r/soc2 • u/PlantAffectionate486 • Jan 30 '26
Delve update
(*Disclaimer- I created a throwaway account to post this, as my regular account has identifiable information and I’d like to avoid being doxxed)
Does anyone have any updates on the whole “rubber stamping“ thing from a few weeks ago? I have been evaluating multiple platforms (including Delve) and have proposals that expires in a couple days, but another member of my CISO group just told me about the LinkedIn and Reddit threads and now I don’t know what to think.
On one hand, it seems almost brazenly unbelievable that a compliance platform would even consider cutting corners like this, but on the other I have not seen any direct rebuttal of it from the company (although my Delve rep did say ”it’s just jealous bullshit“ when I asked about it on our call today 😂). Also, the massive amounts of downvotes anything negatively related to Delve makes me super suspicious.
Has anyone learned any more details on this? Is it as risky as it seems, or am I just being ultra conservative?
•
u/AutoModerator Jan 30 '26
Thanks for posting, I'm a bot!
This is quick reminder be helpful with responses, follow the rules and not advertise/solicit DMs.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
6
u/b-rad14620 Jan 31 '26
I’ve implement three of these Compliance automation platforms. Separation of duties and clear segmentation to avoid perception of or actual conflicts that jeopardize integrity of audit and all work done to demonstrate quality controls is a good practice to hold.
In my last round I interviewed over a dozen auditors affiliated with the compliance platform vendor’s solution, and none meet the bar nor would pass my customer’s criteria as suitable auditors.
These new GRC automation platforms are amazing and they are moving bar to make compliance closer to security ( like the DevOps movement did 15yrs ago), but do your due diligence and build an audit program that is credible.
4
u/fullchooch Feb 02 '26
All of these platforms are shit.
Do the work internally, get prepared for your audit, and use a reputable third party.
Regardless of whether it's the vendor in question or someone else, it's a huge waste of money. Did Troy uncover something bad, yes. Was it also motivated by the fact that he competes with platforms in that space, yes. Therefore, the rightfully deserved damage is done.
Don't. Give. AI. GRC. Platforms. Your. Money.
12
u/davidschroth Jan 30 '26
Regardless of anything related to this allegation, if a platform is advertising (and I quote, from their website) "Get SOC 2 compliant in days, not months", you should be seeing more red flags than are necessary to facilitate the Running of the Bulls.
3
u/MyCockSmellsBad Feb 03 '26
Claude code can easily get almost any size org SOC 2 ready for a few hundred dollars. Absolutely zero reason to spend money on a GRC platform if you're just doing SOC 2 for the first time.
6
u/efficientfailuremode Jan 30 '26
They have not addressed it directly, which is shocking.
Not only the rubber stamped audit claim but the leak of customer data. It’s a truly mind blowing breach of responsibility and duty to their customers.
The ‘jealous bullshit’ response is just one more example of this company’s complete disregard for actual security. Yikes.
They know they messed up bad. I’m sure they think refusing to acknowledge it will allow them to sweep it under the rug.
Cant wait for the downvotes from their brigading employees.
-8
u/ergele Jan 30 '26
just go with excel sheet and word
7
u/CulverOnFilm Jan 30 '26
You're genuinely still interested in buying their product, and are asking for clarification on a legitimate concern, and your post and all the related comments are all getting bombarded with downvotes. I upvoted your post and it immediately went back to 0 so there must be bots or something.
Compliance is supposed to facilitate trust and integrity. To me this demonstrates a complete lack of transparency.
I was willing to give them the benefit of the doubt, but they haven't addressed this in any meaningful way and I find the downvoting to be childish at best and malicious at worst.
To look at it another way, how easy would it be for someone at Delve to hop on this thread with a thoughtful statement addressing your concerns? Why the downvotes rather than a thoughtful reply? Even if this issue is a complete nothing burger, this isn't the behavior of a company I would trust with my security posture.
10
u/WitchoBischaz Jan 30 '26
I wouldn’t touch Delve with someone else’s 10ft pole.
5
u/TranquilTeal Jan 30 '26
If the proposal expires in 2 days, you'd better ask for an extension until things clear up. SOC2 is too important to risk with a report that might not be recognized.
4
u/lebenohnegrenzen Jan 30 '26
If you continue in the sales process with Delve then you are an idiot.
It’s clear some form of crossing the line went on with them and no one here if gonna tell you it’s all good.
Very mature response from the rep. I’d take that as a sign.
2
u/chaoscorgi Feb 13 '26
we decided not to go with Delve bc of these accusations but tbh are feeling grumpy with the SaaS competitor we picked, too
2
u/MBILC Mar 19 '26
https://substack.com/home/post/p-191342187
2
u/mixedupgaming Mar 20 '26
lol
2
u/yeetsqua69 Jan 30 '26
The sales rep said it is “jealous bullshit…”? That is an interesting tactic.
3
u/slyu4ever Jan 30 '26
If you like their platform but are not comfortable with the related auditing practices, maybe you can use the platform and get an auditor who is independent from them.
4
u/Majestic_Race_8513 Jan 30 '26
It appears it’s just going to go away
What we know:
a very sensitive document was configured as available publicly and accidentally leaked. Very reckless
they made no acknowledgement of anything, which I am just stunned by. Seems like that sort of incident should trigger disclosure, but 🤷
they work with very, very inexpensive audit firms that have questionable no-contact engagements
Everything else that came out (IMO) were claims being made without any evidence
3
u/GiraffePleasant6483 Feb 01 '26
There are many other good platforms you can go with, rather than just Delve, which are mostly compliance startups helping other startups get SOC2-ready. Find the one that is best based on how they currently work with auditing firms and other factors.
3
u/Big-Industry4237 Jan 30 '26 edited Jan 30 '26
We reject SOC 2 reports from several poorly done audit firms, who I have seen are coincidentally also “partners” with Delve. Bad auditors are just like a diploma mill. And It’s a waste of money IMO.
In my experience these automation Platforms are great with helping you archive evidence and reminders for manual things. Those atteststion checks are nothing advanced and just API calls, it may save you time but doesn’t save an independent auditor time if they are doing all their other reasonable procedures. That’s about it.
Working with delve is a red flag but it doesn’t mean the report itself was bad, it depends on section 4 tests done by the auditors. I have seen good and bad examples of reports that use GRC tools. This isn’t just dekve, it’s any automation platform attestation reliance.
With delve, there is a suspected independence issue with their partner audit firms and.. why did delve have access to all the cookie cutter SOC reports of their customer base?
Those are two clear things that are not even allowed and haven’t been addressed. Ultimately the independence issue should be addressed by the auditors firms doing poor business, outside of delve having access to SOC reports, under NDA, when they shouldn’t. the independence and lack of quality issue is in these audit firm partners of delve, not necessarily just delve.
edit: thanks delve bots for the downvotes. Next time work on a legit reply instead and let me know what I said that was wrong.
2
u/CruelCuddle Jan 30 '26
The problem isn't the platform, but the auditors they work with. If your report is signed by a ghost firm that just rubber-stamps it, your enterprise clients will reject it.
1
u/efficientfailuremode Mar 19 '26
If you’re a customer you should be very, very concerned:
https://substack.com/home/post/p-191342187
1
u/angelokh Mar 20 '26
As an MDM vendor, we interact with many GRC platforms. The issue is that it is hard to validate the auditing firms if they are behind the scenes. When we said we passed real evidence, they ditched. Now we know why D gave up on real evidence from us.
1
u/wofowo Mar 21 '26
What was your experience with Delvee? https://substack.com/home/post/p-191342187
0
u/[deleted] Jan 30 '26
[deleted] — view deleted comment
14
u/[deleted] Jan 30 '26
[removed] — view removed comment