Skip to content

Certificate of Insurance compliance

Never let an uninsured sub step on your jobsite again.

Pikorua Security reads every COI, verifies the endorsements behind it, and chases brokers automatically before a non-compliant vendor mobilizes.

Keystone Mechanical LLC · HVAC · Project 2214, Riverside Medical Office

Auditing packet

Packet pages

  1. p.1ACORD 252016/03
  2. p.2CG 20 1004 13
  3. p.3CG 24 0405 09
  4. p.4Excl. sched.Carrier form
  5. p.5WC 00 03 13NCCI
  6. p.6Umbrella decFollow form

0

checks passed

0

deficiencies

Audit stream

  1. Reading page 1 of 6

Writes holds and compliance status into the systems your teams already run.

  • SOC 2 Type II
  • ACORD 25 & 28
  • Every ISO endorsement page
  • Procore logoProcore
  • Autodesk Construction Cloud logoAutodesk Construction Cloud
  • Yardi Voyager logoYardi Voyager
  • AppFolio logoAppFolio
  • CMiC logoCMiC
  • MRI Software logoMRI Software
  • RealPage logoRealPage
  • Entrata logoEntrata
  • Bullhorn logoBullhorn
  • Brivo logoBrivo
  • Viewpoint Vista logoViewpoint Vista
  • Foundation Software logoFoundation Software

ACORD

Certificate of liability insurance

Date (MM/DD/YYYY)

10/14/2026

This certificate is issued as a matter of information only and confers no rights upon the certificate holder.

INSR LTRType of insuranceADDL INSDACommercial general liability, occurrenceX
The box is checked. The endorsement that actually grants coverage is somewhere else, or nowhere.

The ACORD 25 illusion

That certificate in your file probably doesn't protect you.

Project managers collect ACORD 25s and check the additional insured box. Then a claim lands, and the sub's carrier denies your tender because the policy had CG 20 10 without CG 20 37, or an exclusion nobody read. Your own policy and your retention pay the defense.

Why CG 20 37 decides completed-operations claims
of subcontractor and vendor COIs contain material coverage deficiencies or missing endorsements on first review
71%
of subcontractor and vendor COIs contain material coverage deficiencies or missing endorsements on first review
AGC Risk Committee Audit
average out-of-pocket litigation and SIR loss when an additional insured tender is rejected
$150,000+
average out-of-pocket litigation and SIR loss when an additional insured tender is rejected
IRMI Construction Risk Analysis
spent emailing subs and brokers back and forth to collect one compliant replacement certificate
28 days
spent emailing subs and brokers back and forth to collect one compliant replacement certificate
Pikorua Security Benchmark Data

How it works

Four steps. The fourth one is the one that matters.

rule_set "Exhibit B: HVAC, tier 2" {
  applies_to  = project("2214 Riverside MOB")
  gl.each_occurrence      >= 1_000_000
  gl.general_aggregate    >= 2_000_000  per_project  # CG 25 03
  gl.products_completed   >= 2_000_000
  auto.combined_single    >= 1_000_000
  umbrella.each_occ       >= 5_000_000  follow_form
  wc.employers_liability  >= 1_000_000

  require endorsement CG_20_10 | CG_20_38   # ongoing ops
  require endorsement CG_20_37              # completed ops, 3 yrs
  require endorsement CG_20_01              # primary & non-contrib.
  require waiver CG_24_04, CA_04_44, WC_00_03_13
  carrier.am_best         >= "A- VII"
  reject  exclusion CG_21_39, residential_work
}

The difference

Basic COI tools check the front page. Pikorua Security verifies the legal endorsements.

A checked box on an ACORD 25 is not coverage. The endorsement form on page 4 is. Here is the same subcontractor packet run through both.
Same vendor, same 6-page packet, two tools.

Front-page COI toolTender denied after loss

  1. 1Day 0Reads ACORD 25 front page
  2. 2Day 0Sees ADDL INSD box checked
  3. 3Day 0Marks vendor Compliant
  4. 4Month 14Water intrusion claim, 8 months after completion
  5. 5Month 15Carrier denies AI tender: no CG 20 37

Pikorua SecurityFixed before mobilization

  1. 100:02Parses all 6 pages of the packet
  2. 200:04Finds CG 20 10 on page 2, no CG 20 37
  3. 300:07Flags completed operations gap
  4. 400:10Requests CG 20 37 from the broker
  5. 5Day 3Endorsement uploaded, tender-ready file

Benchmark data

Where the 71% comes from.

Missing completed operations coverage is the most common gap, and the most expensive one: defect and water claims surface months after a sub has left site.

  • 64% of COIs claiming additional insured status fail to attach the CG 20 37 completed operations endorsement.
  • 25% to 35% of active subcontractor policies expire mid-project unnoticed when tracked in spreadsheets.
Read the 2026 benchmark report
Share of first-submission COIs with each deficiencyA single certificate often carries several, so shares sum past 71%.71%defective on first review
  • Missing CG 20 37 completed operations64%
  • Named insured mismatch48%
  • No waiver of subrogation (CG 24 04 / WC 00 03 13)41%
  • Primary & non-contributory wording absent37%
  • Limits below contract exhibit29%
  • Expired or expiring within 30 days22%

Sources: AGC Risk Committee Audit; IRMI Construction Risk Survey; National Construction Risk Audit; Pikorua Security 2026 benchmark

From the field

Risk, operations and finance, on the same file.

Customer stories
  • “Pikorua Security found 31 subs on active jobs with CG 20 10 and no completed ops form. Every one of those files would have failed a tender.”

    VP Risk Management

    ENR Top 100 commercial general contractor

  • “My project engineers stopped calling insurance agents. The broker gets one exact request and uploads the endorsement from a link.”

    Director of Construction Operations

    Mid-Atlantic commercial GC, $180M annual volume

  • “Holds land in Procore the minute a policy lapses and release the minute it is fixed. Nobody on my team touches it.”

    Controller

    Regional healthcare and education builder

  • “One rejected tender costs us our full $250,000 retention. Pikorua Security Professional costs about 3% of that a year.”

    Chief Financial Officer

    Self-performing GC, 220 active subcontractors

99.4%endorsement verification accuracy across ISO forms

28 days to 4.2 daysaverage broker resolution time

100%tender acceptance on claims with verified endorsement packets

Security

Vendor policies, limits and tax IDs deserve better than a shared drive.

SOC 2 Type II, encrypted end to end, and never used to train models. US customer data is hosted on AWS in us-east-1 with us-west-2 failover.
Security overview
  • SOC 2 Type IIIndependently audited controls
  • AES-256 + TLS 1.3At rest and in transit
  • Zero model trainingYour COIs never train AI
  • US data residencyAWS us-east-1, us-west-2 failover
  • SSO and rolesPM, risk, accounting, admin

Risk exposure

Calculate your un-tendered claim exposure.

150
General liability SIR or deductible
Likely defective COIs in your files
107
Out-of-pocket on one rejected tender
$250K+
Admin hours chasing brokers each year
600
Run the full calculation

FAQ

Questions risk managers ask first.

Something else? Call +91-80-4123-7190 or write to sales@pikoruasecurity.com.

How does Pikorua Security read non-standard or custom carrier endorsements?
Manuscript and carrier-specific forms go through the same vision pipeline as ISO forms. Pikorua Security classifies each page, extracts the form number and edition where one exists, and then reads the operative wording: who is scheduled, whether coverage applies to ongoing or completed operations, the other-insurance language and any exclusions. When wording departs from your exhibit, the finding quotes the clause and cites the page so a risk manager can make the call in seconds.
Does Pikorua Security contact the subcontractor or their insurance broker directly?
Yes, both. Pikorua Security reads the producer block on the ACORD 25 and sends one deficiency notice to the vendor and its retail agent at the same time, naming the exact endorsement or limit that is missing and the wording your contract requires. The broker uploads the fix through a tokenized link with no account to create. You choose the sender name, cadence and escalation contacts per project.
What happens when a policy expires mid-project?
Renewal requests start 60 days before expiry, with reminders at 30, 15 and 0 days. If the renewal has not been verified by the expiry date, the vendor flips to non-compliant, the payment hold and badge suspension rules you configured fire automatically, and the project team gets a single digest instead of a pile of alerts.
How does the Procore payment hold work?
Pikorua Security maps each vendor to its Procore company record and commitments. When a vendor becomes non-compliant, Pikorua Security writes the compliance status to the vendor and holds payment on the affected subcontract commitments, with the reason attached. When the corrected endorsement is verified, the hold releases and the event is logged with a timestamp in the tender defense vault.
How long does implementation take?
Most Starter and Professional customers are live in under two weeks. Day one is your requirement exhibits and a bulk upload of current certificates; Pikorua Security audits the backlog within 48 hours. Procore, Yardi or AppFolio connections take an afternoon. Enterprise rollouts with multiple entities and access control typically run four to six weeks with a dedicated risk engineer.
Is our vendor data secure?
Pikorua Security is SOC 2 Type II audited, encrypts data with AES-256 at rest and TLS 1.3 in transit, and hosts US customer data on AWS in us-east-1 with us-west-2 failover. Vendor tax IDs are masked and field-level encrypted. Customer certificates and contracts are never used to train AI models.

14-day free production trial

Stop letting non-compliant vendors expose your balance sheet.

Upload your current subcontractor COI files. Pikorua Security shows you every hidden coverage defect in 10 minutes.