Summary

  • Xalq Sigorta is an Azerbaijani non-life insurer, not a demonstrated internet-access seller. It collected AZN 25.41 million of premiums in 2025, about 3.9 per cent of the country's non-life total, while market leader PASHA Insurance collected AZN 355.16 million. Its reason to control internet resources is operational resilience, not telecom revenue.
  • The network footprint is recent and in use. The RIPE organisation record was created in September 2025, AS204840 was assigned in October, and the route record for 167.150.216.0/24 appeared in May 2026. Public DNS on 10 July placed the main site, online-product hosts and mail host inside that block, with declared connectivity to Delta Telecom and Azertelecom.
  • The financial room for an infrastructure experiment is finite. Audited 2024 net profit fell from AZN 12.47 million to AZN 4.79 million as reserve movements changed sharply, although operating cash flow recovered. In 2025 premiums rose 3 per cent while cash claims rose 9 per cent; in the first quarter of 2026 premiums fell about 5 per cent while cash claims rose about 33 per cent.
  • The current judgment is cautious. Portable addresses and dual upstream policy can improve continuity, but one /24, no visible IPv6, two public nameservers resolving to one address, undisclosed physical path diversity and no published service or conversion gains do not yet prove value creation. The case changes if tested failover, separate recovery sites, lower complaint intensity and measurable digital retention or expense savings emerge together.

The incentive is to own the failure outcome

Insurance is an information business attached to a balance sheet. A policy is priced from data, issued through records, collected through payment rails and fulfilled through a claims process. The insurer receives the premium at the beginning or during the contract and promises to respond after an uncertain event. That promise becomes more expensive when staff cannot retrieve a contract, a customer cannot submit a loss, a branch cannot reach the central application or a repair provider cannot receive authority.

The party paying for Xalq Sigorta's connectivity is therefore the policyholder, indirectly through the premium. The immediate beneficiaries are the insurer's sales, underwriting, finance and claims teams, as well as customers who can buy or report a loss without waiting for a single carrier to recover. The downside remains split. Xalq Sigorta bears the fixed cost of network engineering, security and duplicate capacity. Customers bear delay, uncertainty and sometimes immediate repair or medical costs when service fails. Shareholders bear the risk that management builds an expensive technical estate that does not improve retention, claims cost or regulatory resilience.

That allocation explains why the new resource footprint matters, but also why it can be misread. An autonomous system number is not a new insurance product. A /24 does not earn premium by itself. Xalq Sigorta's own company description says it has operated as a universal insurer since 2005, offers more than 20 voluntary and three compulsory insurance types, and has paid statutory capital of AZN 58.75 million. The Central Bank's register explanation defines an insurer as the locally licensed party obliged to pay indemnity when a covered event occurs. That is the operating boundary.

The correct investment question is consequently narrow. Does control of public addresses and routing make the insurance operation more dependable or cheaper than the realistic alternatives? Those alternatives include provider-assigned addresses over two managed circuits, colocation, a domestic cloud platform, outsourced security and a hybrid arrangement in which Xalq Sigorta controls addresses but rents the computing and recovery capacity. The company should retain each layer only when control changes the economic outcome.

The business is insurance, with distribution as the scarce asset

Xalq Sigorta sells to individuals and companies across motor, property, liability, health, travel, cargo, equipment and financial-risk lines. Its public site presents online purchase or calculation paths for travel, compulsory property and motor products. It also advertises low-entry offers: Live Healthy costs AZN 50 a year for check-ups at Referans medical institutions, while Plus Kasko is advertised at AZN 70 a year for eligible cars. These prices are acquisition tools and defined benefit packages, not evidence that every contract has the same premium or margin.

The underlying model has four revenue and value components. First, the company earns premiums for carrying risk. Second, it earns investment income while funds are held against future claims. Third, it can cede selected risks to reinsurers, exchanging part of the premium for protection against volatility. Fourth, it can use distribution and service quality to retain a customer for another policy year. The first three are visible to some degree in accounts. The fourth, which is where dependable digital access could become valuable, is not publicly quantified.

Distribution appears unusually tied to Xalq Bank. The insurer's current contact page lists its head office and a broad regional presence, with many Baku and regional representations located inside named Xalq Bank branches. Locations include Ganja, Goychay, Ismayilli, Lankaran, Mingachevir, Guba, Sheki, Sumgayit, Khachmaz and other cities. A 2024 promotion gave qualifying casco customers Xalq Bank payment cards without charge, and Xalq Bank's current home page continues to link Xalq Sigorta as a useful service.

This arrangement can lower customer-acquisition cost. A bank already has premises, staff traffic, payments and borrowers with insurable cars, homes and businesses. Co-location allows the insurer to sell without recreating a full national retail estate. It can also create concentration. If branch referrals, shared premises or payment-card promotions account for a large share of new business, changes in the bank relationship could weaken sales quickly. No public source reviewed gives premium, policy count, commission or renewal by Xalq Bank channel, so the strength of the advantage cannot be separated from the dependency.

The digital channel is the counterweight. A customer can use Xalq Sigorta's site to calculate or purchase selected products and submit information about an insured event. The claims page tells customers to limit damage, notify the relevant authority and call the 24-hour hotline before representatives investigate. The property-loss page also accepts event details online and specifies supporting documents. Reliable internet service can reduce the marginal cost of those interactions, but only if forms feed an efficient claims operation rather than creating another queue.

Market share gives limited room for fixed technology cost

Xalq Sigorta is meaningful in Azerbaijan's non-life market but is not operating at leader scale. The Azerbaijan Insurers Association's full-year 2025 bulletin, using Central Bank data, reports AZN 25.410 million of Xalq Sigorta premiums and AZN 10.883 million of payments. The corresponding 2024 figures were AZN 24.699 million and AZN 9.951 million. Premiums grew 2.9 per cent while payments grew 9.4 per cent.

Across the non-life companies in the same table, total premiums rose 6 per cent to AZN 651.699 million. Xalq Sigorta therefore held about 3.9 per cent of that pool, down slightly from 4.0 per cent in 2024. PASHA Insurance wrote AZN 355.163 million, approximately fourteen times Xalq Sigorta's volume. Qala wrote AZN 78.940 million and Ateshgah AZN 63.804 million. Scale matters because cybersecurity staff, recovery testing, route management and core applications do not become one-fourteenth as expensive merely because premiums are one-fourteenth as large.

The payment-to-premium ratio moved from 40.3 per cent to 42.8 per cent. That is a cash-flow indicator, not an actuarial loss ratio: it does not align earned premium with incurred claims, reserves or reinsurance by underwriting period. It nevertheless shows the direction of immediate cash burden. Premium growth did not outrun payments in 2025.

The first quarter of 2026 extended the pressure. The Central Bank's May 2026 statistical bulletin reports Xalq Sigorta premiums of AZN 7.282 million for January to March, compared with AZN 7.647 million a year earlier, while payments rose from AZN 1.808 million to AZN 2.399 million. That is a roughly 4.8 per cent premium decline and a 32.7 per cent payment increase. Quarter-to-quarter insurance data are noisy, and one quarter cannot establish underwriting deterioration. It does raise the hurdle for discretionary fixed cost.

The practical implication is not that technology should be cut. A weak claims period can make continuity more valuable because every hour of disruption delays more contested work. The implication is that management needs a measured return. It should be able to show that network control reduces downtime, manual handling, duplicate carrier charges, customer abandonment or regulatory exposure by more than its annual operating cost.

The 2024 accounts show profit compression, not financial distress

Xalq Sigorta's 2024 statements provide a more complete view than premium rankings. The company's profit and loss statement reports direct insurance premiums of AZN 24.606 million, up 2.3 per cent from 2023. Investment income rose from AZN 1.978 million to AZN 6.209 million. Paid claims fell from AZN 21.831 million to AZN 10.161 million, while premiums ceded to reinsurance rose from AZN 1.370 million to AZN 5.000 million.

Those favourable-looking movements did not produce a higher profit because insurance accounting depends heavily on reserves. The net change in insurance reserves moved from positive AZN 16.281 million in 2023 to negative AZN 2.803 million in 2024. Total reported income fell from AZN 42.833 million to AZN 28.834 million. Operating expenses fell from AZN 31.829 million to AZN 24.874 million, but net profit still declined from AZN 12.466 million to AZN 4.791 million. The ratio of net profit to that reported income dropped from 29.1 per cent to 16.6 per cent, though it should not be confused with a conventional industrial-company margin.

The cost lines show where network economics sit in the wider business. The company paid AZN 10.161 million in claims, returned AZN 1.559 million of premiums, ceded AZN 5.000 million to reinsurance and recorded AZN 8.081 million of business-running expense. Public statements do not split the last figure into staff, premises, software, telecom, security, sales and administration. No honest calculation can isolate the cost or saving from AS204840.

Cash generation was stronger than the profit comparison suggests. The 2024 cash-flow statement reports AZN 10.235 million of cash generated by operations after a negative AZN 4.490 million in 2023. Purchases of property and equipment fell from AZN 7.197 million to AZN 147,331, purchases of intangible assets fell from AZN 660,174 to AZN 200,715, and bond purchases rose to AZN 5.775 million. Cash ended 2024 at AZN 18.240 million, up from AZN 14.128 million.

The year-end balance sheet lists AZN 60.001 million of long-term assets, including AZN 16.562 million of property and equipment, AZN 27.416 million of long-term financial assets and AZN 15.313 million of equity-accounted investments. A secondary summary based on the same statements reports total assets of AZN 89.019 million, liabilities of AZN 29.770 million and equity of AZN 59.249 million. The balance sheet can support investment, but it does not tell readers whether the company owns server rooms, leases racks or outsources most computing.

Timing also matters. Most of the 2023 property investment occurred before Xalq Sigorta's RIPE organisation and autonomous system appeared in 2025. It would be wrong to label that earlier capital expenditure as network construction. The financial question for 2026 is the incremental spend after the resource acquisition: routers, firewalls, links, colocation, security tooling, engineering labour and recovery capacity, net of any managed-service contracts displaced.

The resource footprint is recent, specific and operational

The public registration sequence is unusually clear. Xalq Sigorta's RIPE member page identifies the company as a Local Internet Registry in Azerbaijan and gives its registered address and company contact. The underlying RIPE organisation record was created on 2 September 2025 and identifies registration number 2000358551.

The official AS204840 record was created on 15 October 2025. It declares imports from Delta Telecom's AS29049 and Azertelecom's AS196925, with Xalq Sigorta exporting AS204840 to both. The resource search record associates the company with the legacy IPv4 range 167.150.216.0 through 167.150.216.255 and shows a route object for 167.150.216.0/24 originated by AS204840, created on 6 May 2026.

Observed routing corroborates use. IPinfo's AS204840 page classifies the ASN as a business network, shows 256 IPv4 addresses, no IPv6 addresses, two upstreams and no downstream networks. A route collector or commercial discovery service can miss private links and some paths, so this is not a complete topology. It is consistent with an enterprise multihoming its own services, not an access provider selling connectivity to other networks.

The address space has moved from registration into visible service. Public DNS results on 10 July 2026 placed the main website at 167.150.216.3. The travel, Plus Kasko and Live Healthy hosts resolved to 167.150.216.2, while the mail host resolved to 167.150.216.10. This is economically important because those are customer acquisition and communication surfaces, not merely unused addresses.

It is also a very new migration. A third-party DNS snapshot dated 15 April 2026 placed the main site at 94.20.138.36, in a Delta Telecom range. That snapshot predates the May route object. The sequence suggests a transition from provider-addressed hosting into company-controlled space between April and July, although public DNS cannot reveal the project's internal timetable or whether back-end applications moved with the front end.

This evidence supports three conclusions and no more. Xalq Sigorta controls a routable identity. It is using the related IPv4 range for public services. It has declared relationships with two national backbone suppliers. It does not prove two physically separate fibre entrances, two routers, distinct power domains, automatic failover, spare capacity, protection from denial-of-service attacks, a recovery site or better customer outcomes.

What address portability can buy

Provider-independent control is valuable when an organisation needs to change a carrier without renumbering every public service. With provider-assigned addresses, moving a website, mail gateway, virtual private network endpoint or branch access service can require DNS changes, firewall updates, certificate checks, allow-list changes and coordination with outside counterparties. With its own prefix and ASN, Xalq Sigorta can in principle advertise the same addresses through another upstream.

That portability has option value. It improves Xalq Sigorta's bargaining position at renewal because the threat to move is more credible. It can reduce a carrier's lock-in advantage. It can also make dual-homing cleaner: both upstreams can carry the same prefix, subject to routing policy and physical design. The benefit is highest for services that are widely allow-listed or difficult to renumber, and lower for a public marketing site that could be placed behind a managed content-delivery service.

The regulatory context gives this control a practical purpose. Azerbaijan's 2024 information-security requirements for supervised financial entities include provider-risk controls, continuity planning, backup arrangements and, for covered categories, agreements with at least two network or internet service providers for critical applications. The requirements contain exemptions for some lower categories, and Xalq Sigorta's category was not established from public material. Two declared upstreams are consistent with a resilience objective; they are not proof of compliance.

The insurer can also segment services more deliberately. Public sales hosts, mail, remote access and partner interfaces can sit behind different controls even if they share the same /24. Logs, abuse contacts and route policy are under clearer organisational ownership. In a security incident, the company can coordinate filtering or withdraw a route without waiting for an address owner to transfer authority.

The strategic mistake would be to confuse control with self-sufficiency. Both declared suppliers connect Xalq Sigorta to the wider internet. Delta Telecom describes its backbone as the route through which major Azerbaijani providers and regional customers reach international channels. Azertelecom says its domestic and international network reaches global hubs over northern, western and southern directions. Xalq Sigorta's address can move between them, but it cannot route around every national cable cut, power event, filtering decision or common facility if the supposedly separate paths converge.

The scale trap sits below the cloud bill

The visible registry fee is small. The RIPE NCC 2026 charging scheme sets an annual contribution of EUR 1,800 per Local Internet Registry account, EUR 50 per ASN assignment and EUR 75 for certain independent or legacy resource registrations, with a EUR 1,000 sign-up fee for new members. Xalq Sigorta's exact invoice is not public, and legacy-resource treatment can vary by contract. Even the full general schedule is immaterial beside AZN 25.41 million of annual premiums.

The real bill begins after registration. Two transit contracts need ports and circuits. Genuine resilience may require separate carriers, building entrances, ducts, routers, firewalls and power. Equipment needs support and replacement. Routes need monitoring. Attacks need detection and mitigation. Certificates, mail reputation, DNS, backups and access controls need administration. A 24-hour customer promise creates an on-call requirement even when traffic is modest.

These costs are partly fixed. A router capable of taking the required routes does not become cheap because the insurer originates one /24. A security engineer cannot be hired for three minutes a day. A second recovery environment still needs patches, tests and data replication. This is where a mid-sized insurer becomes a price-taker: it buys hardware, software support, transit and specialist labour in markets where cloud and telecom suppliers spread their own fixed cost over many customers.

Xalq Sigorta can avoid that trap by owning policy and address control while outsourcing undifferentiated execution. It can place its prefix at a domestic colocation facility, buy managed routing and denial-of-service protection, and rent compute that complies with local data requirements. It can retain authority to change suppliers without employing a large internal network team. The trade-off is reliance on contracts and provider competence rather than direct operation.

Management should calculate the resource footprint as a continuity product. Annual cost includes transit, cross-connects, equipment depreciation, licences, monitoring, security, staff, audit, recovery tests and incident response. Annual benefit includes displaced provider charges, avoided renumbering, lower outage minutes, lower manual work, lower customer abandonment and any regulatory capital or remediation avoided. If the benefit case is expressed only as strategic control, it is not yet resource allocation.

Domestic cloud is a realistic substitute, not a theoretical one

Global cloud scale is difficult to reproduce in a single-country insurer. Large providers buy servers, storage, security research and bandwidth at volumes Xalq Sigorta cannot approach. Yet Azerbaijan's rules narrow the supplier set. The Central Bank's 2024 security requirements say sensitive information owned by a supervised entity should be stored solely within Azerbaijan when cloud services are used. They also require an exit strategy, encryption, provider controls, backup support, incident cooperation and restrictions on subcontracting.

This means a low foreign-cloud unit price may not be the relevant comparison. The realistic alternative is domestic managed capacity. AZINCLOUD says AzInTelecom provides public and private cloud services through its own data centres, with pay-as-you-go pricing, 24-hour support and more than 100 public bodies and about 100 large businesses using related services. A separate local-storage page explicitly markets data storage inside Azerbaijan and payment in local currency. These are supplier claims, not an independent audit, but they establish that a local cloud substitute exists.

AzInTelecom also has geographic assets relevant to continuity. The Ministry of Digital Development says its Yevlakh availability zone is separate from the Baku centre and has Tier III, ISO 20000, ISO 22301 and ISO 27001 certifications. That is a closer match to the Central Bank requirement for main and backup processing centres in non-adjacent economic regions than an insurer trying to create both alone.

Cloud does not remove network control. Xalq Sigorta can announce its own prefix at a colocation or through a compatible provider, use its addresses for gateways and retain multiple links. Nor does a certification prove application uptime, recovery success or favourable contract terms. The cloud provider may become a concentration point, and a white-label platform adds another party. Exit clauses, data portability, source-code access where relevant, backup formats and incident support must be tested.

The economic comparison therefore has three columns. Full self-operation maximises control and fixed cost. Fully managed domestic cloud lowers capital and staffing but increases supplier dependence. A hybrid model preserves address portability and security authority while renting compute, storage and recovery capacity. For a company of Xalq Sigorta's scale, hybrid is the benchmark that an owned estate must beat.

Public DNS exposes unfinished resilience questions

The July DNS view shows progress and concentration at the same time. The main site and specialist sales hosts now sit in Xalq Sigorta's range. That makes the resource useful. No public AAAA record was returned for the main site, and the ASN discovery view shows no IPv6 address space. IPv4-only service is not an immediate commercial failure in Azerbaijan, but it means the migration has not demonstrated a dual-stack architecture.

More important, the two authoritative names, ns1.xalqsigorta.az and ns2.xalqsigorta.az, both resolved on 10 July to 167.150.216.3. Two labels on one visible address do not provide address-level DNS diversity. The hosts could still sit behind resilient equipment or anycast, but the public evidence does not show it. A routing or host failure affecting that address can impair both names at once. Independent secondary DNS would be a low-cost way to reduce this common exposure.

The service hosts also cluster tightly: online product sites at .2, the main site and nameservers at .3, and mail at .10. This is efficient use of a /24 and may reflect virtualised services behind protected gateways. It could also indicate a compact deployment with shared power, switching and firewall dependencies. Public addresses cannot distinguish the two.

The right operational proof is not a topology drawing. It is a controlled failover record: withdraw one upstream, remove one router or simulate one data-centre loss, then show that sales, claims intake, mail and partner interfaces meet documented recovery times. The Central Bank requirements call for continuity and recovery tests under different scenarios, with repeated testing after an unsuccessful result. Evidence of those tests would turn registry status into resilience evidence.

RPKI is another watchpoint. The reviewed official records show the route object and origin but did not establish a public route-origin authorisation for the /24. A valid authorisation would reduce the chance that networks accept an unauthorised origin, though it would not prevent all route leaks or outages. Publishing and monitoring it is a modest governance step for an organisation that has chosen to control its own routing identity.

Suppliers still determine the economics

The two named transit suppliers are substantial. Delta Telecom's current observed network has multiple global upstreams, and Azertelecom presents itself as a national and cross-border backbone. Buying from both can reduce negotiating and operational dependence on either one. It also raises the number of contracts, ports and faults Xalq Sigorta must manage.

Commercial diversity is not necessarily physical diversity. Two invoices can terminate in one building, use the same duct or depend on the same power. One carrier may buy capacity from the other on part of a path. International routes can converge outside Azerbaijan. The public records do not identify handoff sites, committed bandwidth, burst pricing, protection, repair targets or whether both suppliers carry production traffic simultaneously.

Reinsurance is the other major upstream market. Xalq Sigorta ceded AZN 5.000 million of premium in 2024, 20.3 per cent of direct premium, up from 5.7 per cent in 2023. This may reflect a different risk mix, stronger catastrophe protection, new treaty terms or one-off placements. The statements do not name reinsurers or reveal recoverable concentration. Digital continuity helps the company exchange bordereaux, claims documents and settlement information, but it does not improve reinsurance pricing by itself.

Claims fulfilment adds repair shops, medical providers, assessors and assistance services. Xalq Sigorta's travel claims guidance directs customers to Europe Assistance and country-specific service centres, or to pay and submit documents in some circumstances. Its low-cost health product relies on Referans medical institutions. Its vehicle products promise repair support. Every outside provider can affect customer experience even when Xalq Sigorta's own network is healthy.

Regulatory evidence shows why contracts matter. The Central Bank's supervisory-actions page records a 2026 corrective measure after monitoring found that Xalq Sigorta had not concluded civil-law contracts with independent experts. The same page records other directions concerning insurance-law compliance and, in another period, shortcomings in compulsory motor claims settlement. These are formal remediation signals, not proof of insolvency or broad misconduct. They show that supplier and claims governance can create cost even when network availability is adequate.

Customer durability depends on claims, not address ownership

An insurance contract often lasts a year. Renewal can be sticky when a bank, broker, employer or branch simplifies purchase, but it is not physically difficult in the way moving servers or fibre can be. A customer can compare another insurer at renewal. Compulsory motor and property cover also gives competitors a broadly recognisable product around which to compete on price and service.

Xalq Sigorta's bank-linked reach can make the first sale durable. A borrower already visiting a branch may renew there. The insurer's online portals can make renewal cheaper still. Product bundles such as a payment card with casco can raise perceived value without reducing the insurance price directly. None of this proves differentiated demand. The company does not disclose policy count, renewal, digital conversion, acquisition cost or premium by branch.

Claims experience is the stronger retention mechanism. A customer who receives clear instructions, rapid assessment and predictable payment has evidence that the promise works. A customer asked repeatedly for documents or left without an answer has a reason to switch. Network reliability is an input to that experience, but staffing, authority and vendor management decide the result.

The latest official complaint measure is uncomfortable. The Central Bank's motor compulsory-insurance complaint index for the year to 31 May 2026 gives Xalq Sigorta an index of 1.78, the highest displayed value. The regulator states that the measure is intended to support customer choice and does not indicate a threat to financial stability or continuity. It is based on complaint share relative to contract share, not raw complaint count, and it covers one insurance class rather than the whole company.

The index had improved from 2.08 for the year to March and 1.97 for the year to April, but it remained elevated. That creates a concrete management test. If the new network deployment is part of a broader digital claims improvement, the index, response time, repeat-contact rate and settlement cycle should fall after migration. If service measures do not improve, address control has solved a technical input without solving the customer problem.

Competition makes technology necessary but not distinctive

PASHA Insurance has a scale advantage large enough to spread application, security and distribution expense across far more premium. Qala and Ateshgah also write substantially more non-life premium than Xalq Sigorta. Smaller rivals can buy many of the same cloud, payment and communications services. A portal, online calculator or own ASN is therefore not a durable moat on its own.

Xalq Sigorta's plausible differentiation is the combination of Xalq Bank distribution, national representations, a broad product set, local balance-sheet capacity and direct control of critical online endpoints. Each part reinforces the others. A bank referral produces a lead; an online path completes it; a dependable network keeps the path available; a claims team earns renewal. The combination can create value even if no single component is unique.

It can also become an expensive bundle of duplicated capabilities. The bank has its own digital estate. Domestic cloud suppliers sell managed capacity. Backbone providers sell protected links. Assistance companies manage cross-border incidents. If Xalq Sigorta builds a parallel internal capability without sharing cost or improving the policyholder outcome, it remains a buyer of technology at retail scale.

The realistic substitute for a customer is another insurer, not another ISP. The realistic substitute for management is not zero technology; it is a different sourcing model. Xalq Sigorta can retain two carrier contracts and place provider-managed routers at two sites. It can retain its ASN while outsourcing route operation. It can use a domestic cloud for sensitive workloads and an external service for public content. The burden is on internal ownership to beat those combinations on total cost and recovery.

Pricing power will show up in retention and mix. If customers accept higher premiums because service is demonstrably better, network investment supports value. If premiums grow only through low-priced entry products, promotions or passed-through inflation while claims and operating expense grow faster, the company is buying volume. Public figures currently support the second risk more strongly than the first conclusion: 2025 premium growth lagged payments, and early 2026 moved further in that direction.

Regulation turns resilience into a fixed cost of participation

Azerbaijan's insurance law makes digital capability mandatory rather than optional. The Law on Insurance Activity requires each insurer to maintain an official website for public information, complaints and applications, and an electronic information system for entering, processing and storing contract information. It also protects insurance secrets and requires annual financial reporting.

The Law on Compulsory Insurance goes further. The shared compulsory-insurance information service handles policyholder, contract, insured event and damaged-property information. Insurers must enter and retain required contract and event data and support access over internet and mobile channels. Connectivity failure can therefore interrupt a statutory process, not just marketing.

The 2024 security requirements impose governance around cloud selection, provider registers, incident response, backups, penetration testing, business impact, recovery time and data loss. For applicable categories, they require main and backup processing centres in non-adjacent economic regions, tests at least twice a year and at least two network providers for critical services. The fixed cost is documentation and practice as much as hardware.

This changes the build-versus-buy decision. Xalq Sigorta cannot simply select the cheapest virtual machine. It needs contracts covering encryption, data location, access, incident evidence, backup, continuity and exit. Nor can it declare an internal server room compliant because it owns the keys. It needs recovery capability and proof that it works.

The Central Bank's 2024-2026 financial-sector strategy aims to expand insurance channels, improve consumer rights, strengthen solvency and raise insurance trust. Its 2025 implementation report lists digital loss adjustment as a continuing insurance priority. Regulation is therefore pushing Xalq Sigorta toward more connectivity at the same time that the economics favour shared infrastructure. That tension is the central strategic problem.

Cross-border reach does not remove domestic concentration

Xalq Sigorta's travel and reinsurance activities cross borders. Its upstreams reach international hubs. Its customers may need assistance outside Azerbaijan. This makes international connectivity material even though sensitive cloud data must remain domestic.

The declared Delta Telecom and Azertelecom relationships provide supplier diversity at the national edge. Both companies describe multiple international directions. That can reduce the chance that one commercial dispute or one international route isolates Xalq Sigorta. Yet the company remains exposed to Azerbaijan's domestic power, cable, data-centre and regulatory environment. A company-controlled prefix is portable between carriers; it is not portable outside every jurisdictional constraint.

Currency exposure is modest at the registry layer but larger in equipment and support. RIPE invoices are denominated in euros. Routers, firewalls, security subscriptions and specialist support may be priced in foreign currency even when the insurance premium is collected in manat. Reinsurance can add settlement and counterparty exposure across currencies. Public accounts do not provide enough detail to quantify these risks.

Geopolitical risk belongs in the recovery plan, not in unsupported prediction. Routes north, west and south can be affected by events outside the insurer's control. A domestic backup site protects against a Baku facility event but not necessarily an international partition. Critical claims and branch functions need a degraded mode: local queues, verified later submission, alternative communications and clear authority. The financial value of resilience is the loss avoided during that rare period, which makes testing more important than average bandwidth.

Public weak signals show a migration, not a verdict

The strongest weak signal is the timing of DNS and route changes. In April, a third party observed the main site in Delta Telecom space. In May, Xalq Sigorta created the route object for its own /24. By July, the main site, sales subdomains and mail were using that range. This is consistent with an active migration rather than passive resource holding.

It remains weak because DNS reveals endpoints, not architecture. The insurer may have moved only reverse proxies. Back-end policy and claims applications may remain elsewhere. The same addresses may be announced from one or several sites. No public migration notice, incident report or service-level result was found.

The second signal is uneven public presentation. RIPE uses the registered address at 22L Inshaatchilar Avenue, while the insurer's main contact page gives the head office at 24 Academician Hasan Aliyev Street and several online pages still show older address variants. These can all be legitimate legal, operational or historical locations. They do not establish confusion in contracting, but they show why buyers and counterparties should verify the legal entity and service address rather than infer it from a footer.

The third signal is the absence of a representative independent customer-review corpus in the material reviewed. Scattered complaints or promotional comments cannot measure the whole book. The Central Bank's complaint index is more useful because it normalises complaints against contract share and states its methodology. No forum post is used here to establish service quality, outage frequency or claims behaviour.

The fourth signal is the company's public product estate. Multiple specialised subdomains, a 24-hour hotline, online forms and a large branch list indicate an operation that depends on communications throughout the customer life cycle. They do not reveal traffic, conversion or uptime. They do explain why management might value direct network control even without selling a byte of access to outsiders.

Four economic scenarios

In the best case, Xalq Sigorta uses AS204840 as a control layer over a mostly rented estate. Delta Telecom and Azertelecom arrive over genuinely diverse paths. Critical services run across Baku and a non-adjacent backup site. The company uses its own addresses at both, buys managed security and tests failover. Online conversion rises, branch paperwork falls, claims intake becomes faster and the complaint index drops. Fixed internal headcount remains small because suppliers handle commodity work. The network creates value by lowering operating friction and preserving supplier choice.

In a defensible middle case, the deployment improves continuity but does not change revenue. The company avoids one or two material outages, meets regulatory expectations and gains bargaining leverage over connectivity. Costs are roughly equal to the loss avoided. This is not a growth platform, but it is a reasonable insurance expense, like reinsurance or a backup generator. Management should present it as risk reduction rather than digital transformation.

In the weak case, both carrier links share a failure domain, DNS remains concentrated, recovery is untested and technical staff spend time maintaining low-volume infrastructure. The public site looks more independent while core applications still depend on one facility or vendor. Premium growth remains below claims and expense growth. The company has paid for a routing identity without changing the policyholder outcome.

In the worst case, direct operation adds cyber and configuration risk. A route leak, expired certificate, mail error or failed migration creates an outage that a managed provider would have prevented. Security obligations multiply across internal and rented environments. The insurer then pays both the fixed cost of ownership and the emergency price of outside support, while the elevated complaint signal damages renewal.

Probability cannot be assigned from public data. The current evidence fits the early stage between the middle and weak cases: real deployment, sensible supplier policy and useful address portability, but limited proof of physical diversity, customer benefit or economic payback.

The facts that would change the judgment

The first decisive fact is a network bill of materials. Management should disclose internally the annual cost of the two circuits, transit, colocation, routing equipment, security, monitoring, support and staff. It should compare that total with the previous managed arrangement and with a current domestic-cloud bid. A cost premium can be rational, but it needs an explicit continuity benefit.

The second is physical topology. Separate carrier names are not enough. Evidence should identify buildings, entrances, ducts, power zones, routers and upstream handoffs. A quarterly failover record should show withdrawal and restoration times for each path. If both links fail together in testing, the multihoming thesis weakens sharply.

The third is recovery performance. Xalq Sigorta should show recovery-time and data-loss objectives for sales, mail, branch access, compulsory-insurance exchange and claims. It should demonstrate successful transition to a non-adjacent backup centre under at least two scenarios. A domestic cloud can provide part of this evidence; an owned site must do the same.

The fourth is digital economics. Policy count, quote-to-purchase conversion, renewal, acquisition cost, straight-through processing, manual touches and abandoned claims should be measured before and after the migration. A durable 10 per cent increase in completed online renewals, or a clearly attributable reduction in handling expense, would make the network investment easier to defend.

The fifth is customer outcome. The motor complaint index should fall below 1.0 and stay there, while settlement time, repeat contact and reopened claims also improve. A lower index without operational measures could reflect mix changes; faster settlement without lower complaints could conceal communication problems. Both are needed.

The sixth is financial direction. Full-year 2026 premium growth should again exceed the growth of claims payments and controllable expense. The company should separate price, policy count, reinsurance and reserve effects. Revenue growth that comes from higher rates on a shrinking book is not the same as value creation.

The seventh is resource hygiene. Independent DNS addresses, a visible IPv6 plan, route-origin authorisation, monitored abuse contacts and documented capacity would show that Xalq Sigorta is managing the resource as critical infrastructure. Continued concentration of both nameservers on one address and no tested IPv6 path would suggest an incomplete migration.

The eighth is supplier and customer concentration. Premium, commission and renewal by Xalq Bank channel would show whether branch access is an advantage or a dependency. Reinsurance exposure by counterparty and carrier spend by supplier would show whether apparent diversification survives contract detail.

A specific positive pattern would change the current cautious view: twelve months of successful dual-carrier and recovery tests, independent DNS, complaint index below 1.0, online renewal growth above 10 per cent and a documented reduction in handling or managed-service expense, while premium growth exceeds payments. A specific negative pattern would also settle it: common-path carrier failures, no recovery-site transition, flat digital conversion, complaints remaining above market and technology cost rising while premiums contract. The resource records alone cannot decide between those outcomes.

Relevance without cloud scale requires selective ownership

Xalq Sigorta has done more than collect a registry label. It obtained an autonomous system, associated a legacy /24 with the company, declared two upstreams and moved visible customer and mail services into the range. For an insurer subject to digital-service and security obligations, that is a coherent operating decision.

It is not yet a demonstrated economic advantage. The insurer's 2025 premium growth lagged payments, early 2026 widened the gap, and its complaint index remains high. Its public routing surface is one IPv4 prefix with no visible IPv6. Supplier diversity is declared but physical diversity is unknown. The fixed costs of continuity, security and recovery are significant precisely because Xalq Sigorta is much smaller than the market leader.

The sensible strategy is selective ownership. Own the addresses, routing policy, security standards, recovery objectives and right to change suppliers. Rent commodity compute, specialist mitigation and geographically separate capacity when providers can deliver them more cheaply. Keep internal engineering where it changes the failure outcome. Do not build cloud-scale machinery to prove independence.

If management follows that discipline, AS204840 can be a small but valuable insurance asset: a way to keep public services reachable, preserve negotiating leverage and satisfy a higher standard of continuity. If it treats network control as a prestige project, the company will remain a price-taker on every expensive input while customers continue to judge it by the only event that matters to them: whether the claim was handled when they needed it.