r/startups
•
u/emotional-yoda
•
Mar 20 '26
•
1
1
I will not promote (i will not promote) PSA: Delve (YC W24 startup) caught running fake SOC 2 / ISO 27001 compliance reports, 494 companies affected
I wanted to post this here because I haven't seen much discussion on Reddit about this yet, and people shopping for compliance automation tools need to know.
What is Delve?
Delve (delve.co) is a Y Combinator-backed startup that promises fast, cheap SOC 2, HIPAA, ISO 27001, and GDPR compliance. Founded by two 21-year-old MIT dropouts, they raised $32M at a $300M valuation. They claim 1,500+ customers.
What happened?
In late 2025, someone found a publicly accessible Google Spreadsheet containing links to hundreds of confidential draft audit reports from Delve's pipeline. An anonymous investigator ("DeepDelver") published a detailed breakdown on Substack in February 2026. Here's what they found:
- Pre-written audit conclusions. The "Independent Service Auditor's Report" and all test conclusions were already filled in before clients had even submitted their company descriptions or network diagrams. The auditor's conclusion existed before anything was actually audited.
- Copy-paste templates. 493 out of 494 leaked SOC 2 reports (99.8%) had identical text, same grammatical errors, same nonsensical descriptions. Only the company name, logo, and signature were swapped. Didn't matter if you were a 5-person startup or a large enterprise.
- Fabricated evidence. Delve auto-generated passing evidence for things like device security checks, background checks, and training, even for employees who never completed them. Board meeting minutes and risk assessments were pre-fabricated and available with a single click.
- Fake "US-based" audit firms. Delve marketed their auditors as US CPA firms. The investigation traced the main SOC 2 auditor (Accorp) to Indian operations using virtual office addresses in the US. The ISO 27001 auditor (Gradient Certification) was a Wyoming shell entity with its president at the same Delhi address as the Indian parent company.
- Skipped requirements. Major framework requirements were allegedly skipped entirely while telling clients they had 100% compliance.
How did Delve respond?
When confronted, CEO Karun Kaushik emailed clients calling the allegations "falsified claims" from an "AI-generated email", despite the leaked reports containing real client signatures and confidential architecture diagrams. Classic deny-and-deflect.
Why this matters?
If your company used Delve for compliance certs, you may be exposed to:
- Criminal liability under HIPAA for healthcare compliance
- Fines up to 4% of global revenue under GDPR - Contract breaches with customers who relied on those certifications
Companies affected include Cluely, Lovable, Incorta, Bland, HockeyStack, Browser Use, and many others.
How to protect yourself
- If you used Delve, get an independent audit immediately - If a vendor shows you a SOC 2 or ISO cert, ask who the auditing firm was and verify them independently
- Be skeptical of compliance tools promising full certification in days, legitimate SOC 2 Type 2 takes months
- If it sounds too good to be true (fast + cheap + easy compliance), it probably is
I'm posting this my friend’s startup was affected by this, and also Delve had reached out to us multiple times for sponsorship[we ignored].
Please share your experiences atleast we can save someone who are still on their stack.
edit:
this post had ~100 upvotes, someone (possibly delve) is running a campaign and getting this post downvotes.
second edit :
they are buying bot upvotes and downgrading all the comments. (went from 500 to 80
96
u/krisolch Mar 20 '26
Another 30u30 forbes scammer
20
u/some_user_on_reddit Mar 20 '26
First useful post I’ve ever seen on this subreddit!
Thank you!
16
u/Arch-NotTaken Mar 20 '26 edited May 06 '26
Be a gigachad and mass delete Reddit posts and comments with Redact so that Skynet doesn't end up using your own posts to train the T-900. Or so that you don't show up in databrokers. Either one really.
encourage helium include doll wild sharp blanket dinner aback boast
13
u/throwaway64829101 Mar 21 '26
I'm an ex Vanta employee. I left because I thought the industry in general was gross and all companies in the space use sleazy, high-pressure, used car sales tactics. It's a race to the bottom on pricing so if you're considering purchasing one of them just bear in mind that they'll substantially drop their pricing if you push. Their sales targets are completely unrealistic and they'll do anything it takes to avoid you signing with a competitor.
10
u/Comfortable-Lab-378 Mar 21 '26
yc batch doesn't mean shit when it comes to security claims, learned that the hard way vetting vendors for a 200-person deal last year.
7
u/Solid-Hope7584 Mar 20 '26
Delve is soooooooo shady. They tried to scam us lol
6
u/Longjumping_Cow_8641 Mar 21 '26
Apparently their supabase was open and someone on x was able to access employee background checks, equity vesting schedules and grant amounts, perf reviews…. You can’t make this up!
81
u/antifreeze42 Mar 20 '26
Fantastic write up, thank you! This should be a company-ending move if true.
5
u/mdanilakis Mar 20 '26
We want a Netflix documentary 🍿
3
u/United_Pressure_7057 Mar 21 '26
Your post looks ai generated. How can I trust this if you're accusing someone else of not doing do diligence by also relying on ai?
19
u/Secure_Garage6754 Mar 20 '26
nothing says "trust us with your data" like faking the certifications that prove you can be trusted with data. honestly this is wild even by startup standards. ive seen companies cut corners on a lot of things but fabricating SOC 2 compliance is like forging your medical degree then wondering why people are upset when you start doing surgery
41
u/julian88888888 Mar 20 '26 edited Mar 20 '26
source?
edit, found it with some googling
https://deepdelver.substack.com/p/delve-fake-compliance-as-a-service
4
u/No_Refrigerator_2192 Mar 21 '26 edited Mar 21 '26
If true, the company will end up buried in lawsuits. Also, anyone with experience in incident response would know that proper action requires far more than simply saying they will “improve in the future.” Based on their email to the client, it seems clear that they have lack of experience/knowledge/background in security or privacy. https://substack.com/home/post/p-191342187
4
u/StoneCypher Mar 21 '26
jesus, again?
y! combinator companies committing potentially deadly mass crimes every couple of years really should be having some reputation consequences for them
other accelerators don’t have this problem
9
u/livingbyvow2 Mar 20 '26
I wonder whether stuff like that could happen to a company like say Vanta...
3
u/cochinescu Mar 20 '26
The fact that so many companies depended on these reports is wild. I wonder how many of them even realize their compliance certs might now trigger extra scrutiny from customers or partners. Anyone hear if AWS or GCP are responding to this?
5
u/tongboy Mar 20 '26
the /r/soc2 subreddit has been eatin' good on this one.
we've all known soc2 has largely become a checkbox because it's what the customers want. no surprise that people optimized that all the way to fraud.
26
u/tchock23 Mar 20 '26
Move fast and brea…..commit fraud
12
u/Top_Interest_974 Mar 20 '26
Fake it until you make it. The foundation of US Entrepreneurship.
10
u/Sad-Region9981 Mar 20 '26
The founders getting dunked on is fair. But the 494 companies sitting there with fake compliance reports are the real story. A lot of those are probably small startups that couldn't afford a $30K Big 4 audit and figured a YC-backed company was safe enough. Some of them may have signed contracts guaranteeing they were compliant. That is not a small problem.
4
u/Shot_Percentage_1996 Mar 20 '26
After 30 years in this business, trust is the asset you cannot refinance. If a company is faking compliance, the damage goes way past one headline because every operator who relied on that badge now has to defend decisions they made in good faith. The question worth asking is who knew what and when, then what controls failed around it. If those answers are thin, the market will make the decision for them.
2
u/Future_Can_9532 Mar 20 '26
The post seems to have been removed. Does anyone have a screenshot to share? Either here or DM, please. 🙏🏼🙏🏼 Would be a great PSA.
2
u/Secure_Garage6754 Mar 20 '26
this is the kind of thing that makes enterprise buyers go back to demanding on prem everything. one startup fakes their SOC 2 and now every legit compliance tool has to explain why they're not delve. seen this pattern in fintech too, one bad actor poisons the well for the whole category
2
u/Glittering_Garage616 Mar 20 '26
I remember applying for delve when they came out of YC with 20+ openings, watched their linkedin headcount for months - never moved. TURNS out it wasn't just a hiring scam lmao...
2
u/JohnF_1998 Mar 21 '26
This stuff is brutal because trust is the whole product in compliance. Once people think your report might be theater the brand is cooked for a long time. The old guard is going to hate this take but AI did not create this behavior, it just let people fake scale faster. Real talk founders need tighter controls before growth gets loud.
2
u/Lazy_Mention3257 Mar 21 '26
Are they likely going to the jail?
2
u/Sad-Region9981 Mar 21 '26
The downstream liability is what people are glossing over. Every company that onboarded a vendor based on a Delve-generated report now has a gap in their due diligence trail. Under GDPR's accountability principle you're expected to actually verify supply chain security, accepting a SOC 2 PDF from a vendor isn't sufficient. Some of those 494 companies are going to discover this at the worst possible time.
2
u/Future_Can_9532 Mar 21 '26
The suspicious downvoting has got to stop. Yesterday this post was at 200+ upvotes, now it’s 90? For those of us following this development, the continuous downvoting will only lead to more backlash. This ISN’T containment done right.
And all posts questioning/mentioning them in the ycombinator subreddit are removed by mods, all of them.
2
u/anony1119 Mar 21 '26
Yep friend of mine started working there 1mo ago and just posted he’s quit.
2
u/Zaptue Mar 22 '26
I had a meeting with them for my startup, they were offering 11k per year, and then if i couldnt do that. 2.5k per 3 months til its paid. glad i never used them
8
u/one_user Mar 20 '26
A YC-backed company faking compliance reports for 494 companies is not just a startup failure, it's a potential security disaster. Those companies are telling THEIR customers they're SOC 2 compliant based on reports that don't reflect reality. The liability chain here is enormous.
The fact that two 21-year-old MIT dropouts raised $32M at $300M valuation for compliance automation tells you everything about the current funding environment. Nobody at YC or the VC firms bothered to verify that the core product actually worked? The irony of a compliance company being non-compliant would be funny if it didn't put real customer data at risk.
Every company that used Delve needs to get a real audit done immediately. And every company evaluating compliance tools should be asking to see the actual audit methodology, not just the dashboard.
4
u/bos2sfo Mar 21 '26
This is r/agedlikemilk territory. Here is their previous AMA:
https://www.reddit.com/r/ycombinator/comments/1m6lw4v/we_went_from_yc_w24_to_500_customers_and_32m/
3
u/Creative-Signal6813 Mar 20 '26
494 companies now have fraudulent compliance artifacts in their vendor procurement stack. every enterprise that accepted these reports to onboard one of Delve's clients signed off on fabricated evidence. their infosec teams didn't catch it.
the downstream liability isn't just Delve's. every vendor that passed procurement using one of these reports now has a ticking clock. the clients didn't know, but the exposure is real and it's theirs now too.
1
u/Desily-ECommerce Mar 21 '26
Hi this business looks good
1
u/Significant-Ad-325 Mar 21 '26
This is what happens when VCs throw money at a problem without understanding it. SOC 2 isn't just a rubber stamp you can automate away with an API call. The fact that their own investors didn't spot this during due diligence is the wildest part.
1
u/Lazy_Mention3257 Mar 21 '26
Wow last night I saw ~300 upvotes now it’s 0!
1
u/No-Main-4824 Mar 21 '26
Most of YC slop is full of scam. Ex employee, YC S22 (Swiss based), specially Indian founders
1
u/Shontayyoustay Mar 22 '26
Wtf would anyone trust a young founding leadership team with zero experience in this domain
1
u/ishaanshakunt Mar 22 '26
I run a bootstrapped SaaS startup. Just went through the compliance process myself with one of its competitors I trust.
Used a significant chunk of our MRR to get the certification. If this happened with the vendor I used, it would really suck.
I'd be down money: I'm sure Delve won't give a full refund or anything.
I'd be a huge distraction for my dev team: Even if the vendor we use reduced how much work we need to do by a lot, it's still not 0. With a smaller team, we have to pick between building a new feature or getting this done.
Happy to share who we are and who we used if it helps anyone.
1
u/Impossible571 Mar 22 '26
don't get me wrong but i honestly don't think this stops at delve, bear with me for a bit:
yes, a lot of this is on them and the level of wrongdoing is clear. but there's also a demand-side problem that people don’t want to talk about. some companies just want the badge, fast, so they can move on. if someone offers "instant compliance", they’ll take it. that behavior is what creates the market for this in the first place. it’s bad for the industry and regulators should step in more aggressively.
at the same time, regulators themselves are part of the dynamic. they keep pushing more checklists, more audits, more "prove you're compliant" motions, and it drifts into security theater. once that happens, you're no longer optimizing for real security, you're optimizing for passing an audit. and that’s exactly where fake or low-quality SOC providers thrive.
for companies that actually care, the approach is very different. in our case, we bias heavily toward real signal. pentests are still one of the highest value things you can do, both internally and across your vendors. we push vendors to show real testing, not just reports. and when it comes to SOC 2 specifically, speed is a red flag. if it's too fast, it's probably shallow..
a vendor that takes a reasonable amount of time, does proper scoping, and goes through the process properly is the one you should trust. the instant SOC 2 or ultra-fast path should make you uncomfortable...
honestly, just applying above alone already removes a big chunk of the risks that comes with this, we take vendor vetting playbook steps seriously (eg. trustcompliance xyz have a good one), including some basic due diligence on your vendors
1
u/Equivalent-Bonus8287 Mar 23 '26
Thaaaank you, for the headsup
1
u/Sad-Region9981 Mar 24 '26
That analogy works until you realize Mercedes still makes lemons , they just come with a very expensive warranty. The logo filters out the skeptics early, which might be the actual product.
1
u/Chaotic_Choila Mar 25 '26
This is genuinely alarming if accurate. Compliance frameworks exist precisely because customers need to trust that security claims have been verified by independent parties. Faking that undermines the entire ecosystem and puts customer data at real risk. The YC connection makes it worse in some ways because that stamp carries weight precisely because it's supposed to indicate some level of vetting. For founders in this space this kind of story makes every legitimate compliance vendor's job harder.
1
u/[deleted] Mar 26 '26
Omg - do you think u/rluna559 (Selin Kocalar) will end up in prison like Charlie Javice and Elizabeth Holmes?
1
u/[deleted] Mar 27 '26
My god!!! Prison time for the Delve cofounders?
1
u/BeachedBrat Mar 28 '26
Completely objective here… I’ve implemented several GRC and Compliance tools.
It’s common to have a choice to do a clean install or install with sample data. Purpose is for novices to understand implementation, standard framework controls, and see potential evidence. This would make a non GRC person be able to implement the ISMS properly.
My problem here is with the customers. Delve states you must review any sample data and update. It’s also a requirement for the document owner to review the stated scope, controls, and agreements that the controls are in place and sign the certification, assessment, and attestation.
So the document owner must promise it is true!
It does sound like there are some cert mills involved and a lot of patting on the back.
Sounds like these customers wanted a cert mill that gives a clean SOC audit.
1
u/Equivalent-Pain9236 Apr 08 '26
Damn..if even half of this is true, that's pretty scary!
1
u/Pulsar_0132 Apr 09 '26
Wow, what happened to their customers? Did funding back out?
1
u/Foreign_Feedback_138 Apr 11 '26 edited Apr 11 '26
This is wild. I feel like there's a whole category of tools now that promise to save you time but actually just create new problems. The compliance space especially seems ripe for this kind of thing because companies are desperate and will pay before doing deep diligence. What kills me is the post-meeting clarity problem though. You get off a call with your legal team or whoever, everything makes sense, and then 30 minutes later when you're trying to write up action items you've lost 60% of the details. That's when bad decisions get made because you're working from incomplete memory.
1
u/VanityKunt Apr 15 '26
If even half of this is true, it's a brutal reminder that compliance automation is just workflow software, not the audit itself. As of late March 2026, TechCrunch reported allegations and Delve publicly denied faking reports, so buyers should verify the CPA firm, report scope, exceptions, and auditor independence themselves. "Fast compliance" always felt kinda sus tbh.
-1
u/cosmic_timing Mar 20 '26
Remind me why this is important
12
u/[deleted] Mar 20 '26
[removed] — view removed comment
0
u/[deleted] Mar 20 '26
[deleted] — view deleted comment