--- title: "The Delve Compliance Leak: What It Means for SOC 2 Certification - Axipro" description: "The Delve leak sheds light on serious compliance fraud claims in the tech industry. Discover what this means for clients." canonical: "https://axipro.co/the-delve-compliance-scandal/" language: "en-US" modified: "2026-04-23T15:04:36+00:00" generator: "WordPress 7.1.3" --- [Home](https://axipro.co) / [All Blog](https://axipro.co/category/blog/) / The Delve Compliance Leak: What It Means for SOC 2 Certification # The Delve Compliance Leak: What It Means for SOC 2 Certification ![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg) - Pedro Dias - March 24, 2026 Copy Link In March 2026, an anonymous whistleblower published what may be the most detailed exposé of compliance fraud the technology industry has ever seen. The target: Delve, a Y Combinator-backed startup valued at $300 million that promised to get companies [SOC 2 certified](https://axipro.co/soc-2/) in days using AI. The allegation: that Delve had been fabricating audit evidence, generating auditor conclusions before any auditor reviewed client data, and getting unaccredited Indian certification mills to rubber-stamp the results. If you work in tech and care about security compliance, or if you were a Delve customer, this story matters to you. ## **What Actually Happened** Delve was founded in 2023 by MIT dropouts Karun Kaushik and Selin Kocalar. The pitch was compelling: use “agentic AI” to compress months of painful compliance work into a few days. By mid-2025, the company had raised [$32 million in Series A funding](https://techcrunch.com/2025/07/22/21-year-old-mit-dropouts-raise-32m-at-300m-valuation-led-by-insight/), claimed over 1,000 customers in 50 countries, and had become one of the most talked-about names in the compliance automation space. Then, in December 2025, an email went out to hundreds of Delve clients. It alleged that Delve had leaked a publicly accessible Google spreadsheet containing hundreds of confidential audit reports, and that those reports were fraudulent. Delve’s CEO dismissed it as “an AI-generated email with falsified claims.” *That denial turned out to be harder to sustain than expected.* In March 2026, the anonymous account [Deepdelver published a detailed technical analysis](https://deepdelver.substack.com/p/delve-fake-compliance-as-a-service) of the leaked database. The findings were striking. Across **533 leaked reports covering 455 companies**, the same auditor conclusion language appeared word for word, including an identical grammatical error. Auditor conclusions and test results had been generated before any client even provided their company information. The auditors signing off were not the US-based CPA firms Delve had advertised, but Indian certification mills operating through empty shell addresses. *Inc. Magazine covered the initial story in detail.*[Read the full article here.](https://www.inc.com/ben-sherry/the-delve-scandal-a-y-combinator-darling-just-got-hit-with-a-bombshell-fraud-accusation/91320652) Claim your free review Free Migration For Companies Affected by Delve Axipro is currently offering Delve-affected companies a free 30-minute compliance review plus complimentary migration to Vanta or Drata. Our certified compliance experts will tell you exactly which situation you are in, identify any real gaps, and guide your migration so your next audit is clean. [Schedule](https://meetings.hubspot.com/axipro-team/meet) ## **Will Affected Companies Lose Their SOC 2 Certification?** The short answer is **no, not automatically.** [SOC 2 reports](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) are issued by independent CPA firms, not by compliance platforms. Delve was the evidence collection and preparation tool. The auditor signed off separately. There is no central SOC 2 registry, no revocation authority, and no body that automatically invalidates a certificate because the platform used to prepare it has been accused of fraud. The certificate exists. It is technically still valid. **But a certificate is only as credible as the evidence behind it.** If the controls it claims were in place were never actually implemented, if the board meeting minutes were identical boilerplate, if the [penetration test](https://axipro.co/services/vulnerability-assessment-and-penetration-testing/) never happened, if the device security screenshots were one-off manual uploads rather than evidence of [continuous monitoring](https://axipro.co/continuous-monitoring-for-soc-2-compliance/), the certificate is not a record of real compliance. It is a document waiting to be challenged. The moment a Delve client goes to renew with a reputable auditor, that auditor will look at the evidence. They will find gaps. That renewal failure is when the certificate effectively collapses, and it almost always happens at the worst possible time. Review our [SOC 2 compliance checklist](https://axipro.co/soc-2-compliance-checklist/) to understand exactly what a legitimate audit requires. ## **The Three Situations Every Delve Client Is In Right Now** Not every Delve client faces the same risk. Understanding which situation you are actually in is the most important thing you can do right now. **Situation 1: Your controls are real, just poorly documented.** Your underlying security practices are solid. Delve’s platform generated sloppy evidence around them, but the controls themselves exist. A [gap assessment](https://axipro.co/services/gap-analysis/), a cleanup, and a fresh audit with a reputable firm is all you need. Manageable. **Situation 2: You have gaps between what your certificate claims and what exists.** Some controls were implemented, some were not. The Delve platform made it very easy to click through pre-populated forms and never notice the difference. These gaps are fixable — but only if you find them before your next renewal, your next enterprise customer review, or your next M&A process does. For a deeper understanding of what a proper gap analysis involves, see our [detailed guide to gap analysis](https://axipro.co/iso-27001-gap-analysis-a-detailed-guide-for-security-audit/). **Situation 3: Significant controls were never implemented.** This creates real commercial, contractual, and in some cases legal exposure. It is particularly serious for companies that handle health data under [HIPAA](https://axipro.co/hipaa-certification/) or process EU resident data under [GDPR](https://axipro.co/gdpr-compliance/), and for any company that has won government or federal contracts on the basis of these certifications. **All three situations look identical from the outside right now.** Your certificate exists. Your trust page is live. Nothing has visibly broken. The only way to know which situation you are in is to actually look ## **The Consequences Nobody Is Fully Reporting** Most coverage of this story has focused on Delve itself. The more important story is what happens to Delve’s clients over the next 12 months. **The enterprise customer risk.** Delve’s questionnaire AI was answering vendor security questionnaires on behalf of clients, claiming controls, MDM systems, penetration tests, backup restoration simulations, that the platform demonstrably never verified. Delve clients were making specific false representations to their own enterprise customers during procurement. If any of those customers later suffers a breach and traces it back to a vendor that misrepresented its security posture, the liability chain is clear. This is one of the [common pitfalls in SOC 2](https://axipro.co/avoiding-common-pitfalls-in-soc-2-iso-27001/) that organisations rarely anticipate until it is too late. **The HIPAA exposure is more serious than reported.** The Deepdelver report identifies multiple Delve clients that process protected health information for millions of US citizens. [Under HIPAA](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/enforcement-highlights/index.html), penalties for compliance violations escalate from fines to criminal charges depending on whether the violation was knowing or unknowing. The critical legal threshold here is **December 2025**. Companies that received the breach notification email and took no meaningful action after that point have a documented timestamp of when they were put on notice. The distinction between unknowing and knowing violation may hinge on that date. **GDPR creates cross-border exposure.** [Under Article 83 of the GDPR](https://gdpr-info.eu/art-83-gdpr/), fines can reach **4% of global annual revenue or €20 million** — whichever is higher. GDPR applies to any company processing data of EU residents, regardless of where the company is incorporated. Delve claimed clients in 50+ countries. Many of those clients will have EU exposure they are currently unaware of. **The M&A trap.** Compliance certifications are material facts in acquisition due diligence. If a Delve client is acquired or raises a significant funding round, any investor’s legal team doing thorough due diligence will examine the audit evidence behind the SOC 2 certificate. That examination will find the gaps. ## **Why Switching to Vanta or Drata Alone Will Not Fix This** The instinct for most Delve clients right now is to migrate to [Vanta or Drata](https://axipro.co/drata-vs-vanta-which-compliance-tool-is-best/) as quickly as possible. Both are legitimate, well-regarded platforms. [Drata](https://axipro.co/drata/) is trusted by names like Wispr Flow, which publicly announced its migration after the scandal broke. **But software collects and organises evidence. It does not verify that the controls behind that evidence actually exist.** | **What compliance requires** | **Software platform alone** | **Human expert oversight** | | --- | --- | --- | | **Verify controls are implemented** | Relies on self-reporting | Independent assessment of real operations | | **Catch gaps between policy and practice** | Cannot detect undeclared gaps | Structured gap assessment against actual systems | | **Continuous monitoring evidence** | Tracks what you connect | Verifies what is worth connecting | | **Defensible audit documentation** | Template-generated | Expert-reviewed and evidence-backed | | **Accountability if gaps are found** | Platform disclaims liability | Consultant stands behind the work | If your controls were not real under Delve, they will not become real because you are now tracking them in a different dashboard. Switching platforms without a [gap assessment](https://axipro.co/services/gap-analysis/) first is repainting a house with a cracked foundation. It looks better. The problem is still there. That said, migrating to the right platform, with the right guidance, is absolutely the correct long-term move. [Click here to see how Axipro and Drata make SOC 2 happen in weeks, not months.](https://axipro.co/how-drata-axipro-make-soc-2-happen-in-weeks-not-months/) ## **What the Right Remediation Actually Looks Like** For most companies, this is a solvable problem. Start by pulling your existing Delve audit reports and reviewing them against your actual systems. Compare what the reports claim, on MDM, [penetration testing](https://axipro.co/services/vulnerability-assessment-and-penetration-testing/), board meetings, backup simulations, against what you can actually evidence today. Next, commission an independent [gap assessment](https://axipro.co/services/gap-analysis/) with a certified compliance expert. This is the step most companies skip when they are in a hurry to move on. It is also the step that determines whether you remediate on your own terms or get caught out by an auditor, a customer, or a regulator. Once you understand your real compliance posture, choose your new platform with clear eyes. Getting guidance before committing to a new annual contract is worth the time, see our comparison of [Vanta vs Drata](https://axipro.co/drata-vs-vanta-which-compliance-tool-is-best/) to understand which platform suits your organisation’s needs. If you have ongoing customer relationships where your Delve certification was a material factor, consider proactive communication. Getting ahead of potential questions is almost always better than fielding them reactively. Claim your free review Free Migration For Companies Affected by Delve Axipro is currently offering Delve-affected companies a free 30-minute compliance review plus complimentary migration to Vanta or Drata. Our certified compliance experts will tell you exactly which situation you are in, identify any real gaps, and guide your migration so your next audit is clean. [Schedule](https://meetings.hubspot.com/axipro-team/meet) Axipro Author ![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg) ### Pedro Dias Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro. - March 24, 2026 - [All Blog](https://axipro.co/category/blog/) Copy Link ## Blog Highlights ## Explore More Articles [Read More Blogs](https://axipro.co/blog/) - [SOC-2](https://axipro.co/category/soc-2-2/) - October 9, 2026 #### [SOC 2 BCDR Tabletop Exercise: A 3-Week Playbook for First-Time GRC Leads](https://axipro.co/soc-2-tabletop-exercise/) A SOC 2 auditor will not accept a business continuity plan that has never been tested. The AICPA Trust Services Criteria require you to test your recovery procedures, and a written plan sitting in a shared drive does not count. A BCDR tabletop exercise, a facilitated discussion where your team walks through a simulated disaster and makes the decisions a real incident would demand, is the most practical way for a lean team to produce that evidence. This playbook takes a first-time GRC lead from zero to a completed, documented, audit-ready tabletop exercise in three weeks. It covers which Trust Services Criteria the exercise maps to, how to design a realistic scenario, how to run the session, and exactly which artifacts to hand your SOC 2 auditor. No prior exercise experience is assumed, and no external facilitator is required, though we will be honest about when hiring one makes sense. The stakes are real. An untested disaster recovery plan is one of the most common sources of exceptions in SOC 2 reports that include the Availability category. The fix costs one afternoon of your team’s time plus the preparation around it. Few controls offer a better ratio of audit value [Read more](https://axipro.co/soc-2-tabletop-exercise/) - [AI](https://axipro.co/category/ai/), [News](https://axipro.co/category/news/) - October 8, 2026 #### [MAS AI Risk Management Guidelines Are Final: What AI Vendors Selling to Financial Institutions Must Do Before October 2027](https://axipro.co/mas-ai-risk-management-guidelines/) On October 7, 2026, the Monetary Authority of Singapore issued its final Guidelines on AI Risk Management, and the clock is now running. Every financial institution in Singapore has until October 7, 2027 to meet the core supervisory expectations, with the remaining sections due by October 7, 2028. The Guidelines apply to all FIs and all forms of AI, from a chatbot embedded in a support tool to autonomous agentic systems. Here’s the part most coverage will miss: the most commercially significant clause is not aimed at banks at all. MAS makes financial institutions fully accountable for third-party AI, including AI developed, operated, or provided by vendors. FIs must obtain sufficient assurance from those providers, and if they cannot, MAS expects them to limit, suspend, or replace the service. If you sell AI-powered software to banks, insurers, payment firms, or asset managers with a Singapore presence, that sentence is about you. Over the next twelve months, your FI customers will start asking how your AI is governed, and a security questionnaire alone won’t answer the question. This article covers what the Guidelines require, why vendors are effectively in scope, and how ISO 42001, the international standard for AI management systems, [Read more](https://axipro.co/mas-ai-risk-management-guidelines/) - [AI](https://axipro.co/category/ai/), [ISO-27001](https://axipro.co/category/iso-27001-2/), [SOC-2](https://axipro.co/category/soc-2-2/) - October 8, 2026 #### [AI-Generated Code vs SOC 2 and ISO 27001 Change Management](https://axipro.co/ai-generated-code-soc-2-iso-27001-change-management/) Gartner predicts that by 2028, 90% of enterprise software engineers will use AI code assistants, up from less than 14% in early 2024. SOC 2 and ISO 27001 change management controls were written before that shift, and both rest on an assumption that AI-generated code breaks outright: the person who approved a change wrote it, or at least fully understood it. Neither the AICPA nor ISO has published AI-specific change management requirements, so auditors apply the existing controls, SOC 2 CC8.1 and ISO 27001 Annex A 8.32, to commits no human authored. Most teams discover the mismatch mid-audit, when a sample pulls up a 2,000-line agent-generated pull request that was approved in four minutes. This guide maps AI code generation to both frameworks: what each one requires, the risks AI coding assistants introduce, the workflow that satisfies auditors, and the evidence they request when GitHub Copilot, Cursor, or Claude Code shows up in your SDLC. Why AI-Generated Code Breaks Traditional Change Management Change management controls assume a human bottleneck. AI removes it in three places at once. The Volume Problem: AI Commits at Machine Speed A single developer running an agentic coding tool can open more pull requests in a [Read more](https://axipro.co/ai-generated-code-soc-2-iso-27001-change-management/) WhatsApp us