Delve accused of misleading customers with ‘fake compliance’

A recent anonymous post on Substack has sparked controversy for compliance startup Delve, claiming the company misled numerous clients regarding their adherence to privacy and security regulations. The post alleges that Delve's actions could potentially expose its customers to serious repercussions, including criminal liability under HIPAA and substantial fines under GDPR. Delve, which is backed by Y Combinator and successfully raised $32 million in a Series A funding round last year, has responded to these accusations, branding the Substack article as 'misleading' and filled with inaccuracies. The author of the post, known as 'DeepDelver,' claims to have previously worked for a client of Delve and recounts a troubling experience involving an email about a potential data leak that raised concerns among customers. DeepDelver and others began to question the integrity of Delve’s operations after receiving assurances from CEO Karun Kaushik that they were compliant and that no sensitive data had been compromised. The group of concerned clients decided to collaborate on an investigation, concluding that Delve may be fabricating evidence of compliance. They allege that the startup is generating auditor conclusions and certificates by bypassing essential compliance frameworks, misleading clients into believing they have achieved full compliance. The allegations extend to claims that Delve has provided clients with falsified documents, such as evidence of meetings, tests, and processes that never took place. Customers reportedly felt pressured to either accept this fabricated evidence or resort to labor-intensive manual processes with minimal automation. Furthermore, DeepDelver asserts that many of Delve's clients have engaged the same two audit firms, which they describe as part of a coordinated operation, raising further suspicion about the validity of the audits. In its defense, Delve clarified that it does not issue compliance reports, asserting that its platform is designed to assist in the documentation process while allowing clients the freedom to choose their auditors. The company emphasizes that final audit reports are produced solely by licensed independent auditors and not by Delve itself. In response to accusations of providing false evidence, Delve explained that it offers templates to help clients document their compliance processes, distinguishing between drafts and filled evidence. As the situation unfolds, Delve is conducting an investigation into the alleged leaks and reviewing the claims made in the Substack post. Meanwhile, DeepDelver has stated that their company has removed its trust page and no longer depends on Delve for compliance support. The outcome of this situation remains to be seen, as both parties continue to address the serious allegations raised.