Digital Audit: J Sainsbury plc (Sainsbury’s)

Audit Phase: Digital (Digital / Technology Forensics) Subject Entity: J Sainsbury plc (LSE: SBRY) Registered Address: 33 Holborn, London EC1N 2HT, United Kingdom Audit Date: June 2026 Evidence Base: Published corporate disclosures, vendor press releases, trade and technology press, NGO research, and regulatory/biometric-policy reporting. All factual claims are drawn from publicly available sources cited in the End Notes.

Scope and directionality note: Digital assesses the digital/technology nexus to Israel. The serious case is the provision of surveillance, digital, data, or cyber technology to the Israeli state, military, or security services. The reverse direction - Sainsbury’s procuring technology from Israeli-origin vendors - is a customer relationship and is recorded explicitly as such, weighted far lower than provision. No transitive guilt is imputed: an Israeli vendor’s other clients, its founders’ military backgrounds, or a parent group’s separate activities are not attributed to Sainsbury’s. US-entity relationships (e.g. Microsoft, Google, Amazon, NCR Voyix, Snowflake) are not Israeli-origin and are noted only for completeness. A cyberattack carried out against the company is not a provision of technology.

Enterprise Technology Stack & Vendor Relationships

Strategic Technology Partnerships (Direction: Sainsbury’s as customer)

Sainsbury’s principal disclosed enterprise technology relationship is with Microsoft, a US-headquartered entity. In May 2024 Sainsbury’s announced a five-year strategic partnership with Microsoft to use Microsoft Azure, Microsoft 365 collaboration tools, generative AI, and machine learning across customer experience, store operations (including data from shelf-edge cameras for replenishment), and business intelligence, with the stated goal of becoming “the UK’s leading AI-enabled grocer.”¹² Clodagh Moriarty, Sainsbury’s Chief Retail and Technology Officer, and Clare Barclay, then CEO of Microsoft UK, were quoted on the launch.¹ The contract is with the US parent entity; this is not an Israeli-origin vendor relationship and is recorded for completeness only.¹

Sainsbury’s also operates a Snowflake-on-AWS data platform as the cornerstone of its data transformation, consolidating multiple legacy systems into a single data warehouse; Snowflake (US-origin, NYSE: SNOW) and Amazon Web Services (US-origin) are both US entities.³ Sainsbury’s loyalty and retail-media arm Nectar360 uses Google Cloud Platform and Google Marketing Platform technologies (a US-entity relationship), with Accenture named as a systems-integration partner implementing machine-learning processes on GCP.⁴⁵ In August 2024 Sainsbury’s signed a seven-year agreement with NCR Voyix (US-origin, headquartered in Atlanta, Georgia) - extending a 20-plus-year relationship - to deploy its cloud Commerce Platform, point-of-sale, and next-generation self-checkout systems across 22,500 checkouts.⁶⁷ None of these disclosed relationships names an Israeli-origin sub-vendor, integration, or mandated technology component.¹³⁶

Israeli-Origin Technology Vendors in the Sainsbury’s Stack (Direction: Sainsbury’s as customer)

No public evidence identified. No public source reviewed documents Sainsbury’s procuring a commercial product from a named Israeli-origin technology vendor. (This contrasts with peer retailers; the audit searched for but did not find any equivalent confirmed Sainsbury’s–Israeli-vendor procurement relationship.)

Israeli-Origin Cybersecurity Vendors

No public evidence was independently identified confirming that Sainsbury’s holds a licensing, subscription, or integration relationship with any Israeli-origin cybersecurity vendor - including Check Point, Wiz, CyberArk, SentinelOne, Claroty, Verint, or NICE Systems. General reporting confirms several of these are Israeli-founded firms,⁸ but none was linked to Sainsbury’s environment in any independently sourced record reviewed. Palo Alto Networks, although co-founded by an Israeli national, is a US-domiciled Delaware company and is not an Israeli-origin entity; no Sainsbury’s relationship with it was identified either. No public evidence identified.

Procurement Transparency Constraints

Sainsbury’s is a private-sector company not subject to UK public-procurement disclosure obligations. Vendor relationships below the level of named, publicly announced partnerships are not in the public domain, and the full security/IT vendor stack is undisclosed. This is the principal evidence gap in this domain.

Surveillance, Biometrics & Retail Technology

Live Facial Recognition - In-Store Deployment (Facewatch, UK-origin vendor)

On 2 September 2025 Sainsbury’s announced an eight-week trial of live facial recognition (LFR) in two stores - its Sydenham superstore in south-east London and an Oldfield Park Sainsbury’s Local in Bath - using technology supplied by Facewatch.⁹¹⁰ The system scans shoppers on entry and compares faces against a watchlist of individuals previously reported for theft, aggression, or violence, alerting staff within about a minute on a match.⁹¹⁰ Sainsbury’s Chief Executive Simon Roberts was quoted on the launch.¹⁰ In January 2026 Sainsbury’s reported a 46% reduction in logged incidents and said 92% of flagged offenders did not return, and expanded the deployment to six stores (Sydenham plus Greater London sites including Dalston, Elephant and Castle, Ladbroke Grove, Camden and Whitechapel), citing a claimed 99.98% accuracy.¹¹ In February 2026 a shopper, Warren Rajah, was wrongly approached and ejected from the Elephant and Castle store after a Facewatch alert; Sainsbury’s stated this was “not an issue with the facial recognition technology in use but a case of the wrong person being approached in store.”¹¹

Facewatch is a UK company, founded in London in 2010 by Simon Gordon (owner of Gordon’s Wine Bar), and describes itself as a UK retail LFR provider.¹²¹³ This is a procurement (inbound) relationship - Sainsbury’s as customer of a UK-origin vendor - with no Israel nexus; no public source identifies any Israeli-origin technology within the Facewatch system or the Sainsbury’s deployment.⁹¹⁰¹¹¹²

Facial Recognition - UK Domestic Policing (Project Pegasus)

Sainsbury’s is named as a participant/funder of Project Pegasus, a UK Home Office / policing retail-crime initiative launched in October 2023 under which retailers share CCTV footage with police, who run retrospective facial recognition against the Police National Database to identify offenders.¹⁴¹⁵¹⁶ Reporting names Sainsbury’s alongside John Lewis, Co-op, Tesco, Waitrose and Next, with the retailer-funded element reported at around £600,000.¹⁵¹⁶ Project Pegasus is a UK domestic law-enforcement programme with no Israel nexus; the matching is performed by police, and primary reporting identifies no Israeli-origin vendor in the scheme (criticism in coverage related to the UK firm Facewatch, not an Israeli company).¹⁴¹⁶ No provision of any technology, data, or service to Israel arises from Sainsbury’s participation.¹⁴¹⁶

Israeli-Origin Surveillance / Biometric Vendors

No public evidence was identified that Sainsbury’s has deployed facial-recognition, biometric, gait-analysis, or in-store behavioural-analytics technology of Israeli origin (e.g. Oosto/AnyVision, BriefCam, Trigo, Trax). Israeli retail-tech firms such as Trigo are documented with other European clients (e.g. Tesco in the UK, Aldi Nord, REWE, Shufersal in Israel), but no public source links any of them to Sainsbury’s.¹⁷ No public evidence identified.

No public evidence was identified of Sainsbury’s using Israeli-origin predictive-analytics, sentiment-analysis, social-media-monitoring, or workforce-surveillance tools. Sainsbury’s disclosed analytics activity is focused on customer personalisation (Nectar/Nectar360), demand forecasting, supply-chain optimisation, and pricing - internal retail applications.⁴⁵

Third-Party Loss Prevention & Store-Level CCTV Analytics

Beyond the disclosed Facewatch (UK) deployment, third-party loss-prevention or CCTV-analytics sub-contractors used at store level are not publicly disclosed, and it cannot be confirmed or excluded from public evidence whether any such sub-contractor deploys Israeli-origin technology within its own platform. No public evidence identified linking any to Sainsbury’s.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data Centre Operations in Israel

No public evidence was identified that Sainsbury’s operates, leases, or co-locates data-centre infrastructure within Israel. Sainsbury’s is a UK-domiciled grocery and general-merchandise retailer with no publicly disclosed retail, commercial, or digital operations in Israel; its disclosed cloud strategy centres on Microsoft Azure, Google Cloud, and Snowflake-on-AWS (all US-entity relationships) with UK/EU-region operations.¹³⁴

Project Nimbus & Israeli State Cloud Infrastructure

Not applicable. Project Nimbus is the Israeli-government cloud contract awarded to Google Cloud and Amazon Web Services; Sainsbury’s is neither a participant nor a sub-provider.¹⁸ No public evidence was identified of Sainsbury’s involvement in any Israeli state-backed digital-infrastructure programme.

Data-Sovereignty or Resilience Services to Israeli State Institutions

No public evidence identified. Sainsbury’s does not operate as a technology or cloud-service provider to any state body, Israeli or otherwise. No evidence was identified of Sainsbury’s customer or operational data being routed through, stored in, or processed within Israeli-domiciled infrastructure.

Sainsbury’s Bank - Technology Stack (Indirect/Unresolved)

Sainsbury’s Bank operated separate financial-technology infrastructure (the core banking and lending business was transferred to NatWest under an agreement first announced in 2024, with a further partnership update in April 2026).¹⁹ Specific vendors for that infrastructure (fraud detection, AML) are not publicly disclosed; whether any were Israeli-origin cannot be confirmed or excluded from public sources, and the status of any such relationship post-transfer is undocumented. This is recorded as an unresolved indirect-exposure question, not a finding. No public evidence identified.

Defence, Intelligence & Security Sector Technology Relationships

Military & Intelligence Contracts

No public evidence was identified of any contract, partnership, or service agreement between Sainsbury’s and the Israeli Ministry of Defence, the Israel Defense Forces (IDF), or Israeli intelligence agencies (including Unit 8200-linked commercial entities). Sainsbury’s is a retail and food business and does not publicly operate in the defence-technology or security-services sector.

Provision of Technology / Data to the Israeli State or Military

No public evidence was identified of Sainsbury’s providing surveillance technology, data, software, cloud capacity, or digital services to the Israeli state, military, or security services. This is the directionally serious Digital case, and no qualifying evidence of it was found. No public evidence identified.

Dual-Use Technology Provision

No public evidence was identified of Sainsbury’s commercial technology being reported or confirmed as deployed for military, intelligence, or law-enforcement surveillance applications in Israel or the Occupied Palestinian Territories.

Offensive Cyber Capability

No public evidence identified. Sainsbury’s does not develop, license, or sell offensive cyber capability. Sainsbury’s was affected in November 2024 by a ransomware attack carried out against its US-origin supply-chain software supplier Blue Yonder (claimed by the “Termite” group), which caused operational disruption; Sainsbury’s said it activated contingency plans to mitigate impact.²⁰ Sainsbury’s was also affected by the 2021 ransomware attack on the US payroll/workforce-management vendor Kronos.²⁰ These incidents were done to suppliers and have no nexus to the provision of technology to Israel; they are recorded as factual digital context only.

AI, Algorithmic & Autonomous Systems

AI/ML Provision to Israeli State Bodies

No public evidence identified. Sainsbury’s deploys AI/ML internally (demand forecasting, personalisation, supply-chain optimisation, self-checkout analytics) primarily via Microsoft Azure, Google Cloud, and NCR Voyix systems (all US-entity relationships);¹⁴⁶ no public evidence was identified of Sainsbury’s providing AI capability, model access, training data, or inference services to any Israeli state, military, or security body.

Training Data & Model Development Involving Israeli Population Data

No public evidence was identified of Sainsbury’s contributing to, commissioning, or benefiting from AI model development involving Israeli population datasets, intercepted communications, or surveillance-derived data.

Autonomous Systems & Lethality

No public evidence identified. The development or deployment of autonomous lethal systems is not within Sainsbury’s business domain.

Internal Algorithmic Deployment - Israeli-Origin AI Tooling

Sainsbury’s documented internal AI deployment runs through US-entity platforms (Microsoft Azure, Google Cloud, NCR Voyix, Snowflake).¹³⁴⁶ No public evidence was identified of any Israeli-origin AI vendor embedded in Sainsbury’s stack; the undisclosed full vendor list means secondary embedding within managed services cannot be positively excluded, but no such instance was identified.

Technology Ecosystem & R&D Footprint

Israeli R&D Facilities

No public evidence was identified that Sainsbury’s operates any R&D facility, engineering office, innovation lab, or accelerator programme within Israel. Sainsbury’s technology and engineering functions are publicly documented as UK-based, centred on its London headquarters.¹³

Acquisitions & Investments in Israeli Technology Companies

No public evidence was identified of Sainsbury’s acquiring, or taking a corporate-venture stake in, any Israeli technology company. No public evidence identified of an Israeli-registered Sainsbury’s subsidiary or holding structure.

Patents & IP Co-Development with Israeli Institutions

No public evidence was identified of patent portfolios, licensing, or co-development arrangements between Sainsbury’s and Israeli-domiciled entities or research institutions (Technion, Hebrew University, Weizmann Institute).

Supplier Code of Conduct - Technology Supply-Chain Provisions

Sainsbury’s responsible-sourcing and Modern Slavery Act frameworks address ethical obligations for its product supply chain but do not, in public versions reviewed, contain provisions governing the national origin or geopolitical exposure of technology vendors, software suppliers, or digital-infrastructure providers.²¹ No technology-supply-chain due-diligence framework specific to vendor geopolitical exposure is publicly documented by Sainsbury’s.

Civil Society Scrutiny & Regulatory History

NGO & Academic Scrutiny - Technology Supply Chain

No public evidence was identified of an NGO investigation, academic study, or UN report addressing Sainsbury’s technology relationships with the Israeli state, Israeli defence entities, or Israeli-origin vendors. Civil-society attention on Sainsbury’s in relation to Israel has historically centred on its retail sourcing of Israeli and settlement-linked produce (the Economic domain) - for example Corporate Watch and Who Profits research on suppliers such as Mehadrin and Edom - not on technology procurement.²²²³

Live Facial Recognition - Civil-Society Opposition

Big Brother Watch publicly opposed Sainsbury’s 2025 LFR trial, calling it “deeply disproportionate and chilling” and “Orwellian,” citing watchlist due-process concerns and documented misidentification cases, and urged Sainsbury’s to abandon it.⁹²⁴ This scrutiny concerns Sainsbury’s domestic UK use of a UK-origin (Facewatch) surveillance product and has no Israel nexus.⁹²⁴

BDS Campaigns

Sainsbury’s has been a subject of UK BDS/Palestine-solidarity campaigning, including the long-running “Taste the Indifference” campaign and calls (e.g. by War on Want and Corporate Watch) to cease trade with Israeli agricultural firms operating in settlements.²²²³ The publicly documented grounds relate to Sainsbury’s retail sourcing of Israeli/settlement produce, not to Israeli-origin technology procurement, software licensing, or digital-infrastructure provision. No public evidence was identified of a BDS or NGO campaign specifically targeting Sainsbury’s technology relationships.

ICO - Biometric / Facial Recognition

The UK Information Commissioner’s Office (ICO) examined Facewatch’s LFR system and, after the firm made improvements, closed its inspection concluding no regulatory action was required and that Facewatch had a legitimate crime-prevention purpose.²⁵ Sainsbury’s was not identified as a separate subject of ICO biometric enforcement; it is registered as a data controller in its standard capacity as a large UK retailer.²⁵ This regulatory history concerns domestic UK biometric data protection and has no Israel nexus.

Export Controls & Sanctions Authorities

No public evidence was identified of any action by UK export-control authorities, HMRC, the Office of Financial Sanctions Implementation (OFSI), or any equivalent body relating to Sainsbury’s technology sales, services, or data transfers to Israeli state entities. No public evidence identified.

Regulatory & Legal Actions - Technology Sales to Israeli State Entities

No public evidence identified of any ICO, FCA, CMA, HMRC, export-control, or sanctions-body action relating to Sainsbury’s technology sales or services to Israeli state entities.