Guides / Buyer's guide
Buyer's guideCOI tracking software security: 12 questions to ask before you buy
A COI tool holds your subcontractors' policies, your project list and your owners' requirements. Ask how it's protected before IT asks you.
A COI tracking tool ends up holding more than certificates. It has your subcontractors' policy numbers and endorsements, your project list, your owners' insurance exhibits and, if you connect it, links into your project and accounting systems. That's worth a security review before you sign, and these 12 questions cover what to ask.
They pair with our COI tracking software demo questions and the full comparison of COI tracking software for construction.
Independent assurance
- Which SOC report do you have, and for what period? The AICPA describes System and Organization Controls (SOC) as a suite of services CPAs provide on a service organization's controls. Ask for the report itself, its type, the period it covers, and any exceptions the auditor noted. A logo on a website isn't the report.
- Which of your subprocessors are in scope? Cloud hosting, OCR and AI providers handle your files too.
Where your data lives and who sees it
- Where are documents stored, and in what country?
- Who at your company can open our files, and is that access logged?
- How is access controlled on our side? Single sign-on, user roles by project, and removing a departing employee's access.
- What can brokers and subcontractors see? They should see their own documents and requests, not your other trades.
AI and your documents
- Which AI models read our documents, and who runs them?
- Are our documents used to train or improve models? Get the answer in the contract.
- If a third-party AI provider processes our files, what are they allowed to keep, and for how long?
Integrations
- What access does each integration need? A Procore or accounting connection should have the narrowest access that does the job.
When you leave
- What do we get back, and in what format? Every document, requirement, result and decision.
- How long after we cancel is our data kept, and how is it deleted?
Questions for your own team
- Who signs off on the security review, and on what timeline?
- Does your contract with the vendor cover data breach notice and responsibility?
- Do your owners' contracts say anything about where project data can live?
See our COI Journal brief on what insurance regulators say about AI for the wider context on AI in insurance work.
About this guide
This guide was written by the Forsured team. Forsured makes COI tracking software and answers the same questions for its customers. This guide is general information, not legal or security advice; have your own security and legal advisers review any vendor.
Get new posts by email.
New posts on contractor COIs and project requirements, plus the coverage gaps we're seeing on real projects. Short and plain.
You're on the list. Thanks for reading.
No spam. Unsubscribe from any email.
About Forsured
Forsured is construction insurance compliance software for general contractors and the brokers who insure their trade contractors. You set each project's insurance requirements once. Forsured reads every contractor COI and endorsement against them, flags each gap with the reason, and keeps checking through renewals until the job is done.
- Project requirements with exceptions, not one template for every job
- Endorsement review (additional insured, waiver of subrogation, primary and noncontributory), not just the certificate
- A shared workspace where the contractor's broker sees exactly what's missing
- A person on your team approves every result, with a full review history
“What stood out to us is that Forsured doesn't just organize the paperwork. It helps us understand what meets the project requirements, what needs attention, and what needs to happen next. That clarity across the GC, subcontractor, and broker is where we see the real value.”
Send us one project's requirements and a contractor COI or two. We'll show you every gap we find, free.
Common questions
Should COI tracking software have a SOC 2 report?
It's a reasonable thing to ask for. A SOC 2 report is an independent CPA's examination of a service organization's controls, under AICPA standards. Ask for the report itself and the period it covers, and have whoever handles vendor security at your company read it.
Does COI tracking software use my documents to train AI?
Ask each vendor directly and get the answer in the contract. Some vendors use customer data to improve models and some don't. Ask whether a third-party AI provider processes your files and what that provider is allowed to keep.
Sources
- System and Organization Controls: SOC Suite of Services, AICPA & CIMA, checked Nov 13, 2026
We link to the original reporting and research behind every post. This post is general information, not legal or insurance advice: Forsured is a software company, not a law firm or a licensed insurance agency, so confirm anything you'll rely on with your broker or attorney. Spotted something we got wrong? Write to hello@forsured.ai and we'll fix it.