# COI tracking software security: 12 questions to ask before you buy

> A COI tool holds your subcontractors' policies, your project list and your owners' requirements. Ask how it's protected before IT asks you.

Published Nov 13, 2026 by Forsured. Buyer's guide. Source: https://forsured.ai/blog/coi-tracking-software-security-questions/

![Security questions to ask COI tracking software vendors](https://forsured.ai/blog/coi-tracking-software-security-questions/hero.png)

## The short version

- Ask for the vendor's current SOC report, not a badge on the website. SOC reports are issued by CPAs under AICPA standards and cover a defined period.
- Ask where your documents are stored, who at the vendor can open them, and whether your files are used to train AI models.
- Get the exit terms in writing: export format, what's included, and how long your data is kept after you cancel.

A COI tracking tool ends up holding more than certificates. It has your subcontractors' policy numbers and endorsements, your project list, your owners' insurance exhibits and, if you connect it, links into your project and accounting systems. That's worth a security review before you sign, and these 12 questions cover what to ask.

They pair with our [COI tracking software demo questions](/blog/coi-tracking-software-demo-questions/) and the [full comparison of COI tracking software for construction](/blog/best-coi-tracking-software-construction/).

## Independent assurance

1. **Which SOC report do you have, and for what period?** The [AICPA](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) describes System and Organization Controls (SOC) as a suite of services CPAs provide on a service organization's controls. Ask for the report itself, its type, the period it covers, and any exceptions the auditor noted. A logo on a website isn't the report.
2. **Which of your subprocessors are in scope?** Cloud hosting, OCR and AI providers handle your files too.

## Where your data lives and who sees it

3. **Where are documents stored, and in what country?**
4. **Who at your company can open our files, and is that access logged?**
5. **How is access controlled on our side?** Single sign-on, user roles by project, and removing a departing employee's access.
6. **What can brokers and subcontractors see?** They should see their own documents and requests, not your other trades.

## AI and your documents

7. **Which AI models read our documents, and who runs them?**
8. **Are our documents used to train or improve models?** Get the answer in the contract.
9. **If a third-party AI provider processes our files, what are they allowed to keep, and for how long?**

## Integrations

10. **What access does each integration need?** A Procore or accounting connection should have the narrowest access that does the job.

## When you leave

11. **What do we get back, and in what format?** Every document, requirement, result and decision.
12. **How long after we cancel is our data kept, and how is it deleted?**

## Questions for your own team

- Who signs off on the security review, and on what timeline?
- Does your contract with the vendor cover data breach notice and responsibility?
- Do your owners' contracts say anything about where project data can live?

See our COI Journal brief on [what insurance regulators say about AI](https://coijournal.com/reports/naic-ai-bulletin-and-coi-review/?utm_source=forsured) for the wider context on AI in insurance work.

## About this guide

This guide was written by the Forsured team. Forsured makes COI tracking software and answers the same questions for its customers. This guide is general information, not legal or security advice; have your own security and legal advisers review any vendor.

## About Forsured

Forsured is construction insurance compliance software for general contractors and the brokers who insure their trade contractors. You set each project's insurance requirements once. Forsured reads every contractor COI and endorsement against them, flags each gap with the reason, and keeps checking through renewals until the job is done.

- Project requirements with exceptions, not one template for every job
- Endorsement review (additional insured, waiver of subrogation, primary and noncontributory), not just the certificate
- A shared workspace where the contractor's broker sees exactly what's missing
- A person on your team approves every result, with a full review history

> "What stood out to us is that Forsured doesn't just organize the paperwork. It helps us understand what meets the project requirements, what needs attention, and what needs to happen next. That clarity across the GC, subcontractor, and broker is where we see the real value." -- Stephanie Massei, Milestone Construction

Free COI risk check: send one project's requirements and a contractor COI or two, and we'll show you every gap we find. https://forsured.ai/#demo

## Common questions

### Should COI tracking software have a SOC 2 report?

It's a reasonable thing to ask for. A SOC 2 report is an independent CPA's examination of a service organization's controls, under AICPA standards. Ask for the report itself and the period it covers, and have whoever handles vendor security at your company read it.

### Does COI tracking software use my documents to train AI?

Ask each vendor directly and get the answer in the contract. Some vendors use customer data to improve models and some don't. Ask whether a third-party AI provider processes your files and what that provider is allowed to keep.

## Sources

1. [System and Organization Controls: SOC Suite of Services](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services), AICPA & CIMA, checked Nov 13, 2026

General information, not legal or insurance advice. Forsured is a software company, not a law firm or a licensed insurance agency. Confirm anything you'll rely on with your broker or attorney.

---
Forsured: construction insurance compliance software. https://forsured.ai · hello@forsured.ai