Guides
Certificate tracking software and digital COIs
What certificate tracking software does and cannot verify, what to look for in each tool category, and the state laws that limit what a certificate may say.
Certificate tracking software collects certificates of insurance from vendors and subcontractors, reads them, compares them with your contract requirements, and chases expirations. It saves real administrative time. What it cannot do, by itself, is prove that the coverage on a certificate exists: a certificate is a summary, and an altered or inaccurate one can pass a software check as easily as a human one.
What a certificate proves and what it does not
The standard certificate, ACORD 25, states on its face that it is issued as a matter of information only, confers no rights on the certificate holder, and does not amend, extend or alter the coverage in the policies listed. It shows the insurer, policy number, dates and limits as of the day it was issued. It does not show exclusions, most endorsements, or whether the policy has since been cancelled. Our guide to certificates of insurance: what they prove and what they do not covers the form in detail, and the Certificate of insurance (COI) review checklist gives a line-by-line review.
The gap matters most for additional insured status. A box checked for "additional insured" on the certificate does not make anyone an additional insured; the policy endorsement does. See additional insured endorsements explained.
What the software does
Most platforms fall into a few categories, and many combine them:
- Collection and reminders. A vendor or subcontractor uploads a certificate through a link or portal. The system tracks expiration dates and sends reminders at set intervals.
- Data extraction. Document-reading tools pull carrier, policy number, dates, limits and checked boxes from the PDF.
- Requirement matching. You define requirements by vendor type or contract: limits, primary and noncontributory wording, waiver of subrogation, umbrella limits, workers' compensation. The system flags the gaps.
- Deficiency workflows. It sends the vendor a list of what is missing and records the response.
- Endorsement checking. Better tools also ask for and read the endorsements themselves, not just the certificate.
- Agent-issued and live certificates. Some systems connect to agency management systems so a certificate is generated by the agent and updated if the policy changes.
- Audit trail and reporting. Dashboards of compliant, expiring and non-compliant vendors, with a record of who accepted what.
Property managers, general contractors, healthcare systems, retailers and franchisors with hundreds of vendors benefit most, because manual tracking breaks down at that volume. See managing subcontractor insurance and certificates and how to review the insurance requirements in a contract for how requirements are written.
What to look for, by category
We do not recommend products. These are the questions that separate tools:
- Does it check endorsements or only the certificate? A tool that confirms the certificate says "additional insured: yes" is checking the least reliable document. Look for the ability to collect and read the actual endorsement pages, such as the additional insured and waiver of subrogation forms.
- Can it verify with the source? Some tools let the platform confirm the policy status with the issuing agent or insurer, or receive certificates directly from the agent. This is the strongest control against forgery.
- How good is the extraction, and who reviews it? Ask what happens when the system is uncertain. Software that auto-approves every parsed certificate is a risk; one that routes edge cases to a human reviewer is safer.
- How configurable are the requirements? Contracts differ by vendor type, project and state. You want rules by trade, not one global limit.
- Who does the vendor-facing work? Vendors complain about portals that charge them or ask them to rekey data. Check whether fees fall on the vendor, and whether that is compatible with your contracts.
- What is the audit trail? After a claim you will need to show what you had on file and when you accepted it.
- How is data secured? Certificates carry insured names, policy numbers and sometimes financial details. Ask for a security summary and where data is stored.
- Can it manage your own certificates? If you issue many certificates to customers, check that the issuer side is accurate and approved by your agent.
Fraud and forgery
Certificate fraud is a known problem: altered dates, fabricated policy numbers, and fake producers. A risk-management publication (Risk Management magazine, August 2022) described the structural weakness: when the certificate holder accepts a certificate from the insured rather than from the agent, the insured effectively verifies its own coverage. Software helps by comparing the policy number format, dates and carrier against the data you hold, and by flagging odd documents, but only direct confirmation with the agent or insurer proves a policy is in force.
Digital verification projects exist. In 2021 The Institutes' RiskStream Collaborative announced a proof of concept with TrustLayer and insurers to share policy data on a distributed ledger as a single source of truth. Public results of that effort have been limited; treat blockchain-based certificates as emerging rather than established. Ask any vendor that mentions them to show customers using them in production.
State certificate laws
Many states regulate certificates of insurance, generally to stop certificate holders from demanding that a certificate change coverage and to bar certificates that misstate it. Typical provisions prohibit issuing a certificate that alters the policy, require that certificates not be issued to parties with no interest in the policy, and restrict the use of non-standard forms. The rules differ by state, and some include requirements for filing certificate forms with the department of insurance. Check the state guides, such as Texas or California, and the workers' comp and benefits requirements by state. A tracking tool should be configured to match the rules where your vendors and projects are located.
A short worked example
Say a property manager hires an HVAC contractor and requires $1 million per occurrence / $2 million aggregate general liability, additional insured status on a completed-operations basis, waiver of subrogation, and a $2 million umbrella. The contractor uploads an ACORD 25. The software extracts the limits and flags two items: the umbrella is $1 million, and the additional insured box is checked but no endorsement is attached. The vendor management team sends a deficiency notice requesting a corrected certificate and the endorsement pages. The vendor's agent sends a new certificate and the endorsement forms. A reviewer opens the endorsements and confirms the wording matches the contract. This is hypothetical, but it shows where the value is: structured follow-up and a record, plus a human who reads the endorsement.
Key takeaways
- Tracking software automates collection, extraction, requirement matching and expiration reminders; it does not prove coverage exists.
- A certificate gives information only; additional insured status and waivers live in policy endorsements, so choose tools that collect and read them.
- Verification with the issuing agent or insurer is the strongest anti-forgery control; ask how a tool supports it.
- Insist on human review of exceptions, configurable requirements by trade, an audit trail and clear data security.
- State certificate laws vary; configure the tool to your states and have counsel review contract wording.