Delve
Winter 2024Parted waysAI that makes compliance effortless
Pressure-test this opportunity
Explore the risks and possibilities with a prompt for ChatGPT, Claude, or your agent.
AI that makes compliance effortless
Explore the risks and possibilities with a prompt for ChatGPT, Claude, or your agent.
Delve built software that helps companies collect evidence and prepare for compliance reviews. Its founders raised venture capital around a useful promise: less time gathering documents, more time building products. An anonymous investigation in March 2026 challenged the reliability of that work. Delve disputed the allegations and announced changes. Its website still offers demos as of October 2, 2026. This is an unresolved trust dispute, not a confirmed shutdown.[1][2]
Image 1 / 1
The distinction matters. Software can organize evidence, but an independent auditor determines the scope and conclusions of a SOC 2 examination. A tool’s output cannot substitute for that judgment. HIPAA obligations also do not disappear through a private certification.[3][4]
Karun Kaushik and Selin Kocalar met at MIT and left in 2023 to build Delve. The San Francisco Standard interviewed them about working from their Mission Bay apartment before moving into an office. Kocalar described the AI opportunity as “a now-or-never opportunity.” That explains urgency; it does not establish why later evidence problems allegedly occurred.[5]
Kocalar told Tech Funding News that an earlier medical scribe product exposed the team to HIPAA work. They saw document collection and repetitive reviews as a product opportunity. Delve then participated in YC’s Winter 2024 batch. The company’s launch announcement described tools that collect evidence automatically and track compliance tasks.[6][7]
Delve marketed an AI-assisted compliance workspace: connect company systems, collect evidence, track controls, prepare documents and coordinate reviews. Its current site also promotes continuous monitoring and questionnaire support. These are observed product claims; this review did not test a customer account or an audit engagement.[1]
Kaushik summarized the product problem as “Compliance frameworks are standardized. Businesses aren't.” The promised benefit was adapting evidence work to each customer instead of asking every company to fill the same checklist.[8]
Delve’s March 20 response described a boundary between its software and auditors. Customers review draft materials; licensed independent auditors issue final reports. The company said templates were starting points, rather than final attestations. Whether individual engagements respected that boundary remains disputed.[12]
Distribution was unusually visible. Kocalar described sending donuts and custom doormats to startups. Delve’s billboard account explains how it used customer address patterns to choose locations and worked with Division of Labor on creative. These accounts show deliberate audience targeting. They do not establish conversion rates.[6][9]
Delve targeted growing technology companies facing security reviews from larger buyers. The buyer’s immediate job was often to unblock a contract. That creates demand for faster preparation, while making the reliability of the resulting evidence commercially important. Delve’s named customer examples and time savings come from company announcements, not independently measured cohorts.[7]
The reviewed sources do not support a reliable market-size estimate. Delve’s successive customer claims show reported adoption, but customer counts alone do not establish active subscriptions, retention or addressable spending. Frameworks, company size and audit scope also change the work required.[7][8]
Established vendors already offer auditor collaboration. Drata’s Audit Hub documents evidence packages, period-specific snapshots and authorized auditor access. A new product therefore needs a specific improvement in evidence handoff or review, rather than a claim that competitors lack these functions.[13]
Delve sold compliance software and associated support. Its January announcement claimed profitability and millions in annual revenue run rate. Those are company statements; the reviewed sources provide no financial statements or customer-level revenue reconciliation. Adding the announced seed and Series A gives $35.3 million, excluding any undisclosed financing.[7][8]
A customer count multiplied by a quoted contract price cannot establish ARR. Plans, discounts and bundled audit fees can differ. The same limitation applies to estimating burn from employee counts. Neither calculation proves that the company was unprofitable or explains the allegations.
Delve reported more than 100 customers at launch and more than 500 at its Series A. Its current homepage says 1,500+. These claims are useful markers of its public positioning, but this review did not verify the customer base, churn, paid contracts or completed audits.[7][8][1]
The visible fundraising and marketing demonstrate access to capital and distribution. They do not independently measure evidence quality. In this market, growth and assurance quality must be assessed separately.
DeepDelver, an anonymous investigator, alleged fabricated evidence, prewritten audit conclusions and weak review practices. One statistic needs precise wording: the investigator said a particular endpoint-security sentence appeared in 493 of 494 SOC 2 reports. That is not a finding that entire reports were 99.8% identical. This review did not obtain the underlying report collection or independently reproduce the analysis.[10]
Delve denied those allegations. Its April response acknowledged falling short of its standards while scaling. It announced removal of auditor firms that did not meet its standards, direct customer-auditor communication, clearer template labels and a halt to automation interacting with audit workflows. These are announced measures, not independently verified completion.[2]
TechCrunch reported that Delve and YC parted ways.[14] It also reported that LiteLLM moved to Vanta and sought an independent audit.[15] These are material consequences, but neither establishes a company shutdown or an adjudicated fraud finding.
A separate dispute concerned Delve’s Pathways product and the open-source Sim project. Delve described a permitted Apache 2.0 fork. That license allows commercial reuse subject to its conditions; absence of a separate paid agreement alone does not establish infringement. This review did not compare historical repositories or settle compliance with every license condition.[2][16]
The supported mechanism is a trust problem at the handoff between software-generated materials, customer confirmation and independent review. Speed creates value only when recipients can understand what was observed, for which period, and by whom. Hashes can detect changed bytes; they cannot prove that a control operated or that an auditor performed sufficient work.