In March 2026, a whistleblower group exposed a Y Combinator-backed compliance startup allegedly selling fabricated SOC 2 and ISO 27001 reports - with auditor conclusions pre-written before any client submitted evidence. Here is what happened and what it means for organizations relying on compliance automation.
In March 2026, an anonymous whistleblower group calling themselves DeepDelver published a detailed investigation into Delve, a Y Combinator-backed compliance automation startup that had raised $32 million at a $300 million valuation on the promise of AI-accelerated SOC 2 and ISO 27001 certification.
The evidence came from a publicly accessible Google Spreadsheet containing direct links to hundreds of confidential draft audit reports. What the analysis found was difficult to dismiss.
What the Reports Actually Showed
Across 494 SOC 2 reports, auditor conclusions and test results had been fully populated before clients submitted any company information, network diagrams, or evidence - directly violating AICPA independence rules. 493 out of 494 reports used the exact same boilerplate text, including identical grammatical errors. Only the company name, logo, and signature changed.
The auditors signing off were not the US-based CPA firms Delve had advertised. According to the investigation, they were certification mills operating through empty shell addresses. Board meeting minutes were allegedly fabricated. Risk assessments came pre-filled with default entries. The compliance wasn't just automated - according to the allegations, it was fabricated outright.
The Fallout
Y Combinator removed Delve from its portfolio in April 2026. Several Delve customers that separately suffered security incidents publicly said they had dropped Delve for other vendors. Insight Partners briefly removed their investment blog post about the company. Delve halted product demos.
Delve denied the core allegations throughout, stating that final reports and opinions are issued solely by independent, licensed auditors, and that the whistleblower account was inaccurate.
The Bigger Problem
Delve didn't invent the underlying pressure. What the compliance automation market has created is enormous commercial incentive to compress the audit process - and in some cases, apparently, to skip it entirely.
The test for any compliance automation tool is simple: does the evidence get generated because the activity happened, or does the activity get assumed because the evidence was generated? The distinction is everything to a regulator and everything to a court.
For organizations evaluating compliance platforms under frameworks like the EU AI Act, SOC 2, or PCI DSS, the Delve case is a direct warning: if certifications are flawed, liability sits with the companies that relied on them - not with the platform that produced them. Accepting a compliance report without understanding how the underlying evidence was captured is no longer a defensible position.
Photo by Kelly Sikkema on Unsplash. Free for commercial use.