By Patrick Turcotte, COO, Docutrax. Last reviewed: 16 October 2026.

COI tracking software collects certificates of insurance from your third parties, reads the data, compares it against your requirements and flags what is missing or expiring. Every product in the category does that. Two things separate them: how far into the documents the review goes, and who does the work when a document comes back short of what your contract requires. This guide covers both, what eleven providers publish about each, what the category charges, and the questions to put in writing before you sign.

What COI tracking software does

The core of every product in this category is the same. It holds a list of your third parties and the requirements attached to each one, requests documents from them, reads what comes back, compares it to the requirement set, records a compliance status and tells someone when a policy is close to expiring. Most products add a vendor portal, reporting, and integrations into an ERP, accounting or property management system.

That work is real and it is worth paying for. Running it in a spreadsheet and an inbox fails in a predictable way: the tracking is only as current as the last person who updated it, and nobody finds out a policy lapsed until someone goes looking.

Every product collects. The differences start once the document is in the system and someone has to decide whether it satisfies the contract.

The two questions that separate these products

How deep does the review go, and who does the work when a document falls short.

Depth sets what you find. A certificate-level check and a full policy read answer different questions, and the right depth for a janitorial vendor is not the right depth for a structural steel subcontractor on a New York project.

Resolution sets whether anything gets fixed. Every program that fails in this category fails in the same place. A document comes back wrong, or does not come back at all, the system flags it, and then it sits because nobody owns the next step. Flagging a gap and closing it are different jobs, and most of this category's marketing describes the first one.

Price, portals, dashboards and integrations all matter, and all of them follow from your answers to those two questions. Work out what depth your exposure requires and who is going to chase the corrections, then shop.

COI tracking software compared: what each provider publishes

One thing first, about this category's own comparison content. Most of the "best COI tracking software" lists are published by companies that appear in them. Certificial's names itself as the author and scores itself 4.7 out of 5 in first place. illumend and Billy publish their own. None of that is hidden and none of it is useful as a ranking. The criteria are the part worth taking.

Ranking these would be dishonest, because they are not all doing the same job. What follows is what each company states on its own site as of 15 October 2026, not an independent test. "Not stated" means we did not find the claim published on the provider's own site, which is not evidence that the work does not happen.

Three things to know about reading it.

Every performance figure in this category is self-reported. None of it is audited, including the retention rates and hours-saved numbers providers publish, and the scores vendors award themselves in their own comparisons.

Two providers describe their own review as reaching full policies. bcs publishes "Full policy reviews covering endorsements and Description of Operations language" on its Full-Service tier, above an AI agent it calls RiskBot that "reviews certificates and endorsements." Docutrax offers forensic policy review as a depth. TrustLayer has announced an agreement to acquire PolicyReview, whose AI analyzes policy documents, which is a different claim from reviewing policies itself.

SmartCompliance's site could not be read by the automated tools used for this guide. Its row reflects only what was found elsewhere.

Sources: Certificial comparison · Certificial pricing · bcs COI tracking · bcs pricing · bcs vs Certificial · Billy managed services · Billy comparison · COI Tracker · illumend · illumend buyer's guide · Jones pricing · NetVendor vendor support · PINS Advantage pricing · TrustLayer plans · TrustLayer Plus · TrustLayer and PolicyReview

Review depth: certificate, endorsement, policy

Three depths, answering different questions.

Certificate review checks what the certificate reports: the right types of coverage, in the amounts shown, on current dates, with the correct named insured and certificate holder, from a carrier with an acceptable AM Best rating. This is the right level for a great many relationships and it is what most of this category does.

Endorsement review goes to the forms attached to the policy, the actual additional insured endorsement, the waiver, the primary and noncontributory language, and checks whether they match what the contract requires.

Forensic policy review reads the policy itself, including the exclusions and conditions that decide whether coverage responds at claim time.

Most of the category does certificate review. Several add endorsement review. Two describe their own review as reaching full policies.

How to tell which depth you need

Depth should track exposure, which sounds obvious and is hard to apply. Run these six questions over your own population and the answer usually resolves itself.

Are you named as an additional insured, and does the contract specify a form or edition? If it does, a certificate reporting "additional insured: yes" has not told you whether the requirement is met.

Does the work create completed operations exposure? A claim can arrive years after the crew left, and ongoing operations forms do not reach it.

Do you operate in a state whose Labor Law regime or anti-indemnity statute changes where liability lands? New York is the obvious case.

Does any contract require primary and noncontributory treatment or a waiver of subrogation? Both need endorsements, and both carry conditions a certificate cannot display.

What is your largest single contract value, and what is the worst realistic claim against it? Depth should be proportionate to that number rather than to the third party's size.

How many distinct trades or vendor types are in scope? One requirement set across a uniform population is a different problem from thirty sets across a mixed one.

If most of those answers are no, certificate review is probably the right depth and most of this category will serve you. The more of them you answer yes, the further into the documents someone needs to read.

What a certificate of insurance does and does not prove

A certificate is evidence that policies existed on the day it was issued. It is not the coverage, it does not amend the policy, and it binds nobody. That is by design, and knowing what the form can and cannot carry is what lets you decide which depth you are buying.

Seven things worth knowing about the current edition, ACORD 25 (2025/12):

It states on its face that it "IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER," and that it "DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S), AUTHORIZED REPRESENTATIVE OR PRODUCER, AND THE CERTIFICATE HOLDER."

Coverage lives in the policy and its endorsements. The form says so: "If the certificate holder is an ADDITIONAL INSURED, the policy(ies) must have ADDITIONAL INSURED provisions or be endorsed."

There is no exclusions field. An exclusion that guts the coverage sitting behind your indemnity clause will not appear anywhere on it.

There is no schedule of underlying insurance, so it cannot establish what an umbrella or excess layer attaches over.

The cancellation block promises the holder nothing: "NOTICE WILL BE DELIVERED IN ACCORDANCE WITH THE POLICY PROVISIONS."

The limits shown may already be spent. The certification block above the coverage grid warns that "LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS."

The signature is the producer's rather than the insurer's. The block is labeled AUTHORIZED REPRESENTATIVE.

Several states have written the point into statute. Texas bars an insurer or agent from issuing a certificate that "alters, amends, or extends the coverage" and provides that a certificate "may not convey a contractual right to a certificate holder." Minnesota does the same and mandates the disclaimer language. The Texas Department of Insurance also states the alternative plainly: "Chapter 1811 does not prohibit an agent or insurer from providing a copy of the policy or endorsements."

None of this makes certificates useless. It makes them a screen, and the question is whether a screen is the right depth for the relationship in front of you.

Sources: ACORD 25 (2025/12), as posted by NY DFS · Tex. Ins. Code § 1811.051 · Texas DOI, Certificates of Insurance FAQ · Minn. Stat. § 60A.39

The three endorsements every provider says it checks

Nearly every product in this category advertises that it checks additional insured status, waiver of subrogation and primary and noncontributory. Each one carries conditions a certificate cannot display and a shallow read of an endorsement will miss, which makes them the best questions to put to a vendor in a demo.

Additional insured. Status turns on which form is attached and which edition. The 2001 and later editions of CG 20 10 cut coverage off once all work on the project, other than service, maintenance or repairs, is completed or that portion of the work is put to its intended use, which is why completed operations generally requires CG 20 37. Under the 04 13 and later editions, coverage is no broader than the contract requires and is capped at the lesser of the contractually required amount or the available limits. Ask what the software reports beyond "additional insured: yes," and whether it reads the form and the edition.

Primary and noncontributory. ISO CG 20 01, current multistate edition 12 19, requires two things rather than one: the additional insured has to be a named insured under the other insurance, and you have to have agreed in writing that this insurance would be primary and would not seek contribution. It is not implied by additional insured status. Ask whether the review tests both conditions or records that the endorsement exists.

Waiver of subrogation. The general liability waiver and the workers compensation waiver are separate endorsements on separate policies, and one does nothing for the other. Ask which one the review checks when a contract requires both.

And a fourth question. Ask what happens when the form attached is a manuscript endorsement that matches no standard form at all. Automated comparison works by matching against known forms. A non-ISO endorsement drafted by a carrier's counsel is exactly the document that decides a claim, and exactly the one a matching engine cannot grade.

Sources: ISO CG 20 01 · ISO CGL multistate forms list, FCS · Additional insured endorsement editions, Construction Executive

What happens when a document comes back deficient

This is the question that decides whether a compliance program works, and the one buyers ask last.

A third party sends a certificate with the wrong limit, or an additional insured endorsement that does not match the contract, or nothing at all. Software will tell you. Then someone has to contact that third party, usually contact their broker or agent too, explain what is wrong in terms an insurance professional will act on, and keep going until a corrected document arrives. That is the work. It is slow, it is unglamorous, and it is where programs stall.

Ask five things:

1. Who makes contact, your team or theirs?

2. Does anyone talk to the third party's broker or agent, or does the request stop with the third party?

3. How many attempts, over how long, before it escalates, and to whom?

4. What happens when the agent ignores it?

5. What does the provider do, and what does it expect you to do?

What the category publishes varies widely. bcs lists "Corrective Action of Deficiencies" on its Full-Service tier and states that "US-based compliance analysts handle vendor outreach." Jones publishes an Operator offering with "Human follow-ups for nonresponsive vendors" and "Back-and-forth with brokers, agents, and third parties." illumend says its AI contacts partners with the exact requirements and offers human oversight as a subscription addition. TrustLayer sells managed services as a TrustLayer+ add-on without publishing the scope. Several publish nothing on it at all.

There is a related problem the better products treat as structural. Your third parties have to cooperate, and many will not. Three providers answer that with architecture rather than effort, and they answer it in three different directions. Certificial makes its insured and agent tiers free and invites the third party's agent into the network, so corrected documents come from the party who issues them. NetVendor runs a credentialing network the vendor enrolls in once per client, at an annual fee of "generally 149," which shifts the work onto the vendor and attaches a cost to it. Jones takes the opposite position and states it never charges vendors or subcontractors, "so you get faster turnarounds and fewer delays." Which of those suits you depends on how much leverage you have over the parties whose documents you need.

Sources: bcs pricing · Jones pricing · illumend · TrustLayer Plus · Certificial pricing · NetVendor vendor enrollment FAQ

Who reads your documents, and what qualifies them

The least consistent disclosure in the category, and worth pressing on.

Most providers describe reviewers as a team rather than a person. bcs states that human review on its Full-Service tier is performed by "U.S.-based insurance professionals" on a "Team of Compliance Analysts." TrustLayer states that its TrustLayer+ managed service puts a "team of licensed insurance professionals" on the work. Billy refers to its "Certificate Management Team" as "our dedicated group of qualified insurance professionals" and claims CRIS certification at team level. illumend attributes the review to an AI it calls Lumie, "trained on 16 years of compliance expertise from myCOI," with human reviewers handling what Lumie cannot resolve. Several publish nothing we could find about who reads the documents.

Ask who holds the license or the designation, and whether that person reads your documents.

Two credentials are worth knowing by name. A property and casualty license means a state has examined and licensed the holder on the coverage lines you are buying compliance against. CRIS, the Construction Risk and Insurance Specialist designation, is a construction-specific program covering the endorsement structures and contractual risk transfer that show up on subcontract work. Neither one guarantees a good review. Both tell you what the reviewer has been trained to recognize.

Sources: bcs COI tracking · bcs pricing · TrustLayer Plus · Billy managed services · illumend

Software, managed service, or your own team

Three models, and they suit different situations.

Your own team keeps everything in-house, usually a spreadsheet plus email plus a shared drive. It costs nothing in license fees and it is the most expensive option in every other respect: the knowledge sits with one person, the record is only as good as their last update, and there is no audit trail when a claim arrives two years after the work finished. It works at low volume with simple, uniform requirements. Writing your own software is rare and usually a mistake. Building the database takes a few weeks. Reading the documents correctly takes a career.

Software replaces the spreadsheet with a system that requests, reads and tracks documents automatically. It is the right answer when structured tracking is the primary need, the requirements are uniform enough to encode once, and you have someone internally who can adjudicate what the automation cannot resolve. Its limit is insurance judgment. Somebody still has to decide whether a manuscript endorsement satisfies a contract clause, and under this model that somebody is you.

Managed service puts licensed insurance professionals on the review and the remediation, with the platform underneath as infrastructure. It suits programs where requirements vary by relationship, where the exposure justifies endorsement or policy-level review, and where nobody internally wants to spend their week chasing a subcontractor's broker for a corrected endorsement. Its limits are real too. It costs more per third party than software alone, you depend on an outside team's turnaround rather than your own, and it is overkill when your requirements are uniform and your population is small. If one requirement set covers everything you track and a certificate is the right depth, you are paying for judgment you do not need.

What COI tracking software costs

Most of the category does not publish prices at all, which is itself the finding. Of the eleven providers here, two publish figures, two publish a pricing model without figures, one publishes a free tier without figures for its paid plans, and one publishes only what it charges the third parties.

The detail behind those cells. bcs publishes a free plan at 0.95 Per vendor, monthly" with "*Price dependent on vendor volume," and Full-Service at "$17.80 Per vendor, annually" with a "Minimum $10,000 annual spend." Certificial's Requestor Basic is free and capped at five suppliers, Requestor Professional "Starts at $99/mo," Enterprise is on request, and its Insured and Agent & Broker tiers are listed at $0. Jones states it is "priced per record, per year, with unlimited COIs and lease extractions." TrustLayer's Starter is "Free up to 50" vendors with Pro and Complete both covering "0-1500+" vendors on request. PINS Advantage bands by annual volume from under 100 to 2,000+ active vendor, subcontractor or tenant records, with figures behind a form. Docutrax does not publish figures either; its pricing is scoped to account size and the number of third parties.

Read the unit before the number. Per-vendor pricing scales with how many third parties you have, per-record pricing scales with projects or properties, and a per-vendor price looks cheap until you multiply it by a subcontractor list that turns over every project. Minimums matter: the $10,000 annual minimum on bcs Full-Service sets a practical floor regardless of vendor count.

Three things move a quote and are rarely on the pricing page: how many requirement sets you need, whether human review is included or added, and how much historical certificate data has to be migrated at implementation.

Is free COI tracking software worth using?

Sometimes, and it is worth knowing what the free tiers cover. bcs publishes a free plan at $0 with no credit card required, covering COI tracking, automated requests and automated deficiency notices. Certificial's Requestor Basic tier is free and capped at tracking compliance for up to five suppliers, with its insured and agent tiers free as well. TrustLayer publishes a Starter tier, free up to 50 vendors, covering expirations and renewals, messaging, basic reporting, custom data and AI document collection. A spreadsheet is the other free option, and the search volume on certificate tracking templates in Excel tells you how many programs still run that way.

Judge a free tier on review depth and vendor count, the same way you would judge a paid one. Free is the right answer when certificates are the right depth and the population is small enough for one person to chase.

Who pays, you or your third parties?

Ask early, because this shows up in your relationships rather than on your invoice. Most providers charge the organization doing the tracking. Jones states that it "never charges your vendors or subcontractors, so you get faster turnarounds and fewer delays." Certificial's insured and agent tiers are listed at $0. Docutrax charges the client. TrustLayer, illumend, PINS Advantage and COI Tracker publish nothing indicating a third-party fee.

NetVendor is the outlier that publishes one. Its enrollment FAQ states that "the annual enrollment fee is generally 149 per property management company or contractor, if applicable," and that "vendors enroll separately with each property management company or contractor they work with," which means a vendor working for several of your peers pays several times. A third-party-funded model can shift cost off your budget. It also puts a fee between you and the party whose documents you need, at the moment you want their cooperation.

Sources: bcs pricing · Certificial pricing · Jones pricing · TrustLayer plans · PINS Advantage pricing · NetVendor vendor enrollment FAQ · COI Tracker

Implementation, integrations, and getting your data back

The questions almost nobody asks until they are already committed.

Migration and the back book. You already hold certificates, requirement sets and a compliance history, plus a population in partial compliance. Ask what comes across, in what format, and who does the work. Then ask the harder one: does the new program re-review what is already on file, at what depth, and is that first pass included or billed separately? Certificial publishes "Concierge migration support" on its Enterprise tier. Most providers say nothing about migration on their pricing pages at all.

Time to live. Weeks or quarters from signature to a complete first compliance cycle across your existing population. Nobody publishes it. Asking is the point, and so is getting the answer in writing.

Configuration. Requirement sets take the time. Ask how many distinct sets are supported, whether they can be versioned, and what happens to third parties already reviewed under an older version when a requirement changes.

Integrations. Ask which of your systems it connects to, and name them. For a general contractor that usually means Procore, Viewpoint Vista, CMiC or Sage; for an asset manager, Yardi, MRI or AppFolio. TrustLayer publishes integrations with Procore, CMiC and Viewpoint Vista on its Pro tier. illumend publishes Procore, Viewpoint, CMiC and Yardi. Billy claims the deepest ERP integration in the category. Then ask the question behind the integration: can non-compliance place a hold on a payment? A payment hold is the only leverage most organizations have that does not require somebody to make a phone call.

Data ownership and exit. Ask who owns the documents and the review history, in writing, and what you receive on termination and in what format. A compliance file has to outlive the vendor relationship, because a completed operations claim can arrive years after the work finished.

Security. Ask for the current SOC 2 report rather than a badge on a website, and ask how long records are retained.

Who needs to be in the room. Risk, legal, accounts payable, the project or property teams who will field the vendor complaints, and IT security for the integration review. Buying this with risk alone is how programs end up configured against requirements nobody downstream agreed to.

Sources: Certificial pricing · TrustLayer plans · illumend · Billy comparison

Eight questions to put to any provider in writing

Including Docutrax. Written answers tell you more than any comparison page.

What exactly is reviewed: the certificate, the endorsement forms, or the policy? Get the scope into the contract, not the sales deck.

Do you review the actual additional insured endorsement form, or the certificate's statement that one exists?

Who chases the third party when a document is deficient, how many attempts are made, and who talks to their broker or agent?

When the review is automated, what happens to the documents the automation cannot resolve, and who resolves them?

Is human review included in the price, optional, or an additional cost?

What licenses or designations do the people reviewing our documents hold?

How do you handle a manuscript or non-ISO endorsement that does not match a standard form?

When coverage is removed mid-term, how do we find out?

Where Docutrax fits

Docutrax runs third-party insurance compliance as a managed operation. Licensed property and casualty professionals sit on the account, and CRIS-certified Account Managers handle the reviews that need construction risk expertise. Review runs at all three depths, certificate, endorsement, and forensic policy review, matched to the approved requirements and the exposure in each relationship rather than applied uniformly. When coverage falls short of what a contract requires, the Docutrax team gets involved to resolve it, working with the third party and their brokers and agents until it is corrected. The platform makes that review scalable, visible and auditable.

Docutrax has run third-party insurance compliance since 2012 and has reviewed more than 2,000,000 certificates, endorsements and policies across 2,500 or more cumulative client accounts. The platform is SOC 2 Type 2 certified.

What Docutrax does not do is decide for the client. It surfaces what the documents establish and what they do not, produces the documentation, and coordinates the escalation. The compliance decision stays where it belongs.