Sonny Valindra
An anonymous Substack post published this week has cast a significant shadow over Delve, a Y Combinator-backed compliance startup, with accusations of "falsely" convincing "hundreds of customers they were compliant" with critical privacy and security regulations. The allegations, if proven true, could expose these customers to severe repercussions, including "criminal liability under HIPAA and hefty fines under GDPR," according to the post. Delve, which last year announced a substantial $32 million Series A funding round at a $300 million valuation, led by Insight Partners, has vehemently refuted these claims, labeling the Substack post as "misleading" and containing "a number of inaccurate claims."
The explosive allegations originate from a Substack user identifying as "DeepDelver," who claims to have been an employee at a former Delve client. DeepDelver’s account details a disturbing chain of events that reportedly began in December with the discovery of an email suggesting a breach, where a "spreadsheet with confidential client reports" was allegedly leaked. While Delve CEO Karun Kaushik reportedly reassured customers that compliance was maintained and no sensitive data was accessed externally, DeepDelver and other clients grew suspicious due to a perceived underwhelming experience with Delve’s services. This shared unease reportedly led to a collaborative investigation by these clients.
The Core of the Accusations: Fabricated Evidence and Rubber-Stamped Audits
DeepDelver’s investigation culminated in a stark conclusion: Delve allegedly achieves its promised speed and efficiency by producing "fake evidence, generating auditor conclusions on behalf of certification mills that rubber stamp reports, and skipping major framework requirements while telling clients they have achieved 100% compliance." The Substack post elaborates on these accusations, alleging that Delve provided customers with "fabricated evidence of board meetings, tests, and processes that never happened." According to DeepDelver, clients were then presented with a choice: either adopt this fabricated evidence or undertake significant manual work, undermining Delve’s purported automation and AI capabilities.
Further fueling the controversy, DeepDelver pointed to a pattern involving virtually all of Delve’s clients allegedly engaging with two specific audit firms: Accorp and Gradient. These firms, described as operating primarily from India with only a nominal U.S. presence, are characterized as being "part of the same operation." DeepDelver asserts that these firms are merely "rubber-stamping reports that were generated by Delve," thereby inverting the traditional compliance structure. By generating auditor conclusions, test procedures, and final reports before any independent review, Delve, according to the accusation, assumes the dual role of both implementer and examiner. This, the post argues, constitutes a "structural fraud that invalidates the entire attestation." Beyond misleading clients about their own compliance, Delve is also accused of helping customers "mislead the public by hosting trust pages that contain security measures that were never implemented."
The personal account from DeepDelver includes a poignant detail: during discussions about these compliance issues, Delve allegedly sent "multiple boxes of donuts already to keep us happy." Despite these efforts, DeepDelver’s employer reportedly un-published its trust page and ceased relying on Delve for compliance services.
Delve’s Defense: Automation Platform, Not Report Issuer
In a swift response published on its blog, Delve categorically denied the allegations. The company stated that it does not issue compliance reports itself. Instead, Delve positions itself as an "automation platform" designed to ingest compliance-related information and provide auditors with access to this data. "Final reports and opinions are issued solely by independent, licensed auditors, not Delve," the company asserted.
Delve elaborated that its customers have the option to work with an auditor of their choosing or select one from Delve’s "network of independent, accredited third-party audit firms." These auditors, the startup emphasized, are "established firms used broadly across the industry, including by other compliance platforms." Addressing the accusation of providing "fake evidence," Delve countered that it offers "templates to help teams document their processes in accordance with compliance requirements, as do other compliance platforms." The company clarified that "draft templates are not the same as ‘pre-filled evidence.’" Delve also stated that it is "actively investigating any leaks" and is "still reviewing the Substack."
Expanding Concerns: Security Vulnerabilities and Leaked Data
The controversy surrounding Delve’s compliance practices took a further turn with subsequent reports detailing alleged security vulnerabilities. Following the initial Substack post, an X user named James Zhou claimed to have gained access to sensitive Delve information, including employee background checks and equity vesting schedules. Jamieson O’Reilly, founder of Dvuln, shared additional details from a conversation with Zhou, reportedly outlining "several gaping security holes in Delve’s external attack surface." This adds another layer of concern, suggesting potential systemic issues beyond the compliance claims.
TechCrunch’s attempts to solicit further comment from Delve were met with an email bounce, though a subsequent calendar invite for a "Delve demo" was received. TechCrunch has also indicated it reached out to DeepDelver for additional commentary.
Broader Implications for the Compliance and Startup Ecosystem
The allegations against Delve raise critical questions for the rapidly growing compliance technology sector and the broader startup ecosystem, particularly those operating within highly regulated industries like healthcare and data privacy.
Timeline of Events (Inferred and Reported):
- December (Year Prior to Post): DeepDelver reports receiving an email about a potential client data leak. Delve CEO Karun Kaushik reportedly communicates with clients, assuring them of continued compliance.
- Following December: DeepDelver and other former Delve clients, experiencing dissatisfaction, reportedly begin a collaborative investigation.
- This Week: An anonymous Substack post by "DeepDelver" is published, detailing accusations of "fake compliance" and fabricated evidence.
- Within Days of Substack Post: Delve publishes a blog post refuting the claims, calling them "misleading."
- Following Delve’s Response: Reports emerge on X detailing alleged security vulnerabilities and data access at Delve.
- Present: Media outlets, including TechCrunch, are actively investigating and seeking further comment from both Delve and the accusers.
Supporting Data and Context:
The compliance market is experiencing significant growth, driven by increasingly stringent regulations globally. The Health Insurance Portability and Accountability Act (HIPAA) in the United States imposes strict rules on the handling of protected health information (PHI), with violations carrying civil penalties that can range from $100 to $50,000 per violation, and up to $1.5 million per year for identical violations. Criminal penalties can also apply for knowingly obtaining or disclosing PHI.
The General Data Protection Regulation (GDPR) in the European Union, which came into effect in 2018, imposes robust data protection and privacy rules for individuals within the EU and EEA. Fines for GDPR violations can be substantial, reaching up to €20 million or 4% of global annual revenue, whichever is higher. Companies worldwide that process the personal data of EU residents must comply.
Startups like Delve aim to streamline the complex and often resource-intensive process of achieving and maintaining compliance. Y Combinator’s involvement signifies a level of vetting and potential for rapid growth, while a $32 million Series A at a $300 million valuation indicates significant investor confidence in Delve’s market potential and business model. Insight Partners, a prominent venture capital firm, leading this round further underscores the perceived value and scalability of Delve’s offerings.
Analysis of Implications:
The implications of these allegations are far-reaching:
- For Delve: If the accusations are substantiated, Delve could face severe legal and financial consequences, including regulatory investigations, potential lawsuits from affected customers, and a significant blow to its reputation and investor confidence. The valuation achieved in its last funding round could be severely impacted.
- For Delve’s Customers: Hundreds of companies may now be in a precarious position, having believed they were compliant when they were not. This could lead to significant financial penalties, reputational damage, and potential legal action from their own stakeholders or regulatory bodies. The reliance on Delve’s purported automation could mean these companies are ill-equipped to rectify their compliance status independently.
- For the Compliance Tech Industry: The scandal could lead to increased scrutiny of compliance automation platforms and their auditing partners. It may prompt greater demand for transparency and independent verification within the industry, potentially leading to stricter oversight and new standards for how compliance is attested.
- For Investors: The situation highlights the inherent risks in high-growth tech sectors, particularly those operating in regulated environments. Investors may become more cautious, demanding deeper due diligence on the operational integrity and ethical practices of startups.
The narrative presented by DeepDelver suggests a potential systemic issue where the promise of automated compliance might have been exploited to create an illusion of security and adherence to regulations. The involvement of audit firms described as "rubber-stampers" points to a possible collusion or a failure in the independent audit process, which is meant to be a crucial safeguard.
The allegations of fabricated evidence and misleading trust pages are particularly damaging, as they speak to a deliberate attempt to deceive both clients and the public. The mention of "donuts" as a response to client concerns, while anecdotal, paints a picture of a company potentially prioritizing public relations over substantive issue resolution.
As the situation unfolds, the focus will undoubtedly be on the evidence presented by both sides and the outcome of any official investigations. The case of Delve serves as a stark reminder of the critical importance of genuine compliance, robust independent auditing, and ethical business practices in an increasingly complex and regulated digital world. The speed of innovation in the startup ecosystem must be matched by an unwavering commitment to integrity and regulatory adherence.
