Eight /24s and a Promise: The Accountability Test for BGOcloud

Summary

• BGO Cloud OOD is the Bulgarian legal entity behind the BGOcloud brand and AS200628, but a buyer must explicitly state this company name on the purchase order and invoice rather than relying on brand continuity.
• AS200628 visibly originates eight RPKI-valid /24 IPv4 blocks through a single observed upstream and no IPv6 prefix; this is significant evidence of routing control, not evidence of traffic, redundancy, server ownership, customer count, or a particular datacenter location.
• BGOcloud's low prices are made possible in part by annual prepayment, third-party software, a limited inventory of public addresses, and a substantial transfer of administration, firewall, backup, and application monitoring tasks to VPS and dedicated server customers.
• The decisive procurement question is not whether a small Bulgarian host can beat a hyperscaler feature-for-feature. It is whether BGOcloud can turn local human access into documented accountability for location, support, service credits, abuse handling, security, restoration, and exit.

Eight Blocks Wide

Cloud hosting is usually sold with images of unlimited capacity. BGOcloud is easier to see at ground level. The public Internet currently sees AS200628 originating eight IPv4 prefixes, each a /24. A /24 contains 256 numeric addresses, so the routed footprint is eight blocks, or 2,048 addresses before any deduction for network design, infrastructure, customer assignments, reserves, unused addresses. This number is not a valuation, a server count, or an inventory available for sale. It is a limit.

This limit is useful because BGOcloud's storefront makes expansive promises. Thehomepageoffers shared hosting, KVM and OpenVZ virtual servers, MikroTik cloud routers, OpenVPN, and dedicated machines. It advertises 99.9% uptime, free backups on shared plans, a 30-day money-back guarantee, and 24/7 support. These are commercial propositions. The routing table, on the other hand, shows which network announces reachability. No class of evidence can substitute for the other.

This distinction is the central test of this business. A small provider can be a rational choice precisely because it is small. A customer can reach someone who knows the machine, buy a configuration a global platform would not offer, pay a comprehensible monthly bill, and keep data close to a Bulgarian audience. But small scale also concentrates dependencies. A single upstream relationship can hide behind many product names. A handful of support engineers can be both the reason to buy and the capacity constraint.

A single contract can determine whether a customer gets useful recourse after a failure or merely a reassuring percentage before it.

BGOcloud should therefore not be judged as a miniature Amazon Web Services, and its autonomous system should not be mistaken for a miniature datacenter empire. It is better understood as an operations layer. It combines rented physical environment and connectivity, servers controlled or used by the company, licensed control-plane software, public address resources, and human support into packaged offerings. Its economy depends on cheaply assembling these layers. Its accountability depends on stating which layer it actually controls when something fails.

Public evidence confirms a real, ongoing hosting operation. It also leaves consequential questions unanswered. This is not an accusation. It is the normal condition when buying from a private infrastructure provider with modest disclosure obligations. The task of procurement is to convert unknowns into written answers before the low monthly price becomes a production dependency.

The Company Behind the Lowercase Brand

The entity in question is BGO Cloud OOD, not BGO Software, Telehouse, Telepoint, or any similarly named affiliate. Acompany registration from the Bulgarian registryidentifies BGO Cloud OOD, Bulgarian unique identification code 204482247, as an active limited liability company. Its registered activity includes development and maintenance of telecommunications and computer systems and software, cloud computing, IT and hosting services. The history of this registration begins with incorporation on 2 March 2017, and the current registered address is on the twelfth floor of Ring Tower, 251E Okolovrasten Pat, 1766 Sofia.

The operating brand is BGOcloud. The bridge between brand and company is stronger than a matching name. The RIPE-derived organisation data reproduced in theAS200628 registrationnames BGO Cloud OOD, repeats the company number 204482247 and the Ring Tower address, gives a bgocloud.com contact, and attaches this organisation to AS200628. BGOcloud's owncontact pagecalls Ring Tower its headquarters in Sofia and publishes the same public phone number used throughout the site. Together, the corporate, network, and site records link the brand and the network to the designated company with reasonable confidence.

The timeline still deserves attention. AS200628 was created in May 2015, nearly two years before the current legal entity was incorporated, while the current RIPE organisation entity was created in 2018. This does not invalidate the current link. Internet resources can be reassigned, sponsored, or ported into a later company. It means the ASN creation date should not be presented as the incorporation date of BGO Cloud OOD or as proof that the current company has operated the network continuously since 2015.

A2019 HostingAdvice interviewadds useful history but requires attribution. Ivan Angov described BGOcloud as a small spin-off that first served BGO Software's clients and later expanded; the article also referred to BGO Software as a parent company. This is executive testimony in a publication with an affiliate link disclosure, not a current corporate ownership record. It explains shared offices and BGO Software imagery on BGOcloud's contact page, but it does not authorise a researcher or buyer to treat the two companies as one. Any development, staffing, or financial capacity of BGO Software promised in a sale must be named in the order as a subcontractor, guarantor, or support provider, with the responsible legal party clearly indicated.

Thestandard terms of serviceare weaker on this point than the network registration. They refer to the contract as between the customer and "BGOcloud", give the Ring Tower address for notices, and reference services and third-party providers, but the visible text does not state the legal name, company number, or VAT number. This brand shortcut may be unproblematic in ordinary retail usage, especially if the payment invoice supplies the missing identity. For a professional customer, however, the invoice, purchase order, data processing agreement, and service schedule should all name BGO Cloud OOD. Accountability starts with knowing whom to notify, pay, and sue.

The contact page also lists addresses in Plovdiv and London. These lines do not prove that BGO Cloud OOD has branches, employees, servers, or regulated establishments in either location. The BGO Software imagery on the page itself makes the boundary more ambiguous. A buyer selecting a product marked "UK" should ask which legal entity owns or leases the server, which datacenter hosts it, which entity can access it, and whether BGO Cloud OOD remains the sole contracting party. A flag in a plan selector is a location claim, not a company registration.

The Product Scale is a Scale of Work

BGOcloud's catalogue looks like a progression from simplicity to control. In practice, it is also a progression in how much operational work is transferred from the provider to the customer.

At the low end, thecPanel shared hosting pageprices the Launch plan at $3.90 per month or $37.40 for a year, an effective $3.12 per month. It includes one website, ten gigabytes of disk, ten mailboxes, and a soft guide of 5,000 monthly visits. Higher tiers increase sites, storage, mailboxes, and the visit guide; the top displayed plan includes a dedicated address. BGOcloud states that the shared platform includes cPanel, RAID 10 SSD storage, Let's Encrypt certificates, backups, CloudLinux CageFS, and KernelCare. Here, the customer manages a site and mailbox configuration while the provider manages the shared operating environment.

TheKVM VPS pagestarts at two gigabytes of memory, two virtual cores, 50 gigabytes of RAID 10 storage, and two terabytes of traffic for $11.50 per month in the EU location. The page also lists UK variants and larger plans. Root access seems more product, but it is also more work. BGOcloud explicitly says all its VPS services are unmanaged: it provides the virtual environment, while the customer controls the guest and must have the skills to administer it. The support team says it does not have access to the virtual server. Backups are the customer's responsibility, and the page still describes a paid easier backup service as coming "soon".

TheMikroTik VPS pageis the most distinctive rung in the catalogue. A Basic plan at $6.90 per month includes one core, 512 megabytes of memory, 15 gigabytes of disk, 500 gigabytes of bandwidth, RouterOS 6 or 7, and a free licence. The Standard plan increases resources but keeps a free licence; a Licensed plan includes a P1 licence. Discounts for annual prepayment are significant: the dedicated MikroTik server at $109 per month is shown at $981 for 12 months, equivalent to three months saved. Provisioning is described as automatic, but applying the included paid licence may take a few hours after a support ticket. Recovery from a bad firewall rule may mean support reinstalls the virtual router and erases all settings. The product is therefore automated until it reaches precisely the failure state where human intervention matters.

TheOpenVPN pagesells a preconfigured virtual VPN server rather than a consumer VPN subscription. Its Basic plan lists one CPU, one gigabyte of memory, 15 gigabytes of disk, speed up to 20 Mbit/s, and "unlimited" bandwidth at $12.90 per month or $129.90 per year. The customer still owns the policy problem: users, certificates, routes, endpoint security, and recovery must be configured and managed. Encrypting a tunnel does not make the devices at either end trustworthy, and a 20 Mbit/s plan is a capacity choice, not a generic promise of fast remote work.

At the high end, thededicated servers pagestarts at $69 per month. One plan shown at $89 offers an eight-core Intel Xeon Silver, 16 gigabytes of memory, 400 gigabytes of disk, a 100 Mbit/s network port, unlimited transfer, and five usable IPv4 addresses. BGOcloud describes these as physical machines fully at the customer's disposal, not as assets transferred to the customer. It also calls them unmanaged, provides root access, does not provide a firewall, and leaves backup design to the customer. The page says configuration may be ready in 15 minutes while a general note says dedicated setup may take up to 24 hours. This range is not necessarily contradictory — standard and custom machines differ — but the order should state which promise applies.

The catalogue thus serves several workflows: a small business wanting email and WordPress without a server administrator; a developer wanting a cheap Linux guest; a network engineer wanting a Bulgarian virtual router or VPN hub; and a company wanting exclusive hardware without buying, hosting, and connecting it. The sales page makes these products look adjacent. Operationally, they distribute responsibility very differently. A buyer should choose based on the work they can do at 3 a.m., not the most resources they can afford.

An Assembled Stack, Not a Private Cloud

BGOcloud's technical architecture can be partially reconstructed, but it should not be embellished beyond the evidence. The shared service is a conventional hosting stack: Linux, cPanel, CloudLinux controls, SSD storage, web and mail services, TLS certificates, and a backup mechanism. The VPS product indicates KVM, meaning full hardware-assisted virtualisation with individual guest kernels. The MikroTik product runs Cloud Hosted Router on a virtual machine. Dedicated plans expose a physical operating system and root account. These are recognisable components, not proof of a proprietary cloud control plane.

The security function of a component is well defined. CloudLinux's ownCageFS documentationdescribes a virtualised file system that isolates each shared hosting user in a separate cage with its own system files and tools. This is a useful tenant separation at the operating system layer. It is not an independent audit of BGOcloud's configuration, and it does not protect an outdated WordPress plugin, a compromised admin password, a malicious mailbox rule, or a vulnerable application. KernelCare can reduce reboot pressure by applying live kernel patches, but patch policy, subscription status, and application maintenance remain separate questions.

KVM offers a stronger isolation model than a shared account, but BGOcloud's claim that a security problem in one VPS "cannot" affect others is too absolute as a general proposition. Hypervisor bugs, shared storage, management plane credentials, network configuration, and host capacity can all create common risk. The public page does not disclose KVM or host kernel versions, orchestration software, CPU contention policy, storage controller layout, snapshot design, or whether "RAID 10" describes local disks, a shared array, or another layer.

A competent buyer does not need to demand trade secrets; they should ask about failure domains that affect their service.

MikroTik adds a third-party licence and update dependency. The officialCloud Hosted Router documentationstates that the free licence is limited to 1 Mbit/s download per interface, P1 to 1 Gbit/s, P10 to 10 Gbit/s, and P-Unlimited has no imposed speed limit. It also states that licence management depends on a MikroTik account server, and a licence that cannot renew before expiry stops software updates and package changes while the router continues running. BGOcloud's plan therefore contains at least two control planes: the virtual machine under BGOcloud and the RouterOS entitlement under MikroTik. The buyer should know which MikroTik account owns the key and whether it can be transferred when the hosting relationship ends.

Other dependencies are directly stated in the terms. Domain registrations are resold through ResellerClub. cPanel is licensed software. Card payments and PayPal involve payment intermediaries. The terms reserve the possibility that third parties may make substantial changes to services and state that such a change does not itself entitle the customer to terminate. This is economically understandable for a reseller but commercially important: the low-cost bundle inherits supplier price increases, end-of-life decisions, and licence rules that BGO Cloud OOD does not control.

What is not visible counts as much as what is. There is no public architecture diagram showing host clusters, storage replication, management network separation, backup destination, capacity margin, or how EU and UK product locations are linked. There is no public API specification, infrastructure-as-code interface, auto-scaling system, or multi-zone construction. Calling a KVM guest "cloud" does not create these capabilities. BGOcloud may operate internal automation it does not publish, but a procurement decision should use the features promised in the order, not the features implied by the brand.

The Arithmetic Behind a Cheap Server

BGOcloud's prices make sense only if several scarce inputs are shared or tightly limited: server capital, rack space, power, transit, software licences, IPv4 addresses, and support labour. The product pages reveal how the company manages some of these costs.

Annual discounts attract cash and reduce churn. The Launch shared plan reduces a 12-month commitment by about one-fifth compared to twelve monthly payments. Several VPS and MikroTik offers use similar or larger discounts. Prepayment can fund capacity and reduce payment processing and per-customer support overhead. It also transfers risk to the buyer: if service quality disappoints after the first 30 days, the unused portion is governed by cancellation and term conditions, not a simple month-to-month exit.

Resource labels shape usage. Shared plans describe a monthly visit count as a soft guide and state that the service will not be shut down simply because it is exceeded. The terms, however, state that bandwidth and connection speed figures are maximums and allow restrictions when a client imposes excessive loads on servers, hardware, or support compared to similar users. "Unlimited" bandwidth therefore cannot mean infinite simultaneous capacity. It means no stated transfer quota, subject to physical ports, shared systems, and a judgment of acceptable use.

This is standard hosting economics, but the trigger and recourse path should be clearly written.

Public addresses are another cost centre. The site includes one IPv4 address in VPS and MikroTik plans, offers five usable addresses on a dedicated setup, and states that additional addresses cost $2 including VAT in theFAQ. Yet the MikroTik product FAQ says additional addresses cannot currently be added to that service. The terms state that the default primary address may change and cannot be transferred, while some plans include fixed addresses. These differences may reflect product-specific engineering or outdated copy. They also show why a customer should not build a licensing, whitelisting, or reputation system around an address until the order defines whether it is fixed.

The eight visible /24s place an outer boundary on the IPv4 space originating from AS200628 at the observation date, not on every address BGOcloud might use through a provider or on another network. Nonetheless, pooling public addresses into low-cost services creates an opportunity cost. A dedicated plan displaying five usable addresses consumes a larger share than a shared account behind a server address. The provider can respond with denser shared hosting, prudent justification for additional addresses, upstream space, renumbering, or price changes.

Customers experience this economy as address fees, tighter allocation policy, or an exit cost.

Support is the least visible input in a plan table. A $3.90 per month account cannot absorb many hours of senior engineering without cross-subsidy or limits. BGOcloud manages this by standardising shared hosting, leaving VPS and dedicated guests unmanaged, charging for certain technical interventions like IP-KVM work, and requiring tickets for manual licence or network changes. The company's differentiation is personal help, but its gross margin requires distinguishing helpful advice from administration done for the customer. The order should state which side of this line a requested task falls on and what it costs.

What AS200628 Proves

AS200628 is the strongest independent evidence that BGO Cloud OOD operates a real control face on the Internet. Thelive bgp.tools viewidentifies the company and website, marks the autonomous system as active, and observes eight originating /24 IPv4 blocks: 37.72.130.0/24, 77.76.2.0/24, 78.142.25.0/24, 78.142.61.0/24, 82.118.225.0/24, 83.222.184.0/24, 91.148.166.0/24, and 91.191.215.0/24. Each is shown with a valid route origin authorisation. Valid RPKI origin status is significant: it allows route origin validators to verify that the prefix holder has authorised AS200628 to originate the route.

This is a limited security fact. A valid ROA does not validate the entire AS path, does not prevent all route leaks, does not prove that BGOcloud validates routes received from others, does not secure DNS, does not encrypt traffic, and does not show that a server belongs to the company. It answers one question: is this origin authorised for this prefix under the observed ROA? The displayed answer for all eight routes is yes.

The same dashboard observes no originating IPv6 prefixes from AS200628 and a single current upstream, AS57344 Telehouse EAD.IPinfo's independent AS pagealso lists the eight IPv4 ranges, marks them RPKI valid, shows Telehouse as the only upstream, and finds no downstream networks. It estimates 691 hosted domain names across 226 addresses. This domain estimate corroborates active hosting use, but it is not a customer count. One customer can host many domains; parked, test, and provider domains can inflate the count; private services and domains behind a content delivery network can disappear from it.

The IPv6 finding conflicts with BGOcloud's repeated claim that free IPv6 is available on shared, KVM, OpenVZ, and dedicated plans. Both claims can be true if customer IPv6 is provided from another ASN, carried via an upstream, used only in an unobserved location, or not originated at the time of observation. They can also reflect outdated marketing. The correct conclusion is not "BGOcloud has no IPv6". It is that AS200628 originates none publicly, so a buyer requiring native IPv6 should ask for a test address assignment, route origin, reverse DNS process, gateway, filtering policy, and end-to-end working measurement before signing.

There is another instructive discrepancy. The RIPE aut-num text reproduced by bgp.tools contains import and export policy lines for AS57344 and AS31083, but the live connectivity view shows only AS57344. Registry policy entities can be prospective or outdated; route collectors can also miss backup paths. Neither proves a second dormant circuit. A resilience claim needs a current topology: operator names, physical connection points, building entries, router diversity, failover policy, and a test record. Two names in a database are not two working paths, while one observed path is not proof that no hidden backup path exists.

The country context makes this distinction more important. TheRIPE NCC 2022 Internet Country Reportdescribed Telehouse, Vivacom, Evolink, and Novatel as important connectors of Bulgarian networks and found a generally well-interconnected domestic market, while warning that individual networks may retain bottlenecks not visible from aggregate resilience. BGOcloud can benefit from Telehouse's broader connectivity without being itself multi-homed at the public AS level. The resilience of an upstream's backbone and the resilience of the customer's BGOcloud service are related but not identical.

Finally, some prefix descriptions on the routing page retain "BGO Cloud Ltd." or another organisation name. These labels often reflect historical inetnum descriptions and should not be read as deeds of ownership. The route observation demonstrates origin and reachability. Registry entities document administrative assertions. Neither proves title to each address, payment of a lease, a physical rack, or beneficial ownership of the server responding at an address. The network record is strong precisely when used for the limited proposition it supports.

Sofia as a Chain of Dependency

BGOcloud states in its FAQ that it owns its servers and provides service from a "Tier 3+" datacenter in Sofia. This is a corporate claim with two distinct names to test. Owning servers does not mean owning the building, power plant, cooling, fibre, upstream network, or every server sold in a UK-marked plan. A server can be owned by BGO Cloud OOD and hosted in someone else's premises; it can also be leased, financed, or provided for a particular service. The public site does not publish an asset schedule.

The facility is not named on the BGOcloud pages used here. The visible network relationship points to Telehouse EAD, but does not locate a rack. Telehouse's owncorporate pagestates that AS57344 provides data transmission and Internet services and that its main technical facilities are in the Telepoint international colocation centre. This establishes something about Telehouse, not about BGOcloud. AS200628 could reach Telehouse at Telepoint, at another meeting point, or via a circuit. Treating an upstream's facility statement as BGOcloud's lease contract would be an unwarranted leap.

Telepoint's currentinfrastructure descriptionclaims three datacenters, over 9,000 square metres of combined colocation space, three 10 kV power supplies, UPS and N+1 cooling, separate cable paths, on-site staff, ISO/IEC 27001:2022 certification, and limited-scope PCI DSS controls. These are Telepoint's claims and certifications. They do not automatically flow through Telehouse to BGO Cloud OOD, and they certainly do not certify the customer's guest OS or application. A buyer should ask BGOcloud to name the actual facility and provide the relevant certification scope rather than trying to infer it from a traceroute.

The term "Tier 3+" requires particular restraint. The Uptime Institute's explanation ofmyths and misconceptions about the Tier certification systemstates explicitly that marketing terms such as "Tier III plus" have no basis in its four-tier system. In that system, Tier III means concurrently maintainable site infrastructure, and certification can apply separately to design documents, constructed facility, and operations. "Tier 3+" may be a facility operator's shorthand for a redundant design. It is not, in itself, an Uptime Institute award name. The procurement question is therefore: certified by whom, for which site, at what certification stage, under what current scope?

The ownership of a likely ecosystem dependency also changes. Telepoint says it was acquired, andDigital Realty announced its entry into Bulgaria through the acquisition of Telepointon 2 March 2026. Again, no public document reviewed here proves that BGOcloud is a tenant of Telepoint. The acquisition counts as a diligence question, not a fact about BGOcloud's rack: if BGOcloud uses a Telepoint facility or a Telehouse service provided there, has the counterparty, access process, pricing, cross-connect policy, or certification scope changed?

The facility's locality can still be valuable. Hosting in Sofia can reduce latency for Bulgarian users, keep physical operations in the EU, and allow local engineers or courts to act in a familiar jurisdiction. It can also concentrate site risk if production, backup, and network egress share a single campus or metropolitan dependency. The right comparison is not "local equals safe" versus "global equals redundant". It is a map of every failure domain, from power and building to operator, host, guest, application, and backup, followed by a recovery plan that crosses the domains that matter.

A Warranty Without a Clock

BGOcloud's 99.9% uptime promise looks precise. In a 30-day month, 0.1% equals 43 minutes and 12 seconds; over a 365-day year, it is about eight hours and 46 minutes. But the arithmetic becomes a service level only after the parties define the measured service, observation point, calculation period, exclusions, claim window, and remedy.

The terms state that scheduled maintenance is excluded. They also state that BGOcloud does not guarantee uninterrupted or continuous service and is not liable for data loss. A warranty section promises performance comparable to that of similar companies and offers re-performance or a pro-rata credit as the exclusive remedy, but it expressly disclaims uptime and SLA-covered items from that warranty. The claims section says that outage claims are covered by "our SLA", but the visible terms page does not provide a linked service credit table or measurement method. A percentage on the homepage therefore remains incomplete for procurement.

The definition of "in service" is particularly important across BGOcloud's catalogue. A powered-on dedicated server may be reachable while the customer's database is corrupted. A KVM host may be healthy while a guest firewall blocks all traffic. A shared server may respond to a health check while an account is resource-limited. A VPN process may run while routes or certificates fail. BGOcloud states that it monitors the uptime of its services 24/7 but makes customers responsible for services inside unmanaged VPS and dedicated machines. This is a reasonable responsibility boundary, provided the SLA specifies which side is measured.

Public evidence does not provide achieved monthly uptime, status history archives, incident post-mortems, maintenance notices, or an independent monitor tied to the 99.9% figure. The company's ownMAP Marketing Research case studyclaims 100% uptime for a client's website, email, and communications, but does not disclose the observation window, monitor, denominator, or exclusions. It is useful as a named customer testimony, not as a fleet reliability audit.

The terms further exclude or excuse several events, including planned work and force majeure conditions such as bandwidth outages. They cap direct liability to fees received in the three months before the event and exclude broad categories of indirect loss to the extent permitted by law. A service credit on a low monthly fee will never compensate an e-commerce client for a significant business loss. That does not make the price irrational. It means the client must buy the required continuity through architecture — replication, external backup, tested failover, and monitoring — rather than expecting damages to rebuild the business.

A serious pilot should deliberately create measurable events. Reboot a guest. Ask support to recover a locked MikroTik instance. Restore a full shared hosting backup. Fail DNS over to a secondary target. Measure from Sofia and from the customer's real user regions. Open a priority ticket at night. Then ask BGOcloud to reconcile the observations with its SLA definition. A provider that can explain the boundary clearly is worth more than one that merely repeats the percentage.

Support as a Product and Bottleneck

BGOcloud's most plausible competitive advantage is not computation. Computation is widely available. It is the chance that a technically competent person in or near Sofia will answer a small customer's unusual question and retain context across tickets. The website makes 24/7 support a central part of the proposition, and the 2019 executive interview presented personal attention as a response to consolidation and scripted service at larger hosts.

The catalogue contains evidence of real human work. Staff can recommend a plan, migrate a site, apply a MikroTik licence, reinstall a locked router, add an address, handle an IP-KVM device, or change a dedicated disk. These interventions are not decorative. For a small business without an infrastructure team, competent recovery can be worth years of difference in monthly hosting fees. Local language, time zone, and familiarity with Bulgarian networks can shorten diagnosis even when the underlying hardware is ordinary.

Human service is also a capability that cannot be oversold indefinitely. "24/7" can mean an engineer on duty, a rotating employee, on-call, a ticket intake function, or an outsourced first line. The public pages do not indicate staffing per shift, severity definitions, first-response targets, recovery targets, escalation contacts, or whether phone and chat are monitored for incidents. The Plovdiv and London addresses do not prove distributed support coverage. A friendly response also does not prove that the responder has facility access or hypervisor authority.

The unmanaged boundary sharpens the problem. BGOcloud says its team does not access VPS guests, but the sales narrative emphasises help and custom solutions. Both can be true: staff can advise on infrastructure without administering the OS. The customer needs examples. Will support diagnose packet loss in a guest? Will it inspect a host for stolen time? Will it help recover a broken bootloader? Mount a rescue medium? Restore a snapshot? Configure a firewall for a fee? The answer determines whether "support" is an operational service, a courtesy, or a sales channel.

Small-team risk must be addressed contractually without assuming weakness. Ask for support organisation, not employee biographies: coverage model, secondary escalation, on-site remote hands arrangements, knowledge base ownership, change approval, privileged access logging, and continuity if a key engineer is unavailable. Ask how tickets are retained and exported. If BGO Software staff performs support, name that subcontracting relationship. The goal is to preserve the intimacy of a small provider while removing dependence on an undocumented individual.

Local support labour is part of the price. A provider can keep cheap entry-level plans by automating provisioning, limiting managed scope, and charging for exceptional work. A customer can make this model sustainable by buying an appropriate support tier instead of expecting unlimited system administration in a $12 server. The responsible transaction is one where both parties know what the monthly fee funds and does not fund.

Security Changes with Root Access

BGOcloud's security claims vary by product, and the buyer's interpretation should vary accordingly. Shared hosting includes provider-managed controls such as CageFS isolation, live kernel patching, anti-malware tools, and TLS. These controls can reduce common cross-account and patch risks. They do not constitute a BGO Cloud OOD security certification, and the site does not publish penetration test scope, vulnerability management targets, independent audit reports, or control effectiveness.

With a KVM VPS, the demarcation shifts. BGOcloud is responsible for the host and virtual environment promised in the order; the customer is responsible for guest users, packages, firewalls, keys, applications, logs, and backups. With a dedicated server, the page is even more explicit: there is no provided firewall, the customer buys application licences, and backup is left to the Linux method the customer implements. "First-class security" in marketing cannot erase these assignments. Root access is valuable because it gives control; it is dangerous for the same reason.

Backups illustrate the gap between a feature and a recovery system. Shared hosting advertises free backups, while the terms allow deletion of backups older than 30 days on an account and tell customers to download cPanel copies locally. cPanel's ownbackup documentationwarns that a user cannot automatically restore a full account backup from cPanel; full automatic restoration is a WHM/provider function. A buyer needs the schedule, retention, storage location, immutability, encryption, restoration authority, recovery time, and last successful test. A backup on the same administrative plane is not a complete defence against account compromise or provider failure.

VPN products also require narrower reading than sales adjectives. BGOcloud advertises encryption, authentication, and TLS for OpenVPN and sells MikroTik as a VPN concentrator or web proxy. The host can provision a virtual machine and a network path. It cannot guarantee endpoint hygiene, certificate custody, routing policy, DNS behaviour, logging choices, or traffic security after decryption. "Anonymous" and "100% safe" are marketing formulations, not security properties that can be proven for every customer configuration.

For personal data, physical location is only the beginning. Article 28 of the EUGeneral Data Protection Regulationrequires that processing by a processor be governed by a binding contract with specified subject matter, instructions, confidentiality, security, assistance, sub-processing, and deletion or return conditions. BGOcloud's terms state that an acceptable use policy and privacy policy are incorporated, but the public browsing used for this article did not expose a clearly labelled privacy policy, data processing agreement, or sub-processor list. A company should ask for these documents and verify controller/processor roles rather than treating "servers in Europe" as a compliance conclusion.

Facility certifications cannot fill this gap. Even if a named BGOcloud server is in a facility with ISO 27001 or PCI DSS controls, the certification scope may cover physical colocation operations, not BGOcloud's hypervisor, support desk, billing system, or the customer's application. The buyer should obtain the certificate holder, site, standard version, scope statement, expiry date, and relevant exclusions. It should also ask whether BGO Cloud OOD itself holds any security certifications; none should be inferred from an upstream's website.

There is no strong public incident history from which to calculate BGOcloud's breach or failure rate. This absence is not evidence of no incidents. Private hosts can resolve events without press coverage, and customers may not publish them. The appropriate response is not default suspicion but an incident questionnaire: hardware events over a defined period, notification practice, forensic retention, regulator contact, cyber insurance, lessons applied, and a sample of customer communication with sensitive details redacted.

When Abuse Policies Meet the Proxy Product

Hosting providers must control abuse. Spam, phishing, denial-of-service traffic, compromised software, and illegal content consume addresses, harm reputation, and create costs with operators and authorities. BGOcloud publishes an abuse contact in its RIPE-derived network registration and its terms prohibit spam, malware, infringement, attacks, and illicit content. These are necessary operational controls.

The business risk lies in scope and process. The terms allow immediate suspension or cancellation for policy violation or non-payment without notice or recourse. A later cancellation section reserves the right to close an account without refund for a broad list including excessive resource usage, torrent software, proxies, and attempts to circumvent security controls. The same public catalogue advertises MikroTik as a web proxy and VPN tool, states it does not restrict ports or protocols on the MikroTik service, and sells OpenVPN.

A reasonable interpretation is that legitimate private networking is allowed while abusive or public-proxy use is not. The documents do not clearly draw this line.

This ambiguity matters before deployment. A security company may run scanners. A telework gateway may generate many connections. An e-commerce site may suffer an attack that makes its outgoing traffic abnormal. A developer may use a VPN endpoint for testing. If automated abuse detection suspends the only server first and asks questions later, the customer's continuity depends on the speed of recourse. If the provider never suspends quickly, the reputation of its small IPv4 pool may suffer. Accountability requires both decisive control and a defined review path.

A buyer should describe expected traffic in writing and ask BGOcloud to approve it as part of the order. The approval should cover VPN or proxy purpose, scanning, mail volume, connection rate, ports, content category, complaint forwarding, response time, and emergency contact. It should distinguish a compromised machine from deliberate abuse and state when null routing, port blocking, guest shutdown, or account termination may be used. For regulated or high-availability workloads, it should include a remediation opportunity when the law and immediate harm permit.

Address reputation is a shared economic asset. IPinfo's domain estimate shows many domains spread across a relatively small observed network. A spammer on one address can affect mail deliverability or blacklist perception beyond their own account; a strict abuse desk protects innocent customers. RPKI does nothing for this layer. The most valuable evidence would be operational: abuse acknowledgement time, complaint categories, remediation rate, repeat offenders, outbound filtering, and ability to move an innocent customer without destroying whitelists. None of these metrics are public.

The terms also allow restrictions when support consumption exceeds that of similar customers. This is an understandable protection against one account turning a low-cost service into unlimited consulting. It should not become an indefinite path to throttle a difficult incident. A support plan, severity matrix, and paid engineering rate can turn conflict into a price rather than a surprise.

Exit Begins Before Cancellation

Low entry cost can mask switching cost. BGOcloud's services are built on portable technologies — Linux, KVM, cPanel, RouterOS, and standard VPN protocols — but portability exists only if the customer controls the artefacts and starts before account closure.

The contract renews for successive periods equal to the initial term. Either party may terminate by written notice at least 25 days before the end of the current period. Customers can use an online form or ticket, but a term commitment may leave termination fees. The 30-day guarantee refunds monthly service fees when invoked in time, while setup, domains, SSL certificates, custom orders, configuration, and development are excluded. This combination rewards early testing and penalises discovery of an architectural problem after prepayment.

Account closure can be abrupt. The terms state that emails and other communications will not be forwarded after termination and encourage a transition period. They also state that the primary IP provided may change and cannot be transferred. A customer whose licence server, partner whitelist, DNS reputation, or client VPN configuration depends on that address must plan for renumbering. Five IPv4 addresses bundled with a dedicated machine create five dependencies, not five owned assets.

Shared hosting offers a relatively familiar exit if the customer regularly downloads full cPanel backups, exports databases and emails, controls the domain registrar account, and has credentials outside the hosted mailbox. Yet a full cPanel archive may require WHM-level restoration at the destination provider. Domain registration is through ResellerClub, so the customer must confirm the registrant name, transfer lock, authorisation code, renewal date, and recovery email. The provider's promise to help register a domain does not relieve the registrant of verifying it does not expire.

VPS exit can be simpler because the customer has root, but only if the configuration is reproducible. A raw disk image may not boot cleanly on a different hypervisor; DHCP, interface names, boot mode, and network policy may change. The durable exit unit is an external backup plus deployment documentation, secret inventory, and tested rebuild, not merely a provider snapshot. Dedicated exit adds data erasure and support questions: can the customer get a final image, how long does secure deletion take, and what proof is provided?

MikroTik adds licence ownership. BGOcloud states that the P1 licence remains included as long as the customer stays with the service. MikroTik states that perpetual CHR licences can move between instances only under defined account and licence conditions. If BGOcloud controls the account, the customer may be able to export RouterOS configuration but not the entitlement. The order should state whether the licence is leased, assigned, or transferable and what happens on migration.

The practical exit test is short: build a parallel service elsewhere, restore current data, lower DNS TTL, move a non-critical workload, exercise rollback, and measure how much BGOcloud intervention is needed. The cost of this exercise is the best early estimate of lock-in. If a customer cannot do it during a quiet month, they will not do it safely after a suspension notice.

A Very Small Sample of Customers

Public customer evidence is positive but too sparse and dated for fleet-level conclusions.Trustpilotshows four reviews, all positive, dated 2019 to 2023. Reviewers mention price, dashboard, speed, backups, and uptime. Four voluntary accounts cannot estimate failure frequency, support distribution, or current quality, and two 2019 reviews received company responses the same day.

BGOcloud'sG2 pagecontains a single verified small-business review dated 2021. It praises speed and interface but criticises support and the single-datacenter footprint. G2 marks the review as incentivised and states there are too few reviews to provide a buying insight. This is an anecdote with transparent limits, not a verdict.

WHToplists 16 strongly favourable opinions, but the visible entries are heavily concentrated in 2018 and include anonymous or partially identified reviewers. They speak to early reputation for price and personal support. They cannot establish 2026 staffing, capacity, or uptime. The same caution applies to the company-produced case study and the executive interview: named details are useful, performance claims remain attributable to their sources.

This thin record does not imply dissatisfied customers. A quiet infrastructure can have quiet users, and small providers rarely accumulate enterprise reference libraries. It means a procurement team should obtain current references resembling their own workload. Ask for a customer who has restored from backup, one who has managed an incident, one with a dedicated or MikroTik service, and one who has left a plan. The reference's value lies in the event discussed, not in the logo.

Pressure from Three Directions

BGOcloud competes in three overlapping markets. The first is Bulgarian retail hosting, where local providers can offer Bulgarian-language support, local payment, and familiar legal documentation. A useful contrast is not a ranking but contract specificity. The publishedVPS terms of SuperHosting.BG, for example, identify the legal provider, company and VAT numbers, supervisory bodies, basic service obligations, and a five-day non-payment suspension rule. This does not prove better performance. It shows the level of counterparty and process detail a Bulgarian buyer can ask BGOcloud to match.

The second market is international budget infrastructure: European VPS hosts, global shared hosting groups, and dedicated server discounters. They can spread engineering, address procurement, and hardware purchasing over a larger base. Some offer multiple regions, APIs, snapshots, object storage, or more solid public documentation at prices close enough to challenge a local host. Their disadvantages may include less personal help, distant jurisdiction, complex renewal pricing, and a support queue that treats a small Bulgarian customer as one ticket among thousands.

The third market is hyperscale cloud and managed application platform. These providers sell elastic infrastructure, granular identity controls, managed databases, global regions, and vast compliance programmes. They also introduce variable billing, architecture complexity, and a need for cloud engineering. A $3.90 shared account and a hyperscale virtual machine are not substitutes simply because both can serve a website. For a small WordPress business, BGOcloud may replace a bundle of cloud services with a single invoice and a single support relationship.

For an application requiring multi-zone databases, auto-scaling, and audited controls, the apparent local substitute may be the wrong category.

The Bulgarian market leaves room for a patient local operator. Eurostat reported that only17.8% of Bulgarian enterprises used paid cloud services in 2025, compared to 52.7% in the EU. The European Commission's2025 Digital Decade assessmentdescribed strong connectivity but low SME digital adoption, below-average adoption of advanced technologies, and persistent cybersecurity preparedness challenges. These statistics do not measure BGOcloud's market share. They describe a customer base for which price, migration help, and understandable local support may matter more than a vast feature catalogue.

The strategic opportunity is local cloud substitution without pretending to be a hyperscaler. BGOcloud can win workloads that value Sofia latency, EU location, fixed monthly resources, MikroTik familiarity, and a reachable engineer. To maintain that position, it must disclose the modest things a large provider often documents by default: service limits, facility and subcontractor identity, incident process, response targets, credits, backup restoration, and exit. Transparency can be a scale advantage for a small operator because its system is easier to explain.

A Procurement Test Built Around Failure

The best assessment of BGOcloud is a paid pilot with a set of written questions. Marketing features must be converted into observable acceptance tests before production data arrives.

• Counterparty and scope.Require that the quote, order, invoice, and applicable policies identify BGO Cloud OOD and company number 204482247. List each service, location, management task, and third party included. If BGO Software staff or a UK provider participates, name their role and BGO Cloud OOD's continuing responsibility.
• Physical location and network.Ask for the legal datacenter name, postal location, rack or room boundary, whether the server is owned or leased, and relevant certification scope. For a UK-marked plan, repeat the exercise. Do not accept the Ring Tower office address as proof of server location.
• Topology and capacity.Obtain host, storage, and network failure domains; current public and backup upstreams; port speed and traffic policy meaning; oversubscription or fair-use approach; host capacity monitoring; and change procedure when a node fills. Ask what "RAID 10" and "unlimited" mean for the chosen plan.
• IPv4 and IPv6.Record assigned addresses, whether fixed, reverse DNS control, additional address rules, and advance notice of renumbering. For IPv6, test a real address from external probes and record the originating ASN. Confirm whether RPKI valid origin covers each provided BGOcloud prefix and whether the network performs route origin validation on received routes.
• Service level.Define the monitored endpoint, sampling interval, calculation period, scheduled maintenance notice, exclusions, claim window, credit percentage, and credit cap. Separate facility power, network reachability, hypervisor, guest, and application. Ask for 12 months of achieved aggregate uptime and a redacted credit calculation example.
• Support.Test normal and urgent tickets during business hours and at night. Record acknowledgement, technical engagement, and recovery time. Establish who can access the hypervisor and facility, how a severity-one event is escalated, which tasks are free, and the hourly rate and authorisation method for paid work.
• Security and privacy.Ask for a data processing agreement, sub-processor and data location list, privileged access process, vulnerability and patching targets, log retention, breach notification commitment, current certification scopes, and an independent test summary. Define who administers the guest, firewall, VPN certificates, and application.
• Backup and restoration.State schedule, retention, copy location, encryption, immutability, failure alerts, and deletion after termination. Restore a full cPanel account, a VPS, and a dedicated server data set into clean environments. Measure recovery time and confirm whether BGOcloud or the customer performs each step.
• Abuse and suspension.Describe expected VPN, proxy, scanning, mail, and connection behaviour. Obtain written approval and escalation contacts. Define complaint forwarding, response time, emergency blocking, remediation opportunity, and recourse. Reconcile the proxy prohibition with the MikroTik and OpenVPN products.
• Commercial mechanics.Freeze initial and renewal pricing, tax treatment, currency, setup fees, licence fees, address fees, and engineering rates. Record the 30-day refund scope, renewal date, and 25-day termination notice. Ask how a third-party licence price change affects a prepaid term.
• Exit.Require data export formats, domain transfer control, final backup window, address renumbering assistance, CHR licence treatment, deletion certificate where applicable, and support rates during transition. Perform a reversible migration before committing for a year.
• References and incidents.Talk to current customers with similar products and ask about a real restoration, outage, and escalation. Ask for a list of material service or security incidents over a defined period, with cause, duration, communication, and corrective action. A statement that nothing happened must include the period and definition of materiality.

The pilot must last long enough to cover a billing cycle and include maintenance, not just a benchmark immediately after provisioning. Performance tests must use the customer's stack and user geography. A fast synthetic CPU result does not measure support, packet loss, neighbour contention, or restoration quality. Conversely, a bad route from a single probe does not prove a bad network. The goal is repeatable evidence with thresholds agreed in advance.

The buyer must also honestly assess their own work. An unmanaged $17.50 VPS that consumes four hours of administration each month may cost more than a managed alternative. A shared plan that avoids an incident thanks to competent support may be cheaper than self-hosting even if its resource table is smaller. The total cost includes administration, monitoring, backup storage, security tools, migration exercises, and expected downtime cost, not just the invoice.

What the Public Registry Cannot Settle

Several questions remain open after assembling the available corporate, contractual, product, and network evidence:

• There is no public reconciliation of BGO Cloud OOD's server ownership claim with a hardware inventory, leases, financing, depreciation schedule, or the machines offered in each location.
• No public document names the Sofia facility used for each BGOcloud product or proves a lease at Telepoint. The relationship with Telehouse is routing evidence, not a rack location certificate.
• No current topology proves physically diverse transit. One upstream is observed, a second appears in registry policy, and hidden backup arrangements may exist; none of these facts alone demonstrate failover.
• The website claims free IPv6 while AS200628 originates no IPv6 prefix publicly. The delivery ASN, prefix, location, and production readiness are unresolved.
• The 99.9% promise lacks a public measurement definition, service credit schedule, and achieved uptime series tied to current services.
• Public pages do not disclose fleet size, occupancy, CPU contention, storage replication, backup success, support headcount, ticket response distribution, or customer churn.
• No public BGO Cloud OOD security audit scope, penetration test summary, data processing agreement, sub-processor list, or incident history was available in the evidence used here.
• The review and case study samples are too small, too old, or too vendor-influenced to estimate current reliability or support quality.
• The legal relationship with BGO Software and the operational meaning of references to Plovdiv, London, and the "UK" plan require current written confirmation.
• The acceptable use boundary for legitimate VPN and proxy workloads is not clearly reconciled with the broad account termination language.

These are not reasons to automatically reject the company. They are reasons to keep the workload proportional to the evidence. A brochure site can tolerate more uncertainty than a payroll system. A lab MikroTik router can tolerate a different support path than the only gateway to a remote office. The quality of procurement is the act of matching disclosure, contract, and tested recovery to the consequence of failure.

Monitor the Control Surface

The most revealing metrics for BGOcloud will not be market share estimates. Monitor the control surface that customers actually depend on.

First, monitor AS200628. Does it continue to originate the same eight RPKI-valid /24s? Does a second independently observed upstream appear? Does native IPv6 become visible? Do route descriptions and registry contacts stay current? A routing change can reflect growth, migration, or maintenance, so it should trigger a question rather than an instant conclusion.

Second, monitor the contract. Does BGO Cloud OOD's legal identity appear clearly? Does the 99.9% guarantee acquire a measurement and credit schedule? Are privacy, processing, sub-processing, and abuse policies published and versioned? Are claims about "unlimited", fixed address, backup, and UK location reconciled across pages? Documentation quality is not cosmetic for a small host; it is part of the service interface.

Third, monitor operational disclosure. A status page with history, maintenance notices, incident analyses, restoration metrics, and aggregated support performance would reduce the need to infer from a handful of reviews. Specific facility names and certification scopes would convert "Tier 3+" into testable evidence. A working IPv6 test endpoint would resolve more than another icon.

Finally, monitor whether personal support grows without becoming vague. The company's origin story speaks of one engineer and one server, and that intimacy remains the brand's strongest argument. Growth is valuable only if the customer can still reach responsible expertise and if that expertise is embedded in repeatable process rather than in one person's memory.

BGO Cloud OOD occupies a legitimate niche. Bulgaria's low cloud adoption leaves many businesses needing something simpler than a hyperscaler and more capable than a desktop machine. BGOcloud can offer local latency, familiar tools, fixed-price capacity, and direct help. Its public network demonstrates that a real operator exists behind the name. It also demonstrates the limits of what infrastructure metadata can certify.

The eight /24s do not prove a Tier facility, redundant operators, owned hardware, 691 customers, or perfect uptime. They prove that AS200628 visibly originates a small, RPKI-protected IPv4 pool. Everything above that layer — power, servers, virtualisation, backup, security, support, and recourse — must be established by contract and test. This is not a lower standard designed to trip up a small Bulgarian host. It is the standard that makes a small host's advantages safe to buy.