.svg){kind=logo}
A 2026 investigation found Delve generating identical boilerplate SOC 2 reports across nearly all its customers and routing audits through non-independent firms. For startups that need a compliance report that holds up in real enterprise due diligence, how that report is produced matters as much as having one.
A 2026 investigation found Delve generating identical boilerplate SOC 2 reports across nearly all its customers, routing audits through non-independent firms, and drawing conclusions before audit observation periods ended. For startups that need a compliance report that holds up in real enterprise due diligence, how that report is produced matters as much as having one.
Independent auditors, every time. Every ComplyJet customer is matched with a vetted, AICPA-accredited independent auditor. Audit conclusions come from evidence, not templates. The audit firm is separate from ComplyJet — there is no conflict of interest built into the structure.
A team that drives the process. Hands-on guidance through evidence collection, control implementation, and auditor coordination — from kickoff to sign-off. A dedicated account manager on every plan, 5-minute response SLA, and a team that owns the compliance program alongside you.
Compliance that holds up. A report your enterprise buyers can scrutinise. Built on real evidence, verified controls, and a credible audit process. The point of compliance is closing deals and surviving diligence — a report that fails scrutiny defeats the purpose entirely.
In March 2026, a TechCrunch investigation published findings from whistleblowers and audit document analysis. Across 494 Delve customers, 493 received SOC 2 reports with near-identical wording. Audit conclusions in some reports pre-dated the observation period they were supposed to cover — meaning the conclusions were generated before the audit was conducted. Nearly all audits were routed through two firms — Accorp and Gradient — described by investigators as operating as part of the same organisation, with minimal US presence and no meaningful independence from Delve.
Following the investigation, Y Combinator asked Delve to leave its accelerator program. Insight Partners, an early investor, removed their affiliation. The investigation raised structural questions about the audit model — not just isolated incidents — that the compliance industry will need to reckon with as the sector matures.
A SOC 2 report is only valuable if the enterprise buyer's security team trusts it. A report with boilerplate language, non-independent auditors, or pre-generated conclusions will fail scrutiny in any serious due diligence process. The compliance report you produce isn't just a document to check a box — it's the artifact that closes enterprise deals, satisfies investor diligence, and demonstrates to your customers that their data is handled responsibly.
Startups who obtained reports through Delve may face the requirement to re-audit from scratch — not because their controls were inadequate, but because the audit itself cannot be defended. That outcome is worse than not having started compliance: it means time, money, and lost enterprise deals spent on a report that doesn't hold up.
The point of independence in audit standards isn't procedural formalism — it's the mechanism that makes the opinion credible. An auditor that is structurally connected to the compliance platform being assessed cannot produce a genuinely independent opinion. That's why AICPA independence requirements exist, and why they matter for the value of any SOC 2 report.
If your company received a SOC 2 or ISO 27001 report through Delve, the most important question is whether your enterprise buyers will accept it. Given the public coverage of the investigation, some buyers may not — particularly enterprise security teams with established due diligence processes that include verifying auditor credentials and checking report language for template indicators.
A re-audit with an independent firm through a new platform resets the record. The good news: much of the compliance work you did with Delve — control implementation, policy documentation, evidence collection — can carry over. What changes is the audit itself: conducted by a genuinely independent firm, over a proper observation period, producing a report customised to your environment.
If you are in active enterprise deals and your prospects are asking about SOC 2, the right move is to understand what your current report's standing is — and whether a re-audit is warranted before those deals close. ComplyJet's team is available to help you assess that honestly, with no obligation.
From founders and CTOs who thought carefully about the decision
© 2026 ComplyJet. All rights reserved.
