A recent Substack article from an undisclosed source alleges that the compliance startup Delve has “misleadingly” assured “hundreds of clients of their compliance” with privacy and security mandates, possibly making these clients vulnerable to “HIPAA-related criminal charges and substantial GDPR penalties.”
Last year, Delve, a Y Combinator-supported startup, revealed a $32 million Series A funding round, valuing the company at $300 million, with Insight Partners leading the investment. This past Friday, the startup sought to deny the allegations via a blog post, labeling the Substack content as “deceptive” and asserting it harbored “numerous false statements.”
The Substack entry was authored by “DeepDelver,” identified as an individual previously employed by a Delve client.
DeepDelver detailed getting an email in December alleging that the startup had “inadvertently disclosed a spreadsheet containing sensitive client reports.” Although Delve’s CEO, Karun Kaushik, reportedly reassured clients afterward that their compliance was intact and no third parties accessed confidential information, DeepDelver noted that this, along with other clients, sparked suspicion.
They stated, “Given our collective dissatisfaction with Delve’s service and a general intuition that something was amiss, we chose to combine our efforts and conduct a joint investigation.”
Their findings indicated that Delve “maintains its reputation as the swiftest platform by fabricating evidence, crafting auditor findings for certification operations that merely approve reports, and bypassing crucial framework stipulations while informing clients of complete compliance.”
DeepDelver elaborated extensively on these assertions, charging the startup with supplying clients with “manufactured proof of non-existent board meetings, evaluations, and procedures,” thereby compelling them to “either accept counterfeit evidence or undertake largely manual tasks with minimal actual automation or artificial intelligence.”
Furthermore, DeepDelver alleged that almost all of Delve’s clientele appeared to have engaged two audit companies, Accorp and Gradient, characterizing them as “components of a unified enterprise” that largely operates in India with only a token presence in the U.S.
They asserted that these firms are simply endorsing reports created by Delve. Consequently, DeepDelver claimed the startup “reverses” the standard compliance model: “By formulating auditor findings, testing protocols, and ultimate reports prior to any impartial assessment, Delve assumes both the execution and examination roles. This is more than a minor detail; it represents a systemic deception that renders the entire certification invalid.”
Beyond accusing Delve of deceiving its clients, DeepDelver stated that the startup aids these clients in “misleading the public by maintaining trust pages featuring security protocols that were never put into practice.”
DeepDelver mentioned that during their company’s discussions about concerns with Delve, the startup “proactively sent several boxes of donuts to appease us.” Despite this, DeepDelver’s organization reportedly took down its trust page and ceased using the startup for compliance services.
Delve addressed the allegations by stating it does not issue compliance reports whatsoever. Rather, it functions as an “automation platform” that gathers compliance-related data and subsequently grants auditors access to it.
The company clarified, “Independent, certified auditors exclusively produce final reports and assessments, not Delve.”
Delve further explained that its clients “have the option to engage an auditor of their preference or select one from Delve’s roster of independent, accredited external audit firms.” The startup noted that these auditors are “well-regarded firms widely utilized throughout the sector, including by competing compliance platforms.”
Addressing the charge of supplying clients with “fabricated evidence,” Delve contended that it merely provides “templates to assist teams in documenting their procedures according to compliance mandates, a practice also adopted by other compliance platforms.”
The company asserted, “Preliminary templates differ from ‘pre-populated evidence.’”
Delve also mentioned it is “diligently investigating any potential data breaches” and “is continuing its review of the Substack post.”
Subsequent to the original Substack publication, X user James Zhou reported gaining access to confidential Delve data, including employee background checks and equity vesting schedules. Jamieson O’Reilly, founder of Dvuln, provided further insights into his discussion with Zhou regarding “multiple significant security weaknesses in Delve’s external infrastructure.”
TechCrunch attempted to obtain further comments by emailing the media contact address on Delve’s website, but the email was undeliverable. However, a calendar invitation for a “Delve demo” was later received for this week. TechCrunch has also contacted DeepDelver for more information.
This article has been revised to include further data on alleged security flaws supplied by Jamieson O’Reilly, along with additional specifics regarding Delve’s communication with TechCrunch.