Digital Audit: Costa Coffee

Enterprise Technology Stack & Vendor Relationships

Costa Coffee’s UK contact centre (a 40-seat operation in High Wycombe) uses NiCE - an Israeli-founded (1986, Ra’anana) company now dual-listed on NASDAQ and the Tel Aviv Stock Exchange - alongside RingCentral as its Automated Call Distributor platform, per a June 2025 site-visit technology profile ¹. NiCE Systems’ Israeli origin and corporate history are independently documented ². The same contact-centre fact file identifies TechSee, an Israeli (Tel Aviv, founded 2015) visual-assistance/AR vendor, as the provider of video-based remote troubleshooting for Costa Express coffee machines ¹, and TechSee’s Israeli funding and corporate profile are separately documented ³. Both of these relationships are peripheral, customer-facing support functions rather than core network security infrastructure ¹. No evidence was located connecting Costa Coffee to Check Point, Wiz, SentinelOne, CyberArk, Verint, Claroty, or Palo Alto Networks; No public evidence identified.

Costa Coffee’s UK store connectivity and SD-WAN network is delivered by Exponential-e, a managed-service Tier 2 supplier, operating “in collaboration with Cisco Meraki,” with the rollout reported live by January 2021 and still the operating model as of October 2023 ⁴⁵. Cisco Meraki is a US (Cisco Systems)-origin product line, and no evidence connects Costa’s specific Meraki deployment to any Israel-related Cisco contract - these appear to be separate deployments of the same multinational vendor’s general enterprise product line ⁴⁵. Cisco Systems separately maintains extensive, independently documented commercial relationships with the Israeli Ministry of Defense and Israel Police, detailed further below ⁶⁷⁸⁹.

Costa Coffee migrated core systems to AWS cloud via UK partner ANS Group, reported in December 2019, covering roughly 2,467 stores and Costa Express machines in support of international expansion ¹⁰¹¹. AWS is separately a co-contractor, alongside Google Cloud, on the Israeli government’s Project Nimbus cloud-computing contract ¹²¹³¹⁴. No evidence identified that Costa Coffee’s AWS tenancy uses Nimbus infrastructure or Israeli AWS regions; this is a general enterprise cloud-hosting relationship with a vendor that separately serves Israeli state customers as a corporate matter ¹²¹³¹⁴.

Costa Coffee uses GEP SOFTWARE, a US company (Clark, NJ), for AI-driven procurement and source-to-contract automation, selected in 2023 and live from August 2024, with no Israeli ownership, R&D, or data-routing link identified ¹⁵. Costa also uses Computacenter, a UK systems integrator, for its mobile-ordering and kitchen-display-screen rollout across 500+ stores from January 2020, with no Israeli-origin technology named in this engagement ¹⁶. Coca-Cola Company, Costa’s parent since 2019, separately operated “The Bridge,” a Tel Aviv-based startup commercialization accelerator active by 2014 and described in 2017 as being in its fourth cohort, providing marketing mentorship and pilot access to Israeli startups without taking equity ¹⁷; no source names Costa Coffee as a participant or beneficiary of this programme ¹⁷. No public evidence identified of Israeli-origin vendors mandated or recommended by Costa Coffee’s systems integrators (Exponential-e, Computacenter, GEP, ANS Group) beyond the Cisco Meraki networking product noted above.

Surveillance, Biometrics & Retail Technology

Costa Express, Costa’s self-service vending unit, unveiled a facial-recognition and demographic-estimation kiosk (the CEM-200) at NRF in 2013, built by Bsquare, a US company previously known for developing Coca-Cola Freestyle machines ¹⁸¹⁹. Company statements at the time described the system as producing anonymized, aggregate demographic estimates to drive product-mix suggestions rather than identity matching, and the vendor is US-origin rather than Israeli ¹⁸¹⁹. A newer Costa Coffee “AI kiosk” autonomous-barista unit has been deployed at US locations including Austin-Bergstrom Airport and Georgia Tech and is documented in trade press, but no vendor or manufacturer name is identified in available sources, so the origin of this technology is unconfirmed either way ²⁰. No public evidence identified of Trigo, BriefCam, AnyVision/Oosto, or Trax deployment by Costa Coffee. No public evidence identified of Israeli-origin predictive-policing, sentiment-analysis, social-media-monitoring, or workforce-surveillance tools in use by Costa Coffee. No public evidence identified of indirect or bundled delivery of biometric or predictive-analytics tools via Costa’s managed service providers.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

No public evidence identified that Costa Coffee operates, leases, or co-locates data centre infrastructure in Israel. No public evidence identified of Costa Coffee’s direct participation in Project Nimbus or any comparable Israeli government cloud programme; by contrast, AWS - Costa’s general cloud vendor via the ANS Group migration - is a Nimbus co-contractor at the corporate level, a corporate-level fact that is independently documented but not shown to extend to Costa’s specific tenancy ¹²¹³¹⁴. No public evidence identified of Costa Coffee providing data-sovereignty, data-residency, or infrastructure-resilience services to Israeli state institutions or military bodies, consistent with Costa’s position as a technology consumer rather than a technology or infrastructure vendor.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of any contract, partnership, or service agreement between Costa Coffee and the Israeli Ministry of Defence, IDF, intelligence agencies, or other state security bodies. Cisco Systems - whose Meraki networking product Costa uses in its UK stores via Exponential-e - separately and extensively documents commercial relationships with Israeli military and police bodies, including a 2017 US Foreign Military Sales-funded contract of at least $250 million supporting the IDF’s “David’s Citadel” data centre, approximately $2 million in Israeli Ministry of Defense server purchases between November 2023 and January 2024, and Israel Police purchases of Cisco “Nituv” routing equipment and licensing valued at roughly NIS 4,060,533 in 2020–2021 ⁶⁷⁸⁹. These findings pertain to Cisco Systems generally and are not shown to involve the specific Meraki instance deployed for Costa Coffee’s UK stores ⁶⁷⁸⁹. No public evidence identified of Costa Coffee’s own commercial technology being deployed for military, intelligence, or law-enforcement surveillance applications within Israel or the occupied territories. No public evidence identified of Costa Coffee developing, selling, licensing, or maintaining offensive cyber capabilities, zero-day tools, or digital weapons systems.

AI, Algorithmic & Autonomous Systems

No public evidence identified of Costa Coffee providing AI/ML, computer-vision, or decision-support systems to Israeli state, military, or security bodies. No public evidence identified that Costa Coffee’s AI systems - including its GEP procurement AI, AI kiosks, or contact-centre tooling - have been trained on or given access to civilian population data, intercepted communications, or surveillance-derived datasets from Israel or the occupied territories. No public evidence identified of autonomous target-generation, threat-detection, or tracking systems provided by Costa Coffee to Israeli military or security forces, consistent with this activity falling outside Costa’s consumer-facing business model.

Technology Ecosystem & R&D Footprint

No public evidence identified of Costa Coffee-operated R&D facilities, engineering offices, or innovation labs in Israel. No public evidence identified of Costa Coffee acquisitions of Israeli technology companies or direct strategic investments in Israeli startups or venture funds; Coca-Cola Company’s “The Bridge” accelerator in Tel Aviv is a parent-company-level programme with a stated non-equity commercialization model, and no source connects it to Costa Coffee specifically ¹⁷. No public evidence identified of patent portfolios, licensing agreements, or co-development arrangements between Costa Coffee and Technion, Hebrew University, the Weizmann Institute, or other Israeli-domiciled research institutions.

Civil Society Scrutiny & Regulatory History

The Who Profits database profiles Central Bottling Company (CBC), the Wertheim-family-owned exclusive Coca-Cola franchisee in Israel, documenting a regional distribution centre and cooling houses in the Atarot Industrial Zone in occupied East Jerusalem and settlement-sourced grapes used by CBC’s Tabor Winery subsidiary ²¹. The Who Profits profile’s listed CBC brand portfolio - Coca-Cola, Sprite, Fanta, FUZE, Kinley, Carlsberg, Tuborg, Müller, Prigat, and Neviot - does not include Costa Coffee ²¹. No public evidence identified establishing that Costa Coffee products are distributed through CBC or the Atarot facility. Costa Limited’s listed company officers, per its Companies House filing, include the individuals reviewed in this audit ²², and its recent chief executives are Todd Beiger, named in Coca-Cola Company leadership materials ²³, and Philippe Schaillee, whose CEO appointment was reported in February 2023 ²⁴; No public evidence identified of Israel or defense-industry ties for these individuals. Costa Limited’s UK Modern Slavery Statement for 2021–22, as summarized in the UK government’s Modern Slavery Statement Registry, does not name any specific high-risk countries, including Israel or Palestine, in the publicly accessible registry summary ²⁵. No public evidence identified that Costa Coffee or Coca-Cola appears in the “Don’t Buy Into Occupation” 2025 company data set, whose reported additions are Amazon, Boeing, and Cellebrite DI ²⁶. No public evidence identified that Costa Coffee or Coca-Cola is named in the UN OHCHR database of business enterprises operating in connection with Israeli settlements ²⁷. No public evidence identified of regulatory inquiries, export-control actions, or sanctions investigations involving Costa Coffee’s technology sales or services to Israeli state entities.

End Notes