ArvanCloud is an international cloud service provider that offers services such as CDN, DNS, IaaS, and PaaS. Neither ArvanCloud, nor Abr Arvan and Softqloud GmbH, do not provide any services related to Internet filtering, censorship, creation or expansion of national networks, and categorically anything similar to those whatsoever. Also, neither ArvanCloud, nor Abr Arvan and Softqloud GmbH is an Internet Service Provider.
ArvanCloud as an international cloud service provider, with over 100,000 customers across 38 different countries, operates just like other cloud service providers such as Hetzner, Strato, IONOS, Cloudflare, Amazon AWS, and DigitalOcean; such providers operate in a layer that makes them internet consumers, i.e. they and their services are reliant on reliable internet connectivity. Therefore, any cloud provider, not just in Iran, can affect neither the service nor the disruptions nor any restrictions on the Internet. Indeed, cloud services are one of the components of the digital world and any internet disruption harms the services of cloud providers such as ArvanCloud.
We believe that Iranian citizens, like everyone else across the world, must have the rights to access unrestricted, uncensored, and high-quality Internet. With that being said, we have been continuously publishing transparency and periodical reports on Iran’s internet infrastructure besides ArvanCloud Radar, which shines a light on the internet status and disruptions in Iran. These reports were the sources for several news outlets including BBC, Shargh, IRNA, Digitao, Peivast, Zoomit, and several other publications.
In the past three years, we have been falsely accused of completely unjust allegations, and our employees have been constantly cyberbullied and received death threats. These accusations include similar false reports spread across various German outlets, including Taz, which were like fuel to the fire of cyberbullying against us; we address these accusations accordingly in this document.
The Relationship between Abr Arvan (Iran) and Softqloud (Germany)
In Taz’s report, there were mentions of Abr Arvan’s relationship with Softqloud. Abr Arvan and Softqloud engaged in an international partnership in 2019 under German law, in which both parties undertook a contract to offer cloud computing services to the international market as ArvanCloud; the contract was terminated on September 30th, 2022 with a notice period of 3 months until 31.12.2022.
Contrary to what stated in the report, Abr Arvan did not use Softqloud to facilitate international payments and this partnership did not violate any of the sanctions that applied to both companies. There were no financial transactions between Abr Arvan and Softqloud, and as far as we know, Softqloud had business lines other than the “ArvanCloud” partnership as well.
The contract between Abr Arvan and Softqloud undertook the following:
- Softqloud provided and maintained the required infrastructure for providing the aforementioned cloud computing services to the ArvanCloud international customers around the world; this included servers, datacenter space, and any related services.
- Softqloud sold Cloud Computing services to customers around the world.
- Softqloud maintained the payment gateway.
- Softqloud retained all the revenue generated by selling those services and reinvested it in expanding the cloud computing infrastructure
- There were no financial transactions between Softqloud and Abr Arvan.
- Abr Arvan provided Softqloud with Cloud Computing technology and products such as CDN, DNS, IaaS, and PaaS for international customers.
- Abr Arvan could promote its brand of ArvanCloud to gain a wider and more successful presence in the global market after the sanctions have been lifted in the near future.
In the reports, there are mentions of relations with Rheinmond company and a man associated with the Mykonos incident even though there is no relationship between this man or Rheinmond company with Abr Arvan and Softqloud. As far as we know, that person is a resident of Germany and he has only acted as a translator for the Softqloud registration at the notary.
We believe that if there were any worries or legal concerns about the translator, the notary or the German government should have taken the appropriate actions.
Additionally, FANAP, one of the minor shareholders of Abr Arvan, is not under any international sanctions. Pasargad Bank also, which is one of the investors of FANAP, is not under any sanctions by the European Union. Therefore, we can conclude that Abr Arvan’s relationship with Softqloud was legitimate based on German law.
Abr Arvan and ArvanCloud have no relations to Iran’s “National Internet”
In the reports, the international partnership between Abr Arvan and Softqloud is presumed to be linked with Iran’s “National Internet”. Even though ArvanCloud has frequently and categorically denied any relationship with Iran’s “National Internet”, the report somehow links them fictionally which brings up the question of “why would Iran’s National Internet need infrastructure outside of its own country such as in Germany?”.
Unlike what was said in the Taz’s report, Abr Arvan, Softqloud and in general ArvanCloud neither directly nor indirectly facilitated the creation or expansion of any isolated network for the Iranian government. A cloud service provider, not only in Iran but also in any country, cannot help and play a role in the structure and censorship of the Internet. Additionally, ArvanCloud does not provide any service other than cloud computing services.
ArvanCloud’s CDN PoPs are spread across 40 different parts of the world. ArvanCloud, like any other cloud services provider such as Hetzner, Cloudflare, Amazon AWS, and DigitalOcean accesses the internet through Internet Service Providers. It is crystal clear that ArvanCloud technically and logically plays no role in the internet infrastructure in any of these countries. The network, the topology, and the presence of ArvanCloud and its connection to the internet and IXPs in Iran are the same as our presence in other countries. On the other hand, high-quality Internet is one of the most important necessities for ArvanCloud’s operations. Hence, any disruption of the Internet prevents the company from providing services to customers around the world.
All being said, unfortunately, we have been unfairly accused of completely false allegations for the past three years and have been under widespread cyberbullying since then, which worsened after Taz’s report included the same false allegations. The motivation behind these accusations is still unclear to us, but because of social media’s thirst for fake news and the bots on these platforms, there has been a wave of baseless accusations with a snowball effect. These lies have been used as a source by some news outlets and the media, also in Germany such as Taz.
ArvanCloud, as mentioned in its recent press release, is prepared to cooperate with any investigation done by independent domestic and foreign technical institutes in order to clarify about ArvanCloud’s products and infrastructure.
“Abre-Iran” Contract
Another part of Taz’s report covers the contract of Abre-Iran. Abre-Iran is a contract between the Iran Information Technology Organization and AsiaTech, Zharfnegar, XaasCloud, Abr Arvan, and Fanap which were selected through tendering from 20 potential candidates to provide Cloud Computing services in 10 already existing data centers and overhaul them. The total capacity of these already existing data centers in this project is less than 2% of the entire Iranian data center capacity and they will be used only for providing cloud services.
We recommend that everyone study the content of the Abre-Iran contract thoroughly and not jump to conclusions only based on the two pages released on social media out of context. The contract is only about the services provided by Fanap-Abr Arvan consortium for 5 small regional data centers which only have a capacity of 16 racks. We would like to emphasize that the contract is not about the internet, censorship, filtering, eavesdropping, creation or expansion of national networks, but only about overhauling already existing datacenters with cloud technologies.
According to Abre-Iran contract and considering these data centers belong to “Iran Information Technology Organization”, the first party of the contract can enforce all of the companies involved in Abre-Iran’s project to stop providing services inside those data centers. This does not mean that they can disconnect the public Internet via the partner companies of Abre-Iran, but it means that the employer (IITO) can order the contractor (the private sector) to deactivate the cloud services inside those data centers.
We all know that “Telecommunication Infrastructure Company”, which is under the supervision of the Ministry of Communications of Iran, is the main provider of Internet in Iran, as they centralize all the internet connections and provides internet access to ISPs, i.e. they control the internet access in Iran and solely they can disconnect the Internet partially or completely in Iran.
Also in these reports, there are concerns about the monitoring and surveillance of Iranian citizens by Abre-Iran. Lawful Interception (LI) is a concept in international law that allows police and domestic/international justice officials to access cybercriminals’ information via a warrant. Fraudulent transactions, services, and any illegal activities such as phishing or child pornography are the things that trigger LI. All operators and services across the world must follow the LI law. In the cloud services domain, this information includes the contact information of the owner of the cloud service.
It needs to be emphasized that such a clause is only relevant to data centers of the Abre-Iran contract. This contract is again only for 5 small data centers (with an average of 16 racks) and holds no relation to public internet access or internet censorship in Iran.
The following is an excerpt from Abr Arvan’s ” Privacy Policy”:
“Abr Arvan does not monitor, conduct surveillance, or intercept its clients’ data illegally and there is no software or hardware from governmental organizations to save or monitor our clients’ information in any form whatsoever in Abr Arvan’s infrastructure. This company does not provide its own or clients’ encryption keys to any organization and encourages all of its customers to use data and communication encryption at all levels as much as possible.”
In the end, we would like to emphasize that Softqloud has no connection whatsoever to Abre-Iran.
The Relationship between Abr Arvan and the Iranian Government
Abr Arvan is a private Cloud Computing service provider company. Neither Abr Arvan nor Softqloud is directly or indirectly related to or influenced by any authorities, firms, or even individuals associated with the Iranian government (or the Islamic Republic regime).
“FANAP”, as one of the investors of Abr Arvan (not Softqloud), is one of the largest private sector organizations in Iran’s IT industry. Pasargad Bank is the major investor and the largest shareholder of FANAP. Pasargad Bank was founded in 2004 with the legal permission of the Iranian Central Bank. Pasargad Bank has been listed under the Tehran Stock Exchange since August 2013. Therefore, all of the financial accounts of ArvanCloud and FANAP are audited in the financial accounts of Pasargad Bank and are entirely and transparently available in the Iran Stock Exchange financial records.
Another section of Taz’s report presumed that some companies, embassies, and ministries are hosted on ArvanCloud. At the time of writing this response, the hosting services, data processing infrastructure, and servers of none of these clients are located or served on ArvanCloud’s infrastructure and probably, they are hosted on their own dedicated servers. These clients only use the CDN service under a contract with Abr Arvan (and not Softqloud) to increase the speed of public access to their services, and obviously CDN hides the real IP address of the origin servers, hence it is wrongly presumed that those clients are also hosted by ArvanCloud.
It should be noted that if any legal authority reports any illegal client to us, or any person or entity reports that a specific client is using ArvanCloud products in violation of our Terms of Service, we will block the customer’s access to our services. You can view a report of such cases in ArvanCloud’s transparency report.
Internet Filtering and Censorship
It is mentioned in the Taz’s report that ArvanCloud plays a role in filtering the internet in Iran. In addition to the fact that ArvanCloud strongly oppose the sinister phenomenon of internet filtering and censorship and it has always been a defender of freedom and unrestricted internet access, ArvanCloud nor Abr Arvan and Softqloud do not have any filtering or censoring tools or products whatsoever. As evidenced in previous paragraphs, they are internet consumers themselves and cannot play any role in internet filtering or censorship.
Another claim in the Taz’s report is that, in general, any kind of hosting services inside Iran helps and facilitates the isolation of the Internet in Iran.
This statement is absolutely false. It is necessary to point out the two following facts:
- Unfortunately, the Iranian government has restricted internet access at different times (including the recent protests) easily through whitelisting mechanisms, DNS Poisoning, and BGP manipulations and has selectively allowed or blocked IP addresses or domain names to be accessed by Iranian users. With such centralized mechanisms, which have almost no costs for them as they control the gateways of Iran’s internet, it doesn’t matter whether the IP/domain is hosted inside or outside of Iran. Basically, the Iranian government can specify exactly what is available and what is blocked because the internet access is centralized and they control the gateways.
These mechanisms have been there for many years and it can be clearly concluded that the development of data centers and cloud computing services play no part in such actions. Pouya Pirhoseinloo, the co-founder and CEO of Abr Arvan, explained this topic in detail at the beginning of the RTC2022 event. - Assuming that the Iranian government decides to isolate Iranian users and block their internet access, but still let data centers have internet access, cloud services will not have any effect on reducing the social costs of such actions. Cloud services providers are not data center providers but they are just actually clients of data centers. Their presence or absence will not make a difference in this decision. Traditional hosting providers have the largest market share of hosting Iranian services. Abr Arvan covers less than 3% of all of Iran’s hosting capacity.
ArvanCloud is not an internet access bridge
The three reports published by Taz, Correctiv, and Netzpolitik, claim that there are four bridges between Iranian users and the internet. This statement is completely false.
Unlike most countries in the world, Iran’s internet distribution structure is exclusively controlled by the government. The Internet reaches users and data centers only through two channels.
IPM aka “Institute for Research in Fundamental Sciences” with BGP AS number 6737 was the first point of internet connectivity in Iran. After the establishment of the Telecommunication Infrastructure Company, it became the central point of internet access in Iran and no other Internet Service Provider was allowed to establish direct internet connectivity (transit) with foreign carriers. IPM remained as an exclusion but to be only used by scientific centers.
Telecommunication Infrastructure Company, is a subsidiary of the Ministry of Communications and Information Technology, and holds BGP AS numbers 49666, 12880, and 48159. Nowadays, AS49666 is the main internet gateway of Iran.
Internet carriers such as Telia, CW, Cogent, SuperOnline, and Delta distribute the Internet between continents and countries and provide broadband transit service between countries and continents.
If you check the ASNs mentioned in the report in BGP Looking Glass sites, such as bgp.he.net, you will see that Abr Arvan AS202468 is at the fourth layer of Internet access in Iran and the last gateway from which Iranian IPs reach the outside world belongs to the Telecommunication Infrastructure company that distributes internet in Iran to the consumers.
In BGP Looking Glass websites like BGPView, you can see the upstream and downstreams of each AS. In the case of Iran’s centralized internet access structure, you can interpret each upstream as the internet access provider to its downstreams.
As an example, the picture below shows that Abr Arvan with AS202468 is a downstream of Asiatech AS numbers, and Asiatech itself is a downstream of the Telecommunication Infrastructure Company, i.e. it is the TIC that is ultimately providing its downstreams in Iran with internet access.
ASN Abr Arvan: 202468
ASN Asiatech: 43754
ASN Asiatech: 41689
ASN TIC: 49666
TIC Peers
https://bgpview.io/asn/49666#peers-v4
IPM Peer
https://bgpview.io/asn/AS6736#peers-v4
Abr Arvan Peers
https://bgpview.io/asn/202468#peers-v4
It should be noted that Abr Arvan AS numbers are used for ArvanCloud customers. We believe the wrong assumption about Abr Arvan-Softqloud being one of Iran’s internet bridges comes from the peering of AS205585 and AS208006. We would like to point out that the peering is actually happening only in ArvanCloud’s PoPs outside of Iran for Anycast architecture. Also, as you can see AS205585 has no downstreams and is only announcing ArvanCloud’s CDN prefixes.
ArvanCloud provides two services outside of Iran:
- Cloud Server (IaaS)
ArvanCloud or any other cloud service providers need to utilize data center infrastructures from all over the world for providing a better service, and also It is obvious that these data centers need to have internet access. These data centers acquire the internet service from their hosting country. If you take a look at the prefixes that end to Softqloud (prefixes mentioned in the report) you will find out that this company obtained its internet service from the Serverius network (via BGP peering). None of the IP prefixes that ArvanCloud advertises, has anything to do with the end-user’s public Internet and is only being used in its cloud services.
- Content Delivery Network (CDN)
The story is a bit more complicated when it comes to the CDN product and the traffic that goes through the Anycast network. ArvanCloud has 40 different PoPs around the world. In this structure, we do BGP Peering with the hosting data centers from all over the world to deliver user traffic to the nearest PoP and respond to the traffic from there. The IP addresses used in this service only have HTTP/HTTPS traffic and respond to requests according to the configurations made by the website admin (our clients) in the ArvanCloud user panel. It is clear this service has nothing to do with users’ public Internet inside Iran and is related to websites that use ArvanCloud’s CDN services.
It should be noted that in addition to Abr Arvan, there are dozens of other Iranian companies that advertise the IP prefixes of their Internet services (not the IP addresses of Iranian Internet subscribers) outside of Iran, and this is a protocol accepted by global standards.
In the end, we once again emphasize the right of the Iranian people to access unrestricted, high-speed, and stable internet. We expect the media and independent researchers to stand up against lies and slander and defend this basic right for small businesses and the people of Iran.
We believe Taz, Correctiv, and Netpolitikz must accept the responsibility for their baseless and unresearched accusations that were published without proper due diligence and asking for the opinion of cloud, BGP and data center experts, but solely supported by tweets from non-technical and non-tech savvy accounts; and we expect them to show true and ethical journalism and correct their reports and reflect accurate information. Abr Arvan and Softqloud GmbH reserve the right to pursue legal action for all financial, non-financial, and intellectual damages.
