In March 2026, Delve, a compliance automation startup backed by Y Combinator and Insight Partners, briefly switched off the Book a Demo button on its website, and Insight Partners took down a blog post explaining why it had invested. Both moves came days after an anonymous writer accused Delve of helping customers pass security audits with fabricated evidence. Delve has denied the core allegations. Here is what was claimed, how the company responded, and where things stand in October 2026.
Who Delve is and why the story mattered
Delve was founded by Karun Kaushik and Selin Kocalar, two MIT dropouts, and went through Y Combinator. Its software promises to automate the paperwork behind security and privacy certifications such as SOC 2, ISO 27001 and HIPAA, which many startups need before large companies will buy from them. In July 2025, Delve announced a $32 million Series A at a $300 million valuation, led by Insight Partners.
A SOC 2 report or HIPAA attestation is a promise to customers that data is handled properly. If the evidence behind that promise were not real, the risk would land on Delve’s clients and on the businesses that trusted them, not just on Delve. That is why the allegations drew so much attention across the startup world.
What was alleged, and by whom
The claims came from an anonymous Substack author called DeepDelver, who said they had worked at a company that used Delve. None of the following has been independently confirmed. The posts alleged that:
- Delve supplied customers with prepared evidence of board meetings, tests and processes that had not actually taken place.
- Audit conclusions were drafted inside the platform before any independent review, and some partner audit firms approved them with little scrutiny.
- Customers were told they were fully compliant while major framework requirements were skipped.
- Public trust pages listed security controls that had not been put in place.
- Part of the product was built on another company’s open source code without proper credit.
A second post at the end of March included what the author described as internal videos and Slack messages.
Timeline of events
| Date (2026) | What happened |
|---|---|
| March 20 to 21 | First DeepDelver post appears. Delve publishes a blog post titled Response to Misleading Claims. |
| Around March 23 to 24 | The Book a Demo option disappears from Delve’s site. Insight Partners removes its article about the investment, though archived copies remain online. |
| March 24 | Delve announces changes and new support measures for customers, including free repeat audits. |
| March 30 | DeepDelver posts again. LiteLLM, an open source AI project that had used Delve, says it is recertifying SOC 2 Type 2 and ISO 27001 with Vanta. |
| April 3 | The founders publish a longer response and a video statement. |
| April 4 | Kocalar says on X that Y Combinator and Delve have parted ways. Delve no longer appears in the YC directory. |
What Delve says
Delve’s position has been consistent on one central point: it says it does not issue compliance reports. In its first response, the company said final reports and opinions are issued only by independent, licensed auditors, and that customers can pick their own auditor or one from Delve’s network. It also argued that draft templates for policies and procedures are a normal feature of compliance platforms and are not the same thing as prefilled evidence.
In its April 3 post, Delve went further. The founders apologized to customers, admitted the company had grown quickly and fallen short of its own standards, and said the evidence pointed to a coordinated cyberattack rather than a genuine whistleblower. Delve alleged that someone signed up under false pretenses, took internal data and used it in a smear campaign, and said it had hired cybersecurity firms to investigate. It also disputed the open source claim, saying the code it used carried an Apache 2.0 license that allows commercial use.
The company listed concrete changes:
- Rebuilding its auditor network and dropping firms that did not meet its standards.
- Free repeat audits and penetration tests for all active customers.
- Stopping any automation that touches audit workflows.
- Direct contact between customers and their auditors.
- Clear labels in the product that templates are only starting points.
Where things stand in October 2026
Delve is still in business. Its website again shows Book a Demo buttons, lists frameworks from SOC 2 and HIPAA to ISO 42001 and the EU AI Act, and claims more than 1,500 customers, a figure that has not been independently verified. The company has not added a blog post about the dispute since April 3.
The Insight Partners article that was taken down in March is reachable again at its original address on the firm’s website, alongside the 2025 funding announcement. Insight has not, as far as we could find, published a statement explaining either step. We also found no public record of a regulator or court acting on the allegations as of early October 2026.
What Delve customers should do now
If your company holds a SOC 2, ISO 27001 or HIPAA attestation prepared through Delve, the practical steps are the same whatever the truth turns out to be:
- Confirm which audit firm signed your report and check that the firm is properly licensed.
- Make sure the controls described in your report and trust page actually exist and are working.
- Take up Delve’s offer of a free repeat audit, or hire an auditor you choose yourself.
- Be ready to answer questions from customers who rely on your report, ideally with fresh evidence.
FAQ
Did Delve shut down?
No. As of October 2026 its website is live, lists its products and accepts demo requests.
Is Delve still part of Y Combinator?
No. Delve’s COO said on April 4, 2026 that the two had parted ways, and the company was removed from the YC directory.
Who is DeepDelver?
The author’s identity has not been made public. They described themselves as someone who worked at a Delve customer, while Delve says the posts were part of a targeted attack.
Are SOC 2 reports from Delve customers invalid?
Not automatically. A report’s value depends on the auditor who signed it and the controls behind it, so affected companies should verify both or get a new audit.
The verdict
The Delve case is still a set of competing claims: serious anonymous allegations on one side and firm denials plus an attack theory on the other. The company kept operating, lost its Y Combinator link and changed how it works with auditors. For customers, the safest move is to verify their own compliance evidence rather than wait for a final answer.
Updated October 2026: rewritten as a neutral explainer covering the March allegations, Delve’s response, the Y Combinator split and the company’s current status.
Featured photo: Austin Distel on Unsplash.
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
