Technical audit · 2026-05-29

bulgartransgaz.bg

Gas Transmission System Operator of Bulgaria

Bulgartransgaz — the operator of Bulgaria's gas transmission system — 33 requests, a single domain. All resources, including fonts, are hosted locally; there are no external calls, trackers, or cookies. For an operator of critical energy infrastructure, this is the correct approach. No violations have been recorded.

Timeline of the leak

+0 ms · portal load
All resources — HTML, stylesheets, scripts, fonts (woff2), images — are served from the first-party domain bulgartransgaz.bg (Bulgarian hosting).
no third-party calls
Analytics, Google, third-party CDN fonts and scripts, advertising, and session recording are absent from the capture.

Declared versus actual

A 'Notice on the Protection of Personal Data of Counterparties' was provided (processing of counterparties' data, not the site's cookie policy) — declared

Context

bulgartransgaz.bg is the website of Bulgartransgaz EAD, the state operator of Bulgaria’s gas transmission system and underground gas storage facilities, a critical energy infrastructure asset. The data controller is Bulgartransgaz EAD. The document provided — “Известие за поверителност и защита на личните данни до контрагенти” (Notice on Privacy and Personal Data Protection for Counterparties) — is a notice concerning the processing of counterparties’ data, not the site’s cookie policy. Capture: 33 requests, a single domain, recorded in a clean browser.

Declared versus Actual

The capture reveals a fully self-sufficient page. All resources — markup, stylesheets, scripts, fonts, and images — load from the first-party domain bulgartransgaz.bg; fonts (in woff2 format) are hosted locally. There are no external domains present in the capture whatsoever: no analytics, no Google, no third-party CDNs, no advertising pixels, no session recording. Inspection of the first-party domain’s paths revealed no hidden analytics or build endpoints. No cookies are set (Set-Cookie is zero).

The document provided is addressed to counterparties and describes the processing of their personal data within the framework of contractual relationships; it does not substitute for a separate cookie policy for the site. Since there is no third-party processing on the page, no discrepancy between “declared” and “actual” substantively arises.

All calls go to the site’s own domain. There are no third-party resources on the page requiring consent; no cookies are set. For an operator of critical infrastructure, minimizing external dependencies is the correct approach.

What Cannot Be Asserted from This Capture

The capture covers the home page. Internal and secured sections of the platform (capacity data, auctions) may involve additional server-side processing that a browser-based capture does not cover. A separate cookie policy for the site was not provided as part of this package; since there are no third-party trackers, this does not affect the assessment of the capture. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of Bulgaria’s gas transmission system operator is implemented cleanly: all resources, including fonts, are hosted locally on the site’s own domain, there are no external calls whatsoever, and trackers and cookies are absent. For a critical energy infrastructure asset, the absence of external dependencies is particularly fitting. No violations have been recorded in the capture.

Evidence
Original (audit)
HAR file: bg/bulgartransgaz-bg-2026-05-29.har
SHA-256: e58c09eb16f20fe99641e6653403ff9f9fc8213ec1dabc8520042788ffde4089
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.