Digital Audit: Tripadvisor, Inc.

Audit Phase: Digital (Digital / Technology Forensics) Subject Entity: Tripadvisor, Inc. (Nasdaq: TRIP) Registered/Principal Office: 400 1st Avenue, Needham, Massachusetts 02494, United States Audit Date: June 2026 Evidence Base: Company SEC disclosures and investor communications, vendor case studies and press releases, technology and trade press, and NGO research. All factual claims are drawn from publicly available sources cited in the End Notes.

Scope and directionality note: Digital assesses the digital/technology nexus to Israel. The serious case is the provision of surveillance, digital, data, or cyber technology to the Israeli state, military, or security services. The reverse direction - Tripadvisor procuring technology from Israeli-origin vendors - is a customer relationship and is recorded explicitly as such, weighted far lower than provision. No transitive guilt is imputed: an Israeli vendor’s other clients, its founders’ military backgrounds, or a parent group’s separate activities are not attributed to Tripadvisor. US-entity relationships (e.g. Amazon Web Services, OpenAI) are not Israeli-origin and are noted only for completeness. Tripadvisor’s own digital platform listing of businesses located in Israeli settlements is recorded as a platform/digital-operations matter where it surfaced, but the substantive settlement-economy analysis sits in Economic; this audit records the digital-platform dimension only.

Corporate-status correction: Tripadvisor, Inc. remains a publicly traded company. On 19 December 2024 Tripadvisor and Liberty TripAdvisor Holdings announced a merger (aggregate value ~US$435m) under which Tripadvisor acquired Liberty TripAdvisor, ending Liberty’s controlling stake; the transaction closed in 2025 and Tripadvisor reincorporated from Delaware to Nevada.¹² Tripadvisor continued filing with the SEC, including a Form 10-K for fiscal year 2025 filed 13 February 2026 (signed by CEO Matt Goldberg and CFO Michael Noonan).³ The company was not taken private; it operates three reporting segments - Brand Tripadvisor, Viator, and TheFork.⁴

Enterprise Technology Stack & Vendor Relationships

General Stack (Direction: Tripadvisor as customer)

Tripadvisor’s principal disclosed cloud and data infrastructure runs on Amazon Web Services (a US entity). A 2025 ScyllaDB engineering case study, co-published with Tripadvisor engineers, documents a stack built on AWS - including Amazon EKS (Kubernetes), AWS ECS Fargate, Amazon Kinesis, and EC2 - with Redis for static features and an offline data warehouse for ML training.⁵ The same case study describes a real-time feature store serving Tripadvisor’s personalization models at a reported scale of more than 2 billion requests per day across an EC2-hosted six-node cluster.⁵ None of the named US-origin components (AWS, Redis, Kubernetes, Apache Spark, Kubeflow, MLflow, Seldon Core, Prometheus, Grafana) is an Israeli-origin vendor.⁵

Israeli-Origin Technology Vendors in the Tripadvisor Stack (Direction: Tripadvisor as customer)

ScyllaDB - Tripadvisor publicly documents ScyllaDB as the NoSQL database powering its real-time personalization feature store.⁵ ScyllaDB began in November 2014 as the Israeli startup Cloudius Systems, founded by Dor Laor and Avi Kivity, and maintains an R&D presence in Herzliya, Israel; the corporate entity ScyllaDB, Inc. is headquartered in Palo Alto, California.⁶⁷ This is a procurement (inbound) relationship: Tripadvisor is the customer of a commercial database product. It does not involve Tripadvisor supplying technology, data, or services to any Israeli entity.

Israeli-Origin Cybersecurity Vendors

No public evidence was independently identified confirming that Tripadvisor holds a licensing, subscription, or integration relationship with any Israeli-origin cybersecurity vendor - including Check Point, Wiz, CyberArk, SentinelOne, Claroty, Verint, or NICE. These are documented as Israeli-founded firms, but none was linked to Tripadvisor’s environment in any independently sourced record reviewed. No public evidence identified.

Advertising and Recommendation Technology Sub-Vendors

Tripadvisor’s AI semantic-search and recommendation layer is documented as using Qdrant, a vector database; Qdrant is a Berlin, Germany-headquartered company founded in 2020 by Andre Zayarni and Andrey Vasnetsov, not an Israeli-origin vendor.⁸⁹ No public evidence was identified linking Tripadvisor or its Viator and TheFork subsidiaries to Israeli-origin adtech vendors (e.g. Taboola, Outbrain). Programmatic advertising sub-vendor chains are not fully disclosed and remain a non-auditable layer from public sources alone. No public evidence identified of a confirmed Israeli-origin adtech relationship.

Procurement Transparency Constraints

Tripadvisor’s SEC filings address technology risk at a generic level and do not enumerate a full IT or security vendor stack. Vendor relationships below the level of named, publicly documented engagements (such as the ScyllaDB and Qdrant case studies) are not in the public domain. This is the principal evidence gap in this domain.

Surveillance, Biometrics & Retail Technology

Business Model Context

Tripadvisor operates as an online travel-guidance, review, and booking platform. It does not operate physical retail stores, warehouses, or consumer-facing physical premises of the type that typically deploy facial recognition, gait analysis, or shelf analytics. This structurally constrains the plausibility of physical-surveillance technology relationships.⁴

Facial Recognition & Biometrics

No public evidence was identified that Tripadvisor deploys facial-recognition, biometric, or gait-analysis technology of Israeli origin (e.g. Oosto/AnyVision, BriefCam, Corsight), or that it operates any such system at all. No public evidence identified.

No public evidence was identified of Tripadvisor using Israeli-origin predictive-analytics, sentiment-analysis, social-media-monitoring, or workforce-surveillance tools.

Platform Content Moderation & Review Integrity Systems

Tripadvisor operates fraud-detection and content-moderation systems to police fake reviews on its user-generated-content platform.⁴ No public evidence was identified that these systems are sourced from Israeli-origin vendors, or that they are provided to or shared with any Israeli state body. No public evidence identified.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data Centre Operations in Israel

No public evidence was identified that Tripadvisor operates, leases, or co-locates data-centre infrastructure within Israel. Tripadvisor’s disclosed cloud strategy centres on Amazon Web Services (a US-entity relationship).⁵

Project Nimbus & Israeli State Cloud Infrastructure

Not applicable. Project Nimbus is the Israeli-government cloud contract awarded to Google Cloud and Amazon Web Services; Tripadvisor is neither a participant nor a sub-provider. No public evidence was identified of Tripadvisor involvement in any Israeli state-backed digital-infrastructure programme. No public evidence identified.

Data-Sovereignty or Resilience Services to Israeli State Institutions

No public evidence identified. Tripadvisor does not operate as a technology or cloud-service provider to any state body, Israeli or otherwise.

Customer-Data Handling in Israel

Tripadvisor and its Viator and TheFork marketplaces process bookings for businesses located in Israel and in Israeli settlements (see Civil Society Scrutiny, below).¹⁰¹¹ Whether this entails any data-residency arrangement, local data centre, or data-sharing with Israeli authorities is not publicly documented; this is recorded as an unresolved line of inquiry rather than a finding. No public evidence identified of data provision to Israeli state institutions.

Defence, Intelligence & Security Sector Technology Relationships

Military & Intelligence Contracts

No public evidence was identified of any contract, partnership, or service agreement between Tripadvisor and the Israeli Ministry of Defence, the Israel Defense Forces (IDF), or Israeli intelligence agencies (including Unit 8200-linked commercial entities). Tripadvisor is a travel-platform business and does not publicly operate in the defence-technology or security-services sector. No public evidence identified.

Provision of Technology / Data to the Israeli State or Military

No public evidence was identified of Tripadvisor providing surveillance technology, data, software, cloud capacity, or digital services to the Israeli state, military, or security services. This is the directionally serious Digital case, and no qualifying evidence of it was found. No public evidence identified.

Dual-Use Technology Provision

No public evidence was identified of Tripadvisor commercial technology being reported or confirmed as deployed for military, intelligence, or law-enforcement surveillance applications in Israel or the Occupied Palestinian Territories. No public evidence identified.

Offensive Cyber Capability

No public evidence identified. Tripadvisor does not develop, license, or sell offensive cyber capability. Tripadvisor has itself been the target of cyber incidents: it disclosed an email-address breach to members in March 2016,¹² and its Viator subsidiary suffered a payment-card data breach reported in 2014 affecting approximately 1.4 million customers, of whom around 880,000 had names, billing addresses, email addresses, and encrypted card details exposed.¹³ These incidents were done to Tripadvisor and have no nexus to the provision of technology to Israel; they are recorded here as factual digital context only.

AI, Algorithmic & Autonomous Systems

AI/ML Provision to Israeli State Bodies

No public evidence identified. Tripadvisor deploys AI/ML for personalization, semantic search, and itinerary generation, primarily via US-origin (OpenAI) and German-origin (Qdrant) providers and AWS infrastructure;⁵⁸¹⁴ no public evidence was identified of Tripadvisor providing AI capability, model access, training data, or inference services to any Israeli state, military, or security body.

AI Trip-Planning and Generative Features

Tripadvisor launched an AI-powered trip-planning product in July 2023 that uses OpenAI’s generative AI technology (a US entity) and draws on its corpus of over a billion reviews; it released an improved AI trip builder in August 2024.¹⁴¹⁵ Its semantic-search engine uses Qdrant vector search.⁸ None of the named AI providers is Israeli-origin. No public evidence identified of an Israeli-origin AI vendor in Tripadvisor’s generative-AI stack.

Training Data & Model Development Involving Israeli Population Data

No public evidence was identified of Tripadvisor contributing to, commissioning, or benefiting from AI model development involving Israeli population datasets.

Autonomous Systems & Lethality

No public evidence identified. The development or deployment of autonomous lethal systems is not within Tripadvisor’s business domain.

Technology Ecosystem & R&D Footprint

Israeli R&D Facilities

No public evidence was identified that Tripadvisor operates any R&D facility, engineering office, innovation lab, or accelerator programme within Israel. Tripadvisor’s documented engineering presence centres on the United States and Europe.⁴ No public evidence identified.

Acquisitions & Investments in Israeli Technology Companies

No public evidence was identified of Tripadvisor acquiring, or taking a corporate-venture stake in, any Israeli technology company. Tripadvisor’s documented acquisitions include Viator, SinglePlatform, Bokun (an Icelandic tours-software provider), and others - none identified as Israeli-founded.¹⁶ The Israeli-origin vendor identified in this audit (ScyllaDB) is a commercial software supplier, not a Tripadvisor investment. No public evidence identified.

Patents & IP Co-Development with Israeli Institutions

No public evidence was identified of patent portfolios, licensing, or co-development arrangements between Tripadvisor and Israeli-domiciled entities or research institutions (Technion, Hebrew University, Weizmann Institute). No public evidence identified.

Supplier Code of Conduct - Technology Supply-Chain Provisions

No public evidence was identified that Tripadvisor maintains a technology-supply-chain due-diligence framework specifically governing the national origin or geopolitical exposure of software vendors, AI providers, or digital-infrastructure suppliers. No public evidence identified.

Civil Society Scrutiny & Regulatory History

NGO Scrutiny - Digital Platform Listing Settlement Businesses

Tripadvisor’s digital platform has been the subject of sustained NGO scrutiny for listing and facilitating bookings of businesses located in illegal Israeli settlements. In January 2019 Amnesty International published “Destination: Occupation,” finding that Tripadvisor (alongside Airbnb, Booking.com, and Expedia) listed tourist accommodation, activities, and attractions in settlements; Amnesty reported Tripadvisor as hosting more than 70 such listings and called on the company to remove them.¹⁰¹⁷ Tripadvisor responded that it aims to present an “apolitical, accurate and useful” picture of all open businesses and does not remove listings of active businesses, asserting this aligns with travel-industry standards.¹⁷

The Who Profits Research Center lists Tripadvisor under “Settlement Enterprise” and “Services to the Settlements,” documenting (last updated April 2024) listings in eight West Bank settlements (including Ariel, Ma’ale Adumim, and Kfar Etzion) and ten settlements in the occupied Golan, and noting its Viator subsidiary’s booking service for tours in occupied East Jerusalem.¹¹ AFSC Investigate similarly lists Tripadvisor under “Settlement Industry,” stating its platform (including Viator) advertises at least 70 attractions, tours, restaurants, hotels, and rental apartments across illegal settlements in the West Bank and Golan and acts as a commission-collecting booking agent.¹⁸ The substantive settlement-economy analysis sits in Economic; this audit records only that the matter concerns Tripadvisor’s own digital platform operations rather than provision of technology to the Israeli state.

BDS / Campaign Scrutiny

Tripadvisor has been the subject of campaign attention tied to the Amnesty “Destination: Occupation” findings and the NGO listings above.¹⁷¹⁸ The publicly documented grounds relate to its platform’s listing of settlement businesses, not to Israeli-origin technology procurement, software licensing, or digital-infrastructure provision. No public evidence was identified of a campaign specifically targeting Tripadvisor’s technology vendor relationships.

Regulatory History - Review Platform & Data Protection

Tripadvisor operates a user-generated-review platform and has faced general regulatory attention to the online-reviews sector; the US Federal Trade Commission’s Consumer Review Rule (finalised August 2024) regulates fake and deceptive reviews across the industry.¹⁹ No public evidence was identified of a specific FTC, ICO, or CMA enforcement action against Tripadvisor connected to any Israeli-origin technology relationship. No public evidence identified.

Export Controls & Sanctions Authorities

No public evidence was identified of any action by US or other export-control authorities, OFAC, or equivalent bodies relating to Tripadvisor technology sales, services, or data transfers to Israeli state entities. No public evidence identified.