A recent anonymous Substack article has leveled serious accusations against the compliance startup Delve. The post claims Delve “misled” “hundreds of clients into believing they met” privacy and security standards, which could leave these clients vulnerable to “criminal charges under HIPAA and substantial GDPR penalties.”
Last year, Delve, a Y Combinator-supported startup, secured $32 million in Series A funding, valuing the company at $300 million, with Insight Partners leading the investment. This past Friday, the company issued a response on its official blog, dismissing the Substack allegations as “misleading” and full of “inaccurate claims.”
The author of the Substack piece, identified as “DeepDelver,” stated they were an employee of a previous Delve client. When queried by TechCrunch via email, DeepDelver explained that they and their associates opted for anonymity due to concerns about potential “retaliation from Delve.”
DeepDelver’s post details an email received in December, which alleged that the startup had “inadvertently exposed a spreadsheet containing confidential client reports.” Despite Delve CEO Karun Kaushik’s subsequent assurances to clients that their compliance remained intact and no unauthorized access to sensitive data occurred, DeepDelver and other customers reportedly grew skeptical.
They penned, “Given our collective dissatisfaction with Delve’s service and a pervasive feeling that something was amiss, we opted to combine our efforts and conduct a joint investigation.”
Their investigation led them to conclude that Delve “maintains its reputation as the quickest platform by fabricating evidence, crafting auditor findings for certification bodies that merely approve reports, and bypassing crucial framework stipulations, all while assuring clients of 100% compliance.”
DeepDelver elaborated extensively on these assertions, alleging that the startup furnished clients with “forged documentation of board gatherings, examinations, and procedures that never took place,” subsequently compelling these clients to “either accept the false evidence or undertake largely manual tasks with minimal genuine automation or AI support.”
Furthermore, DeepDelver contended that nearly all Delve clients appeared to have utilized two audit companies, Accorp and Gradient, which were characterized as “components of a single entity,” primarily operating from India with only a token presence in the U.S.
These firms, according to DeepDelver, are simply endorsing reports that Delve itself produced. Consequently, DeepDelver asserted that the startup “reverses” the standard compliance process: “By producing auditor determinations, testing protocols, and ultimate reports prior to any impartial assessment, Delve assumes the dual roles of executor and evaluator. This isn’t a minor detail. It constitutes a systemic deception that renders the entire certification invalid.”
Beyond accusing Delve of deceiving its clientele, DeepDelver claimed the startup assists these clients in “misrepresenting facts to the public by maintaining trust pages that list security protocols which were never actually put into practice.”
DeepDelver mentioned that during their company’s discussions about problems with Delve, the startup “dispatched several boxes of donuts […] in an attempt to mollify them.” Despite this gesture, DeepDelver’s employer reportedly removed its trust page and ceased using the startup for compliance services.
Delve addressed the allegations by stating that it does not, in fact, produce compliance reports. Rather, it functions as an “automation platform” that collects compliance-related data and then grants auditors access to this information.
The company asserted, “Ultimately, reports and assessments are solely generated by independent, accredited auditors, not by Delve.”
Delve further explained that clients “have the choice to collaborate with an auditor they select or one from Delve’s established network of independent, certified third-party audit companies.” These auditors, the startup noted, are “well-regarded firms widely employed throughout the sector, including by rival compliance platforms.”
Addressing the charge of supplying customers with “fabricated evidence,” Delve retorted that it merely provides “templates designed to assist teams in documenting their procedures in line with compliance mandates, a practice common among other compliance platforms.”
The company stated, “Preliminary templates are distinct from ‘pre-populated evidence.’”
Delve additionally noted that it is “diligently looking into any data breaches” and “continues to analyze the Substack publication.”
Responding to Delve’s statement, DeepDelver informed TechCrunch that they found it “astonishingly lazy, awkward, and audacious.”
DeepDelver elaborated, “They are attempting to evade accountability by rejecting the term ‘pre-filled evidence’ and instead using ‘templates,’ thereby effectively transferring responsibility to clients for using these ‘templates’ verbatim.” They added, “They assert they are not the ones who ‘issue’ the report, a claim easily made if ‘issuing a report’ is narrowly defined as applying the final approval stamp.”
They further pointed out “several highly serious accusations” that Delve completely overlooked: “The allegations concerning India, the absence of AI (as they only refer to ‘automations’), and the problematic trust page featuring controls that were never actually put in place.”
It seems DeepDelver’s critiques are far from over, as they hinted, “Part II is expected shortly.”
Moreover, subsequent to the initial Substack article, an X user named James Zhou claimed to have accessed sensitive Delve data, including employee background checks and equity vesting schedules. Jamieson O’Reilly, founder of Dvuln, provided further insights, attributing them to a discussion with Zhou regarding “multiple significant security flaws in Delve’s outward-facing systems.”
TechCrunch attempted to solicit further comments by emailing the media contact listed on Delve’s site; however, the email was undeliverable. Nevertheless, subsequent to this article’s publication, an invitation for a “Delve demo” later this week was received.
Originally released on March 21, 2026, this article has been revised to include DeepDelver’s email responses, further information on alleged security weaknesses from Jamieson O’Reilly, and additional specifics regarding Delve’s reply to TechCrunch.