An anonymous Substack post has accused Delve, a privacy and security compliance startup, of misleading hundreds of customers into believing they were fully compliant with regulations like HIPAA and GDPR. The claim is based on alleged falsified evidence and a structure that inverts the normal audit process.

Delve, backed by Y Combinator and valued at $300M post-$32M funding, has denied the accusations. It says it merely provides templates for documentation rather than issuing compliance reports itself. However, critics argue that Delve’s approach undermines true regulatory adherence.

The Substack author, DeepDelver, detailed experiences suggesting Delve generates auditor conclusions and skips major framework requirements, forcing customers to choose between fake evidence or manual work with little automation. Delve counters by stating its role is in automation, not report generation.

Complicating matters further, another user reported gaining access to sensitive information from Delve, raising questions about the startup’s own security practices. Delve claims it is investigating leaks but remains under scrutiny.

The incident highlights the critical nature of compliance tools and the potential for even tech-savvy startups to overpromise on their capabilities. Whether Delve can maintain its valuation or client trust remains to be seen, as the situation unfolds with more information from both sides.