Construction Management integration
Procore COI compliance integration
Write verified insurance status straight into the Procore Directory and let Procore Pay stop the payment. Pikorua Security reads each subcontractor's certificate and endorsement pages, checks them against the commitment's insurance exhibit, and keeps the company's Insurance tab current, so a lapsed or deficient policy blocks payment on the commitment before your project accountant approves the invoice.
Procore, Harbor Point Medical Office
Commitment SC-0412
Payment hold: COI deficient
GL 7741-0093-22 expired 10/15/2026 and completed operations coverage is missing. The Insurance Compliant requirement prevents payment.
- Contract company
- Ridgeline Roofing Inc.
- Subcontract value
- $1,284,500.00
- Invoice #07
- $184,220.00, payment blocked
- Insurance status
- Non-Compliant
- GL expiration
- 10/15/2026
- Additional insured
- CG 20 10 04 13 only
Written by Pikorua Security Oct 16, 2026, 06:00 AM ET
- Setup time
- 45 minutes
- Connection
- OAuth 2.0 app + REST API + webhooks
- Fields synced
- 8 fields, 5 trigger events
- Included on
- Professional and Enterprise
Sync fields
What Pikorua Security reads from and writes to Procore.
| Field | Direction | What happens |
|---|---|---|
| Company Directory | Procore to Pikorua Security | Companies with trade, address and primary contact become Pikorua Security vendors. Matching uses the legal name and your vendor code, so "Ridgeline Roofing" and "Ridgeline Roofing Inc." resolve to one record. |
| Commitments (subcontracts and purchase orders) | Procore to Pikorua Security | Contract number, value, project and status tell Pikorua Security which requirement template applies and which subcontractors are active on site. |
| Subcontractor invoices | Procore to Pikorua Security | Billing period, amount and status are read so the hold report shows the dollars waiting on each deficiency. |
| Insurance tab: type, provider, policy number, limit amount, dates | Pikorua Security to Procore | Written from the verified certificate and policy pages, one insurance record per coverage line, instead of keyed from the front of an ACORD 25. |
| Additional Insured | Pikorua Security to Procore | Set only when the endorsement itself (CG 20 10, CG 20 26 or a blanket CG 20 38) is verified, not when the certificate box says Y. |
| Insurance status | Procore syncs both ways with Pikorua Security | Pikorua Security sets Compliant or Non-Compliant from your rules. If someone changes a status by hand in Procore, Pikorua Security records who and when and flags the override for the risk team. |
| Certificate and endorsement files | Pikorua Security to Procore | The verified certificate PDF and endorsement pages attach to the insurance record, so field staff see the same evidence the risk team does. |
| New company and commitment events | Procore to Pikorua Security | Procore webhooks start a compliance request the moment a company or commitment is created, instead of waiting for a nightly sync. |
Trigger events
When the certificate changes, Procore changes with it.
- Release
Policy expires with no verified renewal
Then: The matching insurance record moves to Non-Compliant. With your Procore Pay insurance requirement set to Required and Prevents Payment, Procore blocks payment on that subcontractor's commitments until the status changes.
- Hold
CG 20 37 completed operations endorsement missing
Then: Status set to Non-Compliant with the missing form number in the record's notes, and the subcontractor's broker receives a deficiency checklist in the same minute.
- Hold
Limits below the commitment's insurance exhibit
Then: Non-Compliant with the shortfall stated in plain words, for example "GL aggregate $1,000,000 vs. $2,000,000 required".
- Warn
Policy expiring in 30 days
Then: Expiration date confirmed and the broker receives the day-30 request. Status stays Compliant, so no payment is blocked early.
- Release
Renewal verified
Then: Insurance records update with the new policy number and dates, the status returns to Compliant, and the next invoice clears the insurance requirement without anyone touching Procore.
Setup
Live in 45 minutes.
6 steps, done by your Procore administrator and a Pikorua Security Admin together. Nothing to install on your servers.
OAuth 2.0 app + REST API + webhooks- 1
Install the Pikorua Security app
A Procore company admin installs the Pikorua Security app by its app ID in App Management and approves its permission set: Directory, Commitments and Invoicing read access, plus write access to company insurance.
- 2
Authorize with OAuth 2.0
The admin signs in to Procore from Pikorua Security's Integrations screen. Pikorua Security stores the refresh token encrypted and never sees a password.
- 3
Map companies
Pikorua Security imports the Company Directory and proposes matches to existing vendors. Review the exceptions, usually duplicates and DBA names.
- 4
Assign requirement templates
Link each project, or each commitment type, to a contract exhibit template so a $40,000 landscaping purchase order and a $4 million steel subcontract are held to different limits.
- 5
Set payment enforcement
In Procore Pay, set the Insurance Compliant payment requirement to Required and Prevents Payment, then choose in Pikorua Security which rule failures mark a company Non-Compliant.
- 6
Preview, then go live
Run the preview to see which companies would turn Non-Compliant today, send their brokers the checklist first, and switch on write-back.
How the hold actually happens in Procore
Procore already has the parts for insurance enforcement. Every company in the Directory has an Insurance tab with type, provider, policy number, limit, effective and expiration dates, an Additional Insured indicator and a status. Procore Pay can treat that status as a payment requirement, and when the requirement is set to Required and Prevents Payment, a commitment whose subcontractor is not Compliant cannot be paid. The weak link has always been the data: someone types expiration dates off the front of an ACORD 25 and marks the record Compliant.
Pikorua Security replaces that typing. The status Procore enforces is written from a verified packet: the certificate, the policy declarations where provided, and the endorsement pages themselves. A certificate that says "additional insured: Y" but attaches only a CG 20 10 04 13, against a subcontract that requires completed operations coverage, stays Non-Compliant because the CG 20 37 is not there.
Procore Pay treats every status other than Compliant, including Compliant - In Progress, as not compliant. Pikorua Security writes only Compliant and Non-Compliant, so nobody is surprised on payment day.
When you do not pay through Procore Pay
Not every general contractor pays subcontractors through Procore Pay. If checks are cut in an ERP such as CMiC or Viewpoint Vista, Pikorua Security still keeps the Procore Directory current for project teams and places the actual hold in the ERP, using the same verdict. Project managers see the reason in Procore; the accounting team sees the hold where the money moves.
Either way, the verdict is made once. Procore and the ERP never disagree about whether Ridgeline Roofing Inc. is compliant, because neither system decides it.
What field teams see
Superintendents rarely open the Insurance tab, so Pikorua Security writes a short status line to the insurance record's notes: what failed, when the broker was contacted, and the expected cure date. When a subcontractor asks why its invoice is stuck, the answer is in Procore, in plain language, with the deficiency letter attached.
- Missing CG 20 37 04 13 for completed operations
- Waiver of subrogation (CG 24 04) not attached
- Workers compensation expired 10/15/2026, broker contacted 10/16/2026
More construction management connectors
Teams that connect this usually connect these too.
FAQ
Procore connector questions.
Pikorua Security is compliance software. It verifies certificates and endorsements against your contract requirements; it does not sell insurance or give legal advice.
Does Pikorua Security need Procore Pay to hold payments?
Which Procore permissions does the app request?
What if a project manager marks a company Compliant by hand?
Do subcontractors need a Pikorua Security login?
14-day free production trial
Connect Procore during your 14-day trial.
Upload your current certificates, authorize Procore, and see which vendors would be on hold today before you switch a single rule on.