Technical audit · 2026-05-26

ages.at

Austrian Agency for Health and Food Safety

Austrian health agency — 36 requests, 3 domains. Piwik on a proprietary subdomain webstatistik.ages.at. Chatbottery (an Austrian company) not mentioned in the policy as a recipient — the only shortcoming. One of the cleanest results in the Austrian series.

Timeline of the leak

+502 ms · on load
web-runtime.chatbottery.com — chatbot widget. Chatbottery GmbH, Linz, Austria.
+734 ms · on load
webstatistik.ages.at/piwik/piwik.js — Piwik on a proprietary subdomain. Data stays within AGES.

Declared versus actual

+ Chatbottery (web-runtime.chatbottery.com) — не заявлен

Transfer timings

+502 ms web-runtime.chatbottery.com

Chatbottery — chatbot. Austria

+734 ms webstatistik.ages.at

Self-hosted Piwik on an AGES subdomain

Detected trackers

Context

AGES (Österreichische Agentur für Gesundheit und Ernährungssicherheit GmbH) is the Austrian state agency for health and food safety. Responsible for monitoring food products, medicinal products, and infectious diseases. DPO — datenschutz@ages.at. The policy is in German. HAR: 36 requests, 3 domains.

Piwik on a proprietary subdomain

webstatistik.ages.at/piwik/ — Piwik (the predecessor of Matomo) on a proprietary subdomain. Analytics data stays within AGES’s infrastructure. The same principle as the Matomo setup at EBA and eu-LISA — analytics without transferring data to third parties. Two requests per session: piwik.js and the piwik.php pageview call.

Chatbottery — an Austrian company, not mentioned

web-runtime.chatbottery.com (+502 ms) — the Chatbottery GmbH (Linz, Österreich) chatbot platform. Loads a chatbot widget in the bottom-right corner. An Austrian company — data stays within the EU. However, AGES’s privacy policy does not mention chatbottery.com as a data recipient. Visitors’ IP addresses are transmitted to Chatbottery on every page load.

Policy — detailed, in German

The AGES Datenschutzerklärung is detailed: it describes categories of data (Bestands-, Kunden-, Kontakt-, Auftrags-, Gesundheits- und Kommunikationsdaten), legal bases, data subject rights, and DPO contact. It states that data is processed exclusively where a legal basis exists. Chatbottery is absent from the list of recipients.

Conclusion

AGES is one of the cleanest results in the Austrian series. Self-hosted Piwik, zero Google Analytics, zero external advertising services. The only issue: Chatbottery is not mentioned in the privacy policy as a data recipient.

Evidence
Original (audit)
HAR file: at/ages-at-2026-05-26.har
SHA-256: 965b73bb2d9ac9cb4c8f4db425443008b26ec89fe30f5e036582ff251527b25f
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.