Delve’s Questionable Compliance Claims: What You Need to Know as a Compliance Tool Shopper
Overview
Delve (delve.co) is a Y Combinator-backed startup that positions itself as a fast, affordable path to SOC 2, HIPAA, ISO 27001, and GDPR compliance. Created by two MIT-educated founders, the company reportedly raised substantial funding and counts a large customer base. New scrutiny has emerged regarding the authenticity of their compliance documentation and the integrity of their auditing process.
What has come to light
– Public audit drafts exposed: In late 2025, a publicly accessible Google Sheet allegedly contained links to confidential draft audit reports from Delve’s pipeline. A detailed breakdown published in February 2026 analyzed these documents.
– Pre-filled audit conclusions: Drafts reportedly contained Independent Service Auditor’s Reports with conclusions already filled in prior to client submissions, suggesting conclusions existed before the actual audits.
– Uniform, templated content: A large majority of leaked reports appeared to use identical language and structure, differing only in company name, logo, and signature.
– Fabricated evidence: There are claims that Delve generated passing evidence for elements such as device security checks, background checks, and training, even when employees had not completed those tasks. Some board materials and risk assessments were allegedly available with one click.
– Questionable auditor relationships: Delve marketed its auditors as US-based CPA firms. Investigations reportedly traced the main SOC 2 auditor to Indian operations with US addresses, and an ISO 27001 auditor to a Wyoming shell entity with ties to an Indian parent company.
– Gaps in compliance: Reports alleged that significant framework requirements were skipped while still presenting 100% compliance to clients.
Response from Delve
– Denial and deflection: When confronted, CEO Karun Kaushik characterized the allegations as “falsified claims” from an “AI-generated email,” despite leaked reports bearing real client signatures and architecture diagrams.
Why this matters for organizations
– Potential regulatory risk: If you relied on Delve for HIPAA compliance, you could face criminal liability in healthcare contexts or severe penalties under GDPR for misrepresenting data protection status.
– Contractual and reputational exposure: Customers who depended on these certifications may pursue contract remedies or damages if the assurances were inaccurate.
– Real-world impact: Several organizations have been named in discussions surrounding the event, highlighting broader risk to customers who may have trusted the certifications.
What to do if you’re assessing compliance tooling
– Seek independent verification: If a vendor claims to hold certifications, request the auditing firm’s details and verify directly with the auditor.
– Beware “instant” or “certification in days” claims: Reputable SOC 2 Type 2 assessments typically require months of work and evaluation.
– Scrutinize evidence quality: Be cautious of pre-filled conclusions or uniform language across reports, and insist on primary source evidence and client-specific artifacts.
– Consider a staged approach: Use tools to assess control environments and readiness, but rely on established, verifiable audit processes for formal certifications.
Practical steps for affected organizations
– Initiate an independent assessment: Engage a reputable third-party auditor to review controls, evidence, and the integrity of any certifications previously issued.
– Re-examine vendor relationships: If you relied on Delve for certifications, assess contractual obligations, potential liability, and remediation plans with legal counsel.
– Communicate with stakeholders: Inform customers and partners of any actions taken to verify or rectify compliance positions, and outline steps to mitigate risk.
Note on this discussion
This article summarizes evolving information about Delve and related reports. If you have direct experience with Delve or feedback from your organization, sharing those insights could help others make informed decisions and prevent exposure to similar risks.
Disclaimer
This piece is intended to inform readers about concerns raised in public discussions and does not constitute legal or regulatory advice. Consult qualified professionals for guidance tailored to your specific certification needs and risk profile.
