The Delve scandal: what 493 identical SOC 2 reports say about compliance automation

On 22 March 2026 an anonymous whistleblower calling themselves DeepDelver published a long analysis of compliance reports issued through Delve, a compliance automation startup reportedly valued at around $300 million. The headline number was hard to ignore: of 494 SOC 2 reports examined, 493 were nearly identical, down to the same grammatical errors.

Delve is a symptom of how the market buys SOC 2, and every company that accepted those reports without reading them helped build the market Delve sold into. Automation that produces the conclusion before it has looked at the evidence is fraud with a dashboard, and that is the part worth worrying about.

I've prepared companies for SOC 2 and ISO 27001 audits and sat on the vendor side of the table when an auditor asks for 25 sampled access tickets and a population list to prove they weren't cherry picked. I know what a real audit trail costs to produce. That is exactly why a report that costs nothing to produce should worry you.

What was alleged

The allegations, as reported by IANS Research, Corporate Compliance Insights and others, go beyond copy and paste. Draft reports reportedly arrived with test procedures and conclusions already written, before customers had submitted evidence. Public trust pages reportedly went live the moment a customer first logged in. The auditors were described as US based, and the whistleblower traced them to certification mills in India.

The fallout reported since includes Delve's removal from Y Combinator's portfolio and a lot of uncomfortable conversations for companies that had handed those reports to their own customers. These remain allegations, and you should read the primary coverage yourself. The mechanics are what matter for you, whatever the final legal outcome.

Why nobody noticed

A SOC 2 report is an attestation issued by a licensed CPA firm under AICPA standards. Its most useful part is Section 4, where the auditor lists each control, how it was tested and what exceptions were found. Almost nobody reads Section 4.

If you've ever received a vendor's SOC 2 report, opened the PDF, checked the date on page one and closed it, you've done what most procurement teams do. The industry had built a document whose only careful reader was the person who wrote it.

Identical reports should have been caught by any buyer who compared two of them. Nobody compared two of them, because the report had stopped being something you read and become something you collect.

The part about India

As an Indian practitioner, I find the certification mill detail the most uncomfortable part of this story. India has excellent auditors. It also has a market for certificates that require no audit, and buyers abroad have now learned that the hard way.

You can check this yourself. A SOC 2 report must be issued by a licensed CPA firm, and US CPA licences can be looked up on CPAverify. An ISO 27001 certificate should come from a certification body accredited by an IAF member such as NABCB in India or UKAS in the UK, and IAF CertSearch will tell you whether the certificate exists. Ten minutes of checking would have exposed a lot of this.

What compliance automation should prove

Good automation pulls evidence from the source system, stamps it with a time and a scope, and leaves the judgement to an independent auditor. The platform and the auditor should never be a single bundled product with a predetermined outcome.

When we designed Steppe we started from one rule: a status on the screen should trace back to the evidence behind it, with the date it was collected and the system it came from. If you use Vanta, Drata or Sprinto, demand the same thing from them. The good tools will show you without blinking.

What to do this week

If your own SOC 2 came through Delve, plan a fresh audit with an independent firm and tell your key customers before they ask. If you rely on vendors' SOC 2 reports, pick your five most important vendors, verify the auditor, and read Section 4 for each. If two vendors' control descriptions read word for word the same, you've learned something.

A compliance report is only worth the evidence underneath it, and any tool that hides the evidence is selling you the cover page.