The COI Tracker Buyer's Guide Nobody Wanted to Write (So We Did)

Most "buyer's guides" for COI tracking software are written by the vendors selling the software. Which is a bit like asking the fox to author the henhouse security manual.

We sat through demos. We talked to risk managers who'd been burned. We read the contracts buried in legal jargon. This is the guide we wish those risk managers had been handed two years earlier.

It's organised the way an actual evaluation runs: the five questions that decide the outcome, how the platforms sort by situation, what the pricing actually does, how to run the process, and the contract terms that bite eighteen months later.

The five questions that actually matter

Forget the 47-point feature checklists. If you can answer these five questions, you can shortlist in an afternoon.

1. Where does the vendor get its data?

There are three sources of policy truth in this category, and they are not equivalent.

Carrier-direct integration. Data flows from the insurer's own system. This is the strongest form of verification because nobody in the middle has to remember to update anything. It's also the narrowest — it applies only to vendors insured by carriers the platform has integrated with.

Broker AMS integration. The platform pulls from Agency Management Systems, the back-office software brokers use to manage their book. This is what most "real-time" marketing in the category actually means. Two things constrain it: AMS records reflect what a human at a brokerage typed, and AMS integration reaches a small fraction of brokerages — under 1% by estimates we've seen. Certificial's architecture is the clearest example of this bet.

Document-based verification. The vendor submits a certificate, the platform parses it and applies your compliance rules. This is what the category was built on, and it's still what every platform falls back to outside its advantaged tier. It's structurally blind to mid-term cancellations: a policy cancelled in March looks fine until you request a new certificate.

The question to ask: "Which carriers do you have direct API integrations with, and what percentage of our vendor list would fall inside that tier?" A list of carrier names and a coverage figure is a real answer. "We connect to AMS systems" and "we have a network of 5,000 brokerages" are not. A network is not ground truth.

Almost every buyer discovers their true coverage percentage after implementation. That is the expensive time to find out.

2. Will your vendors actually use it?

A COI tracker is only as good as the third parties uploading certificates into it. If the portal is clunky, your subcontractors will ignore it, your AP team will start emailing PDFs again, and you'll be paying for shelfware in 90 days.

This is the single most underweighted criterion in the category, and the mechanism is worth naming: you buy the platform to eliminate a coordinator's manual chasing, the third parties don't adopt it, the coordinator keeps chasing, and now you're paying for the software and the labor it was supposed to replace.

The question to ask: demo the vendor experience, not the admin dashboard. Ask to see a subcontractor with a borderline-compliant policy receiving a request, uploading a certificate, and getting a rejection. If the rep gets squirrelly about showing the third-party side, that's your answer.

3. Can you review actions before they go out?

Some platforms auto-send noncompliance emails to your vendors before you've had a chance to look. Efficient, until your largest tenant receives a form letter telling them they're noncompliant and calls your CEO.

This is not hypothetical. It is the most-cited complaint in our customer interviews about Jones, and commercial real estate risk managers have left the platform over the damage to landlord-tenant relationships. The uncomfortable part is that it's core to how the automation delivers value — switching it off gets you the manual review you were trying to escape.

The question to ask: "Show me the approval step between the platform deciding a vendor is noncompliant and the vendor finding out." Then ask what the default is, because defaults are what you'll actually live with.

4. What's the certificate minimum?

Some platforms won't seriously engage below a couple of hundred certificates — myCOI's 200-certificate floor is the best-known example. That's irrelevant if you're a Fortune 500 GC and disqualifying if you're a regional property manager with 80 vendors.

Ask on the first call. It saves a discovery call that was never going anywhere, and it tells you something about whether you'll be a priority account.

5. What happens when you outgrow it?

Spreadsheet replacements feel great at 50 vendors and like cement shoes at 5,000. Three things determine whether the platform grows with you: multi-entity support, integration depth with systems you already run (Procore, NetSuite, Sage, your AMS), and how pricing behaves as volume climbs.

Ask the exit question too, because nobody does: what does a full data export look like on termination, in what format, and is it contractually guaranteed? A platform that makes leaving painful has less reason to keep earning your business.

How the platforms sort by situation

There is no universally correct answer in this category — the honest version of a recommendation is a fit map. Here's how the platforms we cover actually sort:

If you are	Look at	Because
A Procore-native general contractor	Jones	Deepest Procore workflow mechanics, project-based compliance flows
An oil & gas or high-hazard industrial operator	Veriforce	Safety qualification and COI in one system, OSHA/PHMSA overlap
An SMB leaving a spreadsheet	bcs, Billy	Fast implementation, modern UX, no enterprise configuration overhead
A multi-domain compliance program (identity + MVR + credentials + COI)	EvidentID	API-first, consolidates verification types; COI depth is the trade-off
An enterprise already running Riskonnect for claims or ERM	Riskonnect	One vendor, one data model — if COI is a secondary requirement
A program whose vendors cluster with AMS-participating brokers	Certificial	Mid-term policy visibility for that subset specifically
A mature program with deep legacy integrations	MyCOI, SmartCompliance	Familiar workflows, stakeholder recognition, migration cost avoided

Read the right-hand column carefully. Each of these is a conditional recommendation, and the condition is doing the work.

Two patterns worth naming because buyers fall into them repeatedly. First, buying the multi-domain platform when your only real problem is COI — you pay for breadth and accept less insurance-specific depth, particularly on endorsement verification. Second, buying the vertical specialist when your program spans verticals: construction-specific depth is worth nothing to your healthcare vendors.

What the pricing actually does

Five models dominate the category, and they're not comparable on their face:

1. Per certificate — linear and predictable; can get expensive at volume.
2. Per vendor — counts entities rather than policies; more expensive when your vendors carry few policies each.
3. Flat-rate tiers — predictable within a band, with cliff effects at the boundaries.
4. Square footage — used in CRE, poorly aligned with COI risk units, which are tenants and vendors.
5. Custom enterprise — tailored and opaque; comparison is nearly impossible without doing the work below.

The vagueness is not accidental. Unclear pricing protects margin.

Normalise before you compare. Take your actual numbers — certificate count, vendor count, entity count, square footage if relevant — and make every vendor quote the same three-year total against them. Then add the things that don't appear in the per-unit rate: implementation fee, integration build fees, premium support tier, per-entity or per-user charges, and the renewal uplift buried in the contract.

A low per-certificate rate attached to an uncapped renewal is not a good price. It's a good first year.

The feature trap

Vendors love feature lists because they're easy to make and impossible to argue with. "We have 247 features." So does Microsoft Word. Doesn't mean you should write your novel in it.

The things that actually determine whether the platform works, roughly in order:

• Data accuracy — is the policy information correct today, not as of the last certificate?
• Third-party experience — will vendors and tenants actually engage with it?
• Workflow control — can you review before automation fires?
• Integrations that exist — not "on the roadmap." Exist. Ask for a live demo against your system.
• Reporting your auditor will accept — and ask an auditor, not the vendor.

Everything else is parsley.

Treat AI claims the same way. Every platform in the category now markets AI. Some built it in, some bolted it on to a fifteen-year-old codebase last year, and some have rule-based automation with an AI label. The test question: "Walk me through what your AI does to a single COI document, end to end, and what happens when it's wrong." Specific answers name the steps — extraction, validation against requirements, discrepancy flagging, exception routing. "Our AI optimises the workflow" is not a thing AI does.

How to run the evaluation

A process that takes about six weeks and reliably beats a 30-minute demo:

Week 1 — define before you look. Write down your requirements by vendor type before any vendor shapes your thinking. Certificate count, vendor count, entity structure, the systems that must integrate, and the three things that would make the platform a failure. Vendors are extremely good at redefining your requirements into their strengths.

Weeks 2–3 — run demos on your script. Send each vendor your scenarios in advance: onboarding a vendor with your actual requirements, a borderline-compliant policy routed for exception review, a mid-engagement lapse detected and escalated, an audit report for a set period, and a live integration with your systems. Vendors who run these fluidly are usually the better products. Pushback — "we'd need a custom environment for that" — is itself information.

Week 4 — verify independently. Ask for references at your size, in your industry, who have been live more than a year. Ask those references about the third-party adoption rate and what implementation actually took, in calendar time. Get every verbal claim about integrations, timelines and verification coverage confirmed in writing.

Weeks 5–6 — read the contract. Specifically: the renewal uplift cap, the termination notice window, what data export includes and in what format, whether implementation is fixed-fee or time-and-materials, and what happens to pricing if your volume drops rather than grows.

Budget three to six months from signature to steady state, not the number in the pitch. Implementation covers data migration, integration configuration, requirement templates, third-party onboarding, training, and a parallel-run period where you're maintaining both systems.

What to do next

Take our free COI tracker comparison — eight questions, three minutes, a shortlist scored against the criteria above and weighted to your situation. Our methodology explains how the scoring works and what is never for sale.

One rule above all the others: don't sign a 24-month contract on the strength of a 30-minute sales demo. The cost of a bad COI platform isn't the subscription. It's the coordinator you keep paying, the vendor relationships you damage, and the audit finding sitting behind a dashboard that looked confident and was wrong.