A lot of startups move fast with a small team.

You build something great and big corporation X wants to buy a subscription but you need to be certified.

Much of this is a good checklist but some of it is very european.

"Where is the risk register to track controls in your 7 person company?"

Now instead of doing what your team does best, you are doing paperwork theater for frameworks designed for a 100,000 employee enterprise.

You are documenting things nobody will read, making up processes that don't exist and translating the operations of a lean company into bureaucratic language.

What's needed is a variant of these standards for small teams, which is proportionate and pragmatic.

Compliance isn't that hard once you stop looking for shortcuts and start spending time doing it correctly.

AWS is probably the best actual CaaS vendor out there. They have a product offering expressly designed to help their customers get through this jungle:

https://docs.aws.amazon.com/artifact/latest/ug/what-is-aws-a...

You are still responsible for everything on top of what AWS provides (software/configuration/policy), but their compliance package handles a massive portion of what you would otherwise have to do if you were on-prem. Physical security, hardware management, disaster recovery, et. al., you get essentially "for free".

Even if this is a hit piece made by a competitor, the evidence put forwards is very damning:

> Conclusions present before customer signs or provides info

If false, the defamation damages here would be in the tens of millions. Huge respect to whoever stuck their neck out to post this.

Question: how likely is it that a number of 20-year olds have the passion of solving the problem of compliance auditing? I can hardly imagine that I'd even be interested in taking a look at the domain. It's just... so mundane. Or maybe the alpha-type overachievers don't care about the domain but the opportunity?

Interesting that the author (and "the others in his network") seem to only be concerned about the complete illegitimacy of their certs when they were already exposed and now they want to stand up and say they are the good guys for "exposing" Delve.

I've gone through this process and is this not a failure from the institute that are giving away these certifications for a fee without any due diligence?

intermediaries like delve have only amplified this failure.

it was obvious to anyone who was involved in this industry that, all of this is just security theatre with nothing really to back it up.

Love the depth of this post.

We were actually looking at it as well recently (we're using Drata). I was thinking "Cool, this looks like the next cool step forward". The claims didn't sound out of the world in my ears.

Every time an issue like this appears I wonder how many more undiscovered frauds are out there.

The only job of a test is to fail, so if you never see the page red it's not doing anything. It's refreshing to see this being called out instead of going with the flow because "everyone is doing so".

This was such as interesting read, but I found this link via LinkedIn rather than hackernews.

I would have expected this to be somewhere at the top right now given how deep the article digs and evidence seems legit.

> Delve was founded in 2023 by Karun Kaushik and Selin Kocalar, both Forbes 30 Under 30 members and MIT dropouts who met as freshmen.

Forbes 30 under 30 remains undefeated

Compliance is something that no one ever wants and everybody hates. Not a single founder wakes up in the morning thinking to themselves: "oh I wish I could make my company XYZ-123 compliant!"

Thus providing compliance is really just paying someone to shift responsibility.

The regulator can ask whether you are compliant. You can present certificate from Delve or someone else and that's the end of it.

Forbes 30u30 pipeline remains undefeated.

How did none of this come up during diligence? Feels like a prime example of too good to be true.

I remember having sales calls with them and the vibe was that it was "cheap and quick"... exactly what you want for your compliance

Delve did not even try to fake the reports well. They could have used AI tooling to write somewhat plausible Assertions of Management, but they just dropped in clear form submissions to the reports they provided. Here is an example from Cluely:

> We have prepared the accompanying description of Cluely, Inc., system titled "Cluely is a desktop AI assistant to give you answers in real-time, when you need it." throughout the period June 27, 2025 - September 27, 2025(description), based on the criteria set forth in the Description Criteria DC Section 200 2018 Description Criteria for a Description of a Service Organization’s System in a SOC 2 Report (description criteria).

> The description is intended to provide users with information about the "Cluely is a desktop AI assistant to give you answers in real-time, when you need it." that may be useful when assessing the risks arising from interactions with Cluely, Inc. system, particularly information about the suitability of design and operating effectiveness of Cluely, Inc. controls to meet the criteria related to Security, Availability, Processing Integrity, Confidentiality and Privacy set forth in TSP Section 100, 2017 Trust Services Principles and Criteria for Security, Availability, Processing Integrity, Confidentiality and Privacy (applicable trust services criteria).

I mean, just re-read this sentence:

> The description is intended to provide users with information about the "Cluely is a desktop AI assistant to give you answers in real-time, when you need it." that may be useful

It makes no sense at all.

Someone implemented the code to automate this report mill, and didn't think to even smooth it out with an LLM! There was clear intent here.

To imagine that an auditor reviewed and stamped this as a coherent body of work beggars belief.

Slopliance?

> the price quickly dropped to just $6,000 when they realized we were serious about going elsewhere, and they would throw in ISO 27001 and a 200 hour penetration test as well.

I'm sorry, but... $6,000 / 200 == $30 / hour? Just assuming the value of the actual certifications is $zero?

Wouldn't that raise some serious red flags?

There is a lot of serious allegations in here. But some of these complaints apply to most SOC 2 compliance services. For example: it points out that Delve provides pre-filled documents and encourages you to accept them as is. In my experience that is typical. I have seen companies just rubber stamp pre-created documents that describe IT processes that do not accurately reflect actual policy because the MBA[1] running the project didn't want to pull in IT and had no idea what any of it meant.

[1] No offense to MBA, just using it as a placeholder for: business stakeholder with no IT background.

Delve seems clearly scummy, but dear god the author's company was also engaging in fraud with their own customers and just hoping to skate by.

"The trouble starts when you look at the answers Delve’s AI provided. Based on what your Delve policies claim, the questionnaire AI answers questions stating you have an MDM, had a 200 hour pen-test performed, and do regular backup restoration simulations. Tens of questions are answered like that. Great, you just lied to your vendor but at least you have a good shot at landing the deal. So what did we do? We kept our mouths shut."

Pretty rotten stuff. I went from energy into the software startup world and as I've gotten further down that road and energy has become more and more of a hot field I've encountered a depressing increase in that "just do it to make a deal" ethos, but in critical infrastructure.

Like, no, former Apple PM who learned about an interconnection queue from ChatGPT last week, you are not going to fix the grid, and even moreso you can't "just do X and ask forgiveness later", not in electricity.

there needs to be a fund with an ethos of "move slowly and do things accurately"

Well now we know how Cluely and friends can claim to be SOC2 compliant.

Notice how none of Delve's affiliates on X are posting anything after that Substack post. Probably their lawyers told them not to say anything further.

What does that tell you about the scam that was unveiled?

Not good.

I've been talking about this for a while now. For those of you thinking... Oh, I use a "good" company... think otherwise.

https://x.com/HotAisle/status/1946302651383329081

The whole thing is a racket.

Major red flag with this should have been that their expensive marketing predicated heavily on them being MIT dropouts instead of any expertise in the space

> No custom tailoring, no AI guidance, no real automation. Just pre-populated forms that required you to click “save”.

I hate that I've become this cynical, but it's gotten to the point where reading the "no x, no y, just z" construct makes me assume that writing is AI generated (and then I immediately stop caring about reading it)

wow, cannot imagine now companies that tool the compliance, and get deals just to be fake. uff...

vibe compliance

Great write up. What makes this interesting...I thought it was cool what they were doing...but also seemed too good to be true. I went ahead a booked a demo call with them. Great personas. Very friendly. Can't say they had all the answers, but they did bring a CISO on the last meeting, which seemed a bit scripted. They also never disclosed any breaches, even after I asked them. Yikes. Good luck to the orgs that went through all that process.

wow you guys really delved into this

All this evidence seems pretty legit. I found this on LinkedIn and came here to post, but noticed it had already been posted. Surprised I didn’t see it on HN front page.

I miss 2010s YC until like 2017 ish when crypto sort of just caused a massive decline across the board.

I guess it is great if you're a grifter/scammer or looking to just sell off to a FANG.

[dead]

[dead]

Cluely and HockeyStack are scam companies too.

Cluely did the ChatGPT wrapper to cheat on interviews then sold the customer data to recruiters. The whole company promise is a scam, and useless since we have LLMs.

HockeyStack held contests for people to win cars etc and never delivered. They also lied about having revenues and a product when they had nothing built. Along with Greptile they were doing 7day weeks of unpaid labor from “trial periods”.

Scams all around.

[dupe]

How does this not reach the front page?

[flagged]

This seems like a hit job by a competitor. Really ruthless.

> Two months ago, an email went out to a few hundred Delve clients informing them that Delve had leaked their audit reports, alongside other confidential information, through a Google spreadsheet that was publicly accessible.

Who leaked the audit reports? Who sent this email? Who is taking the time to write this analysis and kill the company?

In my opinion, the majority of the points in the article are no news. A compliance saas that offers templates for policies, all of them do. The AI is a chatbot, well who thought.

I think the main point is the collusion between delve and the auditors. Is the evidence for that clear?