YC-backed Delve accused of faking SOC reports
A Substack exposé alleges YC‑backed Delve (raised $32M) used templates and offshore mills to fake SOC 2, HIPAA and GDPR reports — potentially exposing customers to compliance fines and legal risk. The piece has already drawn heavy attention on social platforms and could trigger vendor due‑diligence reviews across startups that rely on third‑party assurances. (x.com)
An analysis of the leaked drafts found roughly 493–494 SOC 2 documents that were nearly identical in wording and structure, with one review noting 259 Type II reports all declaring zero security incidents during their observation periods. (compliancehub.wiki)) The underlying leak appears to have been a publicly accessible Google spreadsheet from late 2025 that contained links to 494 SOC 2 drafts and 81 ISO 27001 registration forms, and an affected‑clients investigation based on that data was published in February 2026. (systima.ai)) Investigators reported that auditor conclusions and test results were present in draft reports before client‑specific evidence was added, a practice the investigators say conflicts with AICPA AT‑C Section 205 requirements for auditors to form opinions based on independent examination. (systima.ai)) The probe identified two auditing firms — named Accorp and Gradient — as the primary recipients of routed audits, and at least one customer (Wispr Flow) lists ACCORP Partners for its SOC 2 attestation and Gradient Certification for ISO 27001 on its compliance page. (compliancehub.wiki)) Delve posted a public rebuttal on March 20, 2026 asserting the company “does not conduct audits or issue ‘fake’ SOC 2 reports,” saying licensed auditors issue final reports and that Delve provides templates, an audit dashboard, and “120+ automated integrations.” (delve.co)) Company filings and coverage name Karun Kaushik (CEO) and Selin Kocalar (COO) as founders, note a rapid customer increase from roughly 100 to over 500 within months, and place the company’s post‑round valuation at about $300 million. (techcrunch.com))
