Your compliance report
may be worthless.
Here's what to do next.

What Happened

In late 2025, a misconfigured Google Spreadsheet belonging to Delve — a compliance automation startup that had raised $32 million from Insight Partners at a $300 million valuation — was accidentally made public. The spreadsheet contained links to hundreds of confidential draft SOC 2 and ISO 27001 audit reports.

A group of former Delve customers, operating under the name "DeepDelver," investigated the leaked data and published their findings in a detailed Substack report in early 2026. TechCrunch subsequently confirmed and expanded on the story.

The findings were damning:

• 493 out of 494 SOC 2 reports were nearly identical. The same paragraphs, the same grammatical errors, the same nonsensical descriptions — with only the company name and logo swapped out.
• Auditor conclusions were pre-written. The "Independent Service Auditor's Report" and all test procedures existed in draft reports before clients had submitted any evidence. The conclusion existed before there was anything to audit.
• Zero security incidents across 259 companies. Every single Type II report claimed zero incidents across the entire observation period. The statistical probability of this is effectively zero.
• Rubber-stamp audit firms. Delve's "US-based CPA firms" traced to Indian certification mills operating through shell entities and mailbox agents.
• Pre-fabricated evidence. The platform auto-generated passing evidence for employees who hadn't completed onboarding, fabricated board meeting minutes and risk assessments, and published fully populated trust pages before any compliance work had been done.

Delve has denied the allegations, characterizing itself as an "automation platform" that provides templates to auditors. However, Insight Partners has since scrubbed its investment thesis article about Delve, and Lovable — Delve's highest-profile customer at a $6.6 billion valuation — publicly confirmed it had already transitioned to Vanta months before the scandal broke.

Who's Affected

Delve Customers

Your SOC 2, ISO 27001, HIPAA, or GDPR certifications may be invalid. Reports were generated from identical templates with pre-written auditor conclusions — before your team provided any evidence. 58 companies have been identified by name, including Lovable, Bland, 11x, Incorta, WisprFlow, Greptile, micro1, and Sentra. Approximately 436 additional companies remain unidentified. Check the full list at dupedbydelve.com.

Enterprise Buyers Who Accepted a Delve Report

If any of your vendors provided a compliance report produced through Delve, you now have a gap in your third-party risk management audit trail. The dupedbydelve.com site lists downstream enterprise exposure including OpenAI, PayPal, Stripe, Amazon, Microsoft, and the U.S. Department of Veterans Affairs.

Regulated Industries

What to Do Right Now

If You're a Delve Customer

Facing a wave of re-questionnaires? Targhee answers them in hours from your actual documentation — with source citations your buyers can verify. Every answer is human-reviewed before submission. Book a free assessment →

If You're an Enterprise Buyer

• "What compliance automation platform did you use to prepare your SOC 2 report?"
• "Who is the independent CPA firm that conducted your audit?"
• "Can you provide their AICPA peer review number?"
• "What was the observation period for your Type II report?"

These questions would have caught the Delve issue immediately.

The Bigger Lesson: Compliance Reports Are Not Security

The Delve scandal exploited a structural weakness in how the industry handles vendor security reviews: the entire system runs on trust, and nobody verifies.

The typical process today: enterprise buyer asks for a SOC 2 report, vendor provides a PDF, buyer's security team skims it and checks a box, deal proceeds. At no point does anyone verify that the auditor is real, that the observation period happened, or that the controls match reality.

Security reviews need to go deeper than a PDF. A SOC 2 report is a starting point, not an endpoint. Buyers should be asking follow-up questions about specific controls, requesting evidence of ongoing monitoring, and verifying auditor credentials independently.

Questionnaire responses need to be traceable. When a vendor answers "yes, we encrypt data at rest using AES-256," that answer should be linked to a specific policy document, with a version number and a timestamp. Not generated from a template. Sourced from the vendor's actual documentation.

This is what Targhee's questionnaire automation platform is built on: every answer traceable to a specific source document, with a citation, a confidence score, and a human reviewer who approved it. The Delve scandal is a reminder of why that distinction matters.

Trust Centers need to be verified, not decorative. A trust page that was live before any compliance work was done is worse than no trust page at all. A legitimate trust center should contain current, independently audited documents gated behind an NDA with access logging.

Vendor risk assessment needs to be continuous. A point-in-time SOC 2 report from 12 months ago doesn't tell you what's true today. Targhee's Vendor Risk Assessment module makes ongoing reassessment manageable at scale.

How Targhee Can Help

We built Targhee specifically for the scenario that Delve's affected companies are now facing: responding to a high volume of security questionnaires quickly, accurately, and defensibly.

For Delve Customers Facing Re-Questionnaires

• Answer questionnaires in hours, not weeks. Upload any format and our AI drafts answers from your actual security documentation — your real policies, your legitimate audit reports, your actual architecture docs.
• Every answer is source-cited. Every answer includes a citation to the specific document and section it was drawn from. Your enterprise customers can verify every claim.
• Human review before anything goes out. Nothing is submitted without your team's explicit approval. Confidence scores flag uncertain answers for manual attention.
• Replace your Delve trust page. Set up a legitimate, NDA-gated trust center where buyers can self-serve your actual compliance documents.

For Enterprise Buyers Re-Assessing Vendors

• Send outbound questionnaires at scale. SIG, CAIQ, NIST, or custom frameworks — sent in one click with built-in reminders and deadline tracking.
• AI-generated risk scores. Our AI reads every vendor response, cross-references supporting documents, and generates a risk score with specific findings.
• Full audit trail. Every response, every score, every remediation — logged with timestamps and ready for your own auditors.

Ready to get started? Book a free assessment and we'll walk you through a real questionnaire in under 5 minutes. Book a free assessment → · See pricing →