Sonny Valindra
An anonymous Substack post published this week has leveled explosive accusations against Delve, a Y Combinator-backed compliance startup, alleging that the company has been "falsely" convincing "hundreds of customers they were compliant" with critical privacy and security regulations. The anonymous author, writing under the pseudonym "DeepDelver," claims this alleged deception could expose Delve’s clients to severe repercussions, including "criminal liability under HIPAA and hefty fines under GDPR." The allegations have sent ripples through the tech and compliance sectors, raising significant questions about the integrity of automated compliance solutions and the vetting processes of prominent venture capital firms.
Delve, which last year announced a substantial $32 million Series A funding round at a $300 million valuation, led by Insight Partners, vehemently denies the claims. In a swift response posted on its official blog on Friday, the startup characterized the Substack post as "misleading" and containing "a number of inaccurate claims." The company asserts its role as an "automation platform" that facilitates compliance rather than issuing certifications itself, a distinction that lies at the heart of the escalating dispute.
The Genesis of the Allegations: A Client’s Perspective
The anonymous Substack post is attributed to "DeepDelver," who identifies as a former employee of a Delve client. In direct correspondence with TechCrunch, DeepDelver explained the decision to remain anonymous stemmed from "fear for retaliation by Delve." This sentiment underscores the perceived power imbalance between a startup and its allegedly aggrieved customers.
According to DeepDelver’s account, the suspicion began in December when their former employer received an email indicating that Delve had "leaked a spreadsheet with confidential client reports." While Delve CEO Karun Kaushik reportedly reassured clients in a subsequent communication that they remained compliant and that no sensitive data had been accessed externally, DeepDelver and other clients found these assurances unconvincing. "Having the shared experience of being underwhelmed with the Delve experience, and having the overall sense that something fishy was going on, we decided to pool resources and investigate together," the post detailed.
Unraveling the "Fake Compliance" Model
The investigation by DeepDelver and their collaborators led to a stark conclusion: Delve allegedly "achieves its claim of being the fastest platform by producing fake evidence, generating auditor conclusions on behalf of certification mills that rubber stamp reports, and skipping major framework requirements while telling clients they have achieved 100% compliance."
The allegations delve into the operational mechanics of Delve’s service. DeepDelver claims the startup provided clients with "fabricated evidence of board meetings, tests, and processes that never happened." Furthermore, clients were reportedly presented with a difficult choice: either adopt this fabricated evidence or undertake a largely manual compliance process with minimal actual automation or AI support. This scenario suggests a deliberate circumvention of rigorous compliance protocols in favor of superficial documentation.
Allegations of a Collusive Audit Network
A significant component of DeepDelver’s accusation revolves around the audit firms purportedly associated with Delve’s client base. The post claims that "virtually all of Delve’s clients seem to have gone through two audit firms, Accorp and Gradient." DeepDelver describes these entities as "part of the same operation," primarily based in India with only a "nominal presence in the United States."
The core of this claim is that these audit firms are allegedly engaged in "rubber-stamping" reports generated by Delve, rather than conducting independent, thorough examinations. This alleged arrangement, according to DeepDelver, fundamentally inverts the standard compliance structure. "By generating auditor conclusions, test procedures, and final reports before any independent review occurs, Delve places itself in the role of both implementer and examiner. This is not a technicality. It is a structural fraud that invalidates the entire attestation," the Substack post argued. This alleged self-serving mechanism raises concerns about the integrity of any compliance certifications obtained through Delve’s facilitated process.
Misleading the Public and Aiding Customer Deception
Beyond misleading its direct customers, DeepDelver accuses Delve of actively assisting them in misleading the public. This is allegedly achieved by "hosting trust pages that contain security measures that were never implemented." Trust pages, often publicly accessible, are designed to assure stakeholders of a company’s commitment to security and privacy. If these pages contain inflated or fabricated claims about implemented controls, it constitutes a significant breach of transparency and potentially deceives customers, partners, and the general public.
In a notable anecdote, DeepDelver shared that during discussions about their company’s issues with Delve, the startup sent "multiple boxes of donuts… to keep us happy." Despite this gesture, DeepDelver’s former employer reportedly unpublished its trust page and ceased reliance on Delve for compliance. This personal experience highlights the company’s alleged tactics to manage client dissatisfaction, while also suggesting a potential acknowledgement of the underlying issues.
Delve’s Defense: An Automation Platform, Not a Certifier
Delve’s official response directly confronts the core allegations by distinguishing its role from that of a compliance certifier. The company states it "does not issue compliance reports at all." Instead, Delve positions itself as an "automation platform" that collects compliance-related information and then provides auditors with access to this data.
"Final reports and opinions are issued solely by independent, licensed auditors, not Delve," the company asserted. This defense hinges on the idea that Delve provides the tools and data, but the ultimate judgment of compliance rests with external, accredited auditors.
Delve also clarified its client engagement model, stating that customers "can opt to work with an auditor of their choosing or opt to work with one from Delve’s network of independent, accredited third-party audit firms." The company emphasizes that these auditors are "established firms used broadly across the industry, including by other compliance platforms."
Regarding the accusation of providing "fake evidence," Delve counters that it offers "templates to help teams document their processes in accordance with compliance requirements, as do other compliance platforms." The company distinguishes these "draft templates" from "pre-filled evidence," suggesting that the responsibility for accurately populating and utilizing these templates lies with the customer.
Delve concluded its statement by indicating it is "actively investigating any leaks" and is "still reviewing the Substack." This acknowledgment of potential data breaches, separate from the compliance allegations, adds another layer of concern regarding the company’s security posture.
DeepDelver’s Rebuttal: "Baffled by the Laziness, Clumsiness and Brazenness"
Reacting to Delve’s defense, DeepDelver expressed astonishment, describing the company’s response as "baffled by the laziness, clumsiness and brazenness of it." DeepDelver viewed Delve’s reframing of "pre-filled evidence" as "templates" as a deliberate attempt to evade accountability. "They are trying to snake their way out [of] being held accountable by denying having ‘pre-filled evidence’ but calling it ‘templates’ instead, effectively shifting the blame to customers for adopting the ‘templates’ as is," DeepDelver stated.
Furthermore, DeepDelver criticized Delve’s assertion that it does not "issue" reports. "They’re claiming they are not the ones to ‘issue’ the report, which is easy to claim if you define issuing a report as providing the final stamp," DeepDelver elaborated.
DeepDelver also pointed out specific allegations that Delve’s response failed to address adequately. These include "The India accusation, the lack of AI (they only talk about ‘automations’), and the trust (lol) page containing controls that were never implemented." The promise of a "Part II" to the Substack post suggests that further revelations may be forthcoming.
Security Vulnerabilities Emerge
Adding to the mounting pressure on Delve, an X user named James Zhou posted that they were able to gain access to sensitive information from Delve, including employee background checks and equity vesting schedules. Jamieson O’Reilly, founder of Dvuln, shared further details from a purported conversation with Zhou, describing "several gaping security holes in Delve’s external attack surface." This indicates that even if the compliance claims were to be resolved, Delve faces significant questions regarding its internal security practices and data protection protocols.
TechCrunch reported that an initial attempt to contact Delve via their website’s media contact address resulted in a bounced email. However, a subsequent calendar invite for a "Delve demo" was received, suggesting the company is still engaging with potential clients and media.
Broader Implications for the Compliance and Startup Ecosystem
The allegations against Delve, if proven true, carry significant implications for several key areas:
- Customer Liability: Businesses that relied on Delve’s assurances of compliance could face substantial legal and financial penalties if their adherence to regulations like HIPAA and GDPR is found to be non-existent or based on fabricated evidence. This could trigger widespread investigations and lawsuits.
- Venture Capital Oversight: The substantial funding Delve received, particularly the $32 million Series A led by Insight Partners, raises questions about the due diligence processes employed by venture capital firms. High-profile investments often signal a level of confidence in a startup’s technology and business model, and these allegations could prompt a re-evaluation of how such assessments are conducted.
- The Future of Automated Compliance: The growing reliance on technology solutions for complex regulatory adherence is a significant trend. The Delve controversy could lead to increased scrutiny of all automated compliance platforms, demanding greater transparency and robust independent verification mechanisms. Customers may become more hesitant to trust software-generated compliance reports without extensive human oversight.
- The Role of Independent Auditors: The allegations directly challenge the integrity of the audit process when intertwined with compliance platforms. The purported collusion between Delve and audit firms highlights the critical need for genuine independence and rigorous auditing standards, free from influence or pre-determined outcomes.
- Startup Accountability: The case underscores the importance of ethical business practices and accountability within the fast-paced startup environment. The potential for "fake compliance as a service" to gain traction suggests a market gap where speed and perceived efficiency might be prioritized over genuine adherence to critical legal and ethical frameworks.
The unfolding situation surrounding Delve serves as a cautionary tale, emphasizing that in the critical domain of regulatory compliance, substance and verifiable adherence must always supersede the appearance of swift, automated solutions. The coming weeks and months will likely reveal more as DeepDelver prepares their promised follow-up and as regulatory bodies, if they choose to intervene, begin their own investigations. The tech industry will be watching closely to see how Delve, its investors, and its customers navigate these serious accusations.
