calico engineering case study ⁴ provides technical corroboration, confirming AWS EKS (Elastic Kubernetes Service) as the orchestration layer, with Calico implementing zero-trust network policies. Google Cloud is used as an additional platform, specifically for AI/ML workloads tied to the “Uma” AI assistant ⁵⁶. No other cloud providers are named in public disclosures.

Israeli Data Centres

No evidence that Upwork operates, leases, or co-locates data centre infrastructure within Israel was identified in any SEC filing, press release, engineering disclosure, or independent news report. Upwork’s 10-K filings describe infrastructure as fully cloud-based with no owned or leased Israeli physical facilities. No public evidence identified.

Project Nimbus

Project Nimbus is a confirmed $1.2 billion cloud services contract awarded in 2021 to Google Cloud and AWS to provide cloud infrastructure and services to the Israeli government and military ³⁹. AWS launched the il-central-1 (Tel Aviv) AWS region in 2023 in connection with Project Nimbus obligations ⁴⁰. Google Cloud employees staged internal protests and public demonstrations in April 2024 over Project Nimbus ⁴¹.

Upwork is a confirmed AWS customer ⁴³ and confirmed Google Cloud / Vertex AI customer ⁵⁶. However, Upwork is not a party to Project Nimbus, has made no public statement about the contract, and has not been reported by any source — news, NGO, parliamentary, or regulatory — as a Project Nimbus participant, subcontractor, downstream beneficiary, or affiliated entity. The inference that Upwork’s AWS or GCP expenditure contributes revenue to Project Nimbus infrastructure is indirect and would apply equally to any enterprise customer of either platform; it does not constitute a verified or material finding specific to Upwork.

The prior research memo’s specific claim that Upwork uses the il-central-1 AWS region for data caching or processing is unverified and speculative. No Upwork engineering disclosure, AWS case study, SEC filing, or independent report confirms Upwork has opted into or uses the Israel AWS region. No public evidence identified.

Data Sovereignty & Sovereign Cloud Services

No evidence was identified that Upwork provides services marketed or contracted to Israeli state institutions for data sovereignty, resilience, or government cloud purposes. No public evidence identified.

Data Residency Disclosures

Upwork’s current DPA ²⁷ and subprocessor list ³³ are the primary public disclosures governing data residency obligations. The 2023 archived DPA version ³⁴ provides partial historical subprocessor information. Upwork’s support documentation ²⁸ acknowledges cross-border data transfers and applicable safeguards (Standard Contractual Clauses). No specific disclosure of data being routed through or stored in Israeli jurisdiction was identified. No public evidence identified of Israeli data residency.

Defence, Intelligence & Security Sector Technology Relationships

Military & Intelligence Contracts

No verified contracts, partnerships, service agreements, or memoranda of understanding between Upwork and the Israeli Ministry of Defence, the Israel Defense Forces (IDF), any branch of Israeli military intelligence (Unit 8200, Mossad, Shin Bet, Aman), or affiliated procurement agencies were identified in any public source — including the full SEC EDGAR filing index ²⁴, Upwork press releases ⁴², major technology and defence trade press, or NGO procurement databases. No public evidence identified.

Dual-Use Technology Provision

No instances were identified where Upwork’s technology, platform, or services have been publicly reported or confirmed as deployed for military, intelligence, or law enforcement surveillance purposes in Israel or in Israeli-occupied territories. No public evidence identified.

Talent Supply to Defence/Intelligence Sector

Upwork’s marketplace connects freelancers with clients across all sectors. No reporting, NGO investigation, or regulatory disclosure has specifically identified Upwork’s marketplace as a significant channel supplying technical talent to Israeli defence or intelligence entities. No public evidence identified.

Offensive Cyber & Weapons Technology

Upwork is a freelance labour marketplace. It does not develop, sell, license, or provide cybersecurity tools, offensive cyber capabilities, signals intelligence products, or weapons systems. Its commercial model is the intermediation of labour contracts between independent contractors and client organisations. No public evidence identified; category structurally inapplicable to Upwork’s business model.

AI, Algorithmic & Autonomous Systems

”Uma” — Generative AI Platform

Upwork launched its “Uma” (Upwork Mindful AI) generative AI platform in 2023 ⁶. Uma is confirmed via Google Cloud’s generative AI case study publication ⁵ and Upwork’s own press release ⁶ as built on Google Vertex AI, incorporating Google’s Gemini foundation models. Uma’s documented functions include AI-assisted job post generation, freelancer matching, workflow automation, and a conversational assistant for navigating the platform.

No evidence was identified that Uma, or any Upwork AI product, has been provided, licensed, or sold to Israeli state bodies, military institutions, or intelligence agencies. No evidence was identified of Upwork AI systems being deployed for population surveillance, predictive policing, or military targeting applications in any jurisdiction. No public evidence identified.

Training Data Practices

Upwork’s Terms of Service grant Upwork a broad licence over platform content, which may encompass use for AI model training and improvement purposes ²⁷. This is a standard commercial ToS practice and is not specific to Israeli data, state-linked datasets, or surveillance-derived corpora. No publicly reported instance of Upwork AI models being trained on surveillance-origin, military, or Israeli government datasets was identified. No public evidence identified.

Algorithmic Labour Allocation

Upwork’s core matching algorithms allocate job recommendations and search rankings for freelancers and clients. No independent audit, NGO report, or academic study specifically examining the civil liberties or human rights implications of Upwork’s algorithmic labour allocation in the context of Israeli or Palestinian workers was identified in publicly available sources. The arXiv study on digital payments in data work ¹⁶ touches on structural financial access inequities affecting Global South data workers on platforms including Upwork but does not make findings specific to Israeli-Palestinian dynamics.

Autonomous Systems & Lethal Autonomy

Not applicable to Upwork’s commercial domain. No public evidence identified.

Technology Ecosystem & R&D Footprint

Israeli R&D Centres & Offices

No evidence was identified that Upwork operates research and development facilities, engineering offices, innovation labs, startup accelerator programmes, or co-working arrangements within Israel. Upwork’s 10-K filings ²³²³ list principal offices as San Francisco (headquarters) and Chicago, with a predominantly remote and distributed engineering workforce. No Israeli office is disclosed in any SEC filing. No press release, news report, or LinkedIn organisational data reviewed identified an Upwork Israel office or R&D facility. No public evidence identified.

Acquisitions and Investment Activity

All confirmed Upwork acquisitions identified in public records are non-Israeli in origin:

• Bubty (2025): Dutch Freelance Management System, Netherlands-origin ^20192122. Upwork’s 10-Q ¹⁹ confirms this acquisition. EU Startups reporting ²¹ and Outsource Accelerator ²² provide commercial context.
• Ascen (2025): US-based employer-of-record and payroll compliance company ²⁰¹⁹²². US-origin.

No acquisitions of Israeli-origin or Israeli-domiciled technology companies by Upwork were identified in SEC filings ¹⁹²³²⁴, Upwork press releases, or credible news reporting. No public evidence identified of Israeli-origin acquisitions or strategic investments.

Patent & Intellectual Property Relationships

No significant patent portfolios, cross-licensing agreements, co-development arrangements, or joint IP ventures between Upwork and Israeli-domiciled entities — including academic institutions (Technion–Israel Institute of Technology, Hebrew University of Jerusalem, Weizmann Institute of Science) or Israeli government research bodies — were identified in USPTO records, Upwork SEC filings, or press releases. No public evidence identified.

Ecosystem Partnerships

Upwork’s disclosed technology partnerships centre on payment infrastructure (Payoneer ¹¹¹²¹⁵), AI infrastructure (Google Vertex AI ⁵⁶), and cloud infrastructure (AWS ⁴³). No formal technology ecosystem partnership with Israeli-origin companies — beyond the confirmed historical AU10TIX IDV relationship described in §Surveillance, Biometrics & Retail Technology — was identified in any primary source. No additional public evidence identified.

Civil Society Scrutiny & Regulatory History

NGO & Academic Reports

• The 2024 arXiv paper “Deeply Embedded Wages: Navigating Digital Payments in Data Work” ¹⁶ examines financial infrastructure in gig and data work including Upwork, focusing on payment access barriers for Global South workers and the structural role of intermediaries including Payoneer. The paper does not make specific findings about Israeli state technology relationships, military contracting, or technology complicity claims.

• No dedicated investigation by major human rights or technology accountability organisations — including Amnesty International, Human Rights Watch, Who Profits (Israeli NGO tracking commercial involvement in occupation), the American Friends Service Committee (AFSC) Investigate database, or Al-Haq — specifically addressing Upwork’s technology relationships with the Israeli state was identified in publicly available sources. No targeted NGO report identified.

• No UN Special Rapporteur report, UN Human Rights Council resolution, or UN database entry specifically addressing Upwork and Israeli technology relationships was identified. No public evidence identified.

Boycott, Divestment & Sanctions Campaigns

The BDS Movement’s published boycott lists and active campaign targets ⁴³ focus primarily on companies with direct contracts with the Israeli military, a direct corporate presence in Israeli-occupied territories, or specific provision of military or surveillance technology. No BDS campaign specifically targeting Upwork was identified in available public records. No organised divestment resolution, shareholder campaign, pension fund exclusion, or sanctions proceeding specifically citing Upwork’s Israeli technology relationships was identified across BDS Movement, AFSC Investigate, Who Profits, or Palestine solidarity campaign archives. No public evidence identified.

Regulatory & Legal Actions

• No regulatory inquiries, formal investigations, export control enforcement actions, or sanctions-related proceedings involving Upwork’s technology sales or services to Israeli state entities were identified in SEC-disclosed risk factors, DOJ/FTC public databases, OFAC records, or press reporting. No public evidence identified.

• The AU10TIX credential exposure (June 2024) ³⁰³¹³² generated substantive privacy-focused media coverage and user concern. Multiple technology and security publications named Upwork as a client whose user data was exposed. However, no regulatory enforcement action — by the FTC, a state data protection authority, or equivalent — specifically naming Upwork as a respondent in connection with the AU10TIX breach was identified in publicly available records as of the knowledge cutoff. The breach is noted as a significant privacy incident with confirmed Israeli-vendor provenance.

• Upwork’s 10-K risk factors ²³ disclose general regulatory and data privacy risks. No specific risk factor disclosures address Israeli technology relationships or BDS-related reputational risk.

Platform Labour & Payment Access Concerns

The arXiv study ¹⁶ and associated academic literature raise concerns about financial exclusion embedded in platform payment architectures. The Payoneer integration specifically ¹¹¹²¹⁰ involves an Israeli-founded payment company as the primary freelancer withdrawal mechanism on Upwork in many jurisdictions. User-level documentation of this dependency appears in multiple Upwork support articles ¹³¹⁴ and third-party financial commentary ¹⁵. No regulatory or civil society action specifically addressing this payment architecture from a BDS or political risk standpoint was identified.

End Notes