Anonymous post accuses Delve of issuing fake SOC 2 compliance reports

In short: An anonymous Substack post claims AI compliance startup Delve misled customers by providing fabricated audit-style reports, including for SOC 2.

What happened

An anonymous Substack post published around March 20, 2026, accuses Delve, a startup that sells compliance help to other companies, of fabricating audit reports and evidence. The post is titled “Delve - Fake Compliance as a Service - Part I.” It claims Delve told hundreds of customers, mainly startups, that they met privacy and security rules when they did not.

The post focuses on SOC 2, a common security check that many software companies use to prove they handle customer data safely. Think of it like a “safety inspection” for how a company protects information. The anonymous author alleges Delve marketed extremely fast results, such as “SOC 2 in days,” and then delivered reports in as little as five days without doing the real work an audit would normally require.

The claims spread on Hacker News, where commenters said the speed sounded “too good to be true” and questioned how customers accepted the reports. Some commenters described the post’s documentation as detailed, but the evidence has not been independently verified in the public reports available so far. As of the latest coverage, there is no public response from Delve and no known statement from regulators.

Why it matters

If the allegations are true, companies that relied on these reports could face real consequences, including losing deals, failing partner checks, or facing legal and regulatory trouble. It is a reminder that “compliance as a service” tools can be helpful, but they can also create a false sense of security if they focus on paperwork that looks right instead of protections that actually work.

Source: TechCrunch AI