AI compliance-automation platform (SOC 2, HIPAA, ISO 27001) that raised $32M at a $300M valuation before fraud allegations unraveled the company in 2026
HQ: San Francisco, California, United States | Founded: 2023 | Employees: ~24 (2025 est.) | Stage: Series A (post-controversy) | Website: https://delve.co
Delve was founded in 2023 by Karun Kaushik and Selin Kocalar, two MIT students who met during freshman week and dropped out during their sophomore year. Their first product was an AI medical scribe; when they ran into HIPAA compliance firsthand — costly, opaque, slow — they pivoted to selling compliance itself. The founders had unusually strong credentials on paper: Kaushik had done AI research at Stanford's Bintu Lab and helped scale a COVID diagnostic tool; Kocalar had published eight peer-reviewed papers by age 20 and led an experiment aboard the International Space Station. Both were later named to Forbes 30 Under 30 lists.
The product pitched an appealing idea: compliance frameworks are standardized, but businesses aren't, so teams drown in manual evidence collection. Delve claimed AI agents could collect compliance evidence, autofill vendor questionnaires, and continuously monitor infrastructure across SOC 2, HIPAA, ISO 27001, GDPR, and PCI DSS — delivering 'compliance in days.' After Y Combinator's Winter 2024 batch, it raised a $3.3M seed in January 2025 (Y Combinator, General Catalyst, FundersClub, Soma Capital) and then a $32M Series A led by Insight Partners in July 2025 at a $300M valuation, claiming 500+ customers including Lovable, Bland, and Wispr Flow, quarterly revenue doubling, and profitability. Founder-led sales with an ACV around $15,000 had generated $1M+ ARR before the first salesperson was hired.
The unraveling began in December 2025, when a publicly accessible Google Sheet exposed hundreds of confidential draft audit reports belonging to Delve clients. In March 2026, an anonymous Substack author ('DeepDelver') — who said they were a former Delve client — alleged that Delve fabricated evidence of board meetings and tests that never happened, generated auditor conclusions on behalf of two audit firms (Accorp and Gradient) before any independent review, and skipped major framework requirements while telling clients they were 100% compliant. A leaked dataset of 493 draft reports allegedly showed 99.8% identical boilerplate across clients. TechCrunch covered the allegations; Delve responded that it is an 'automation platform' that doesn't issue compliance reports — independent auditors do — and that templates are not 'pre-filled evidence.'
What followed compounded the damage: a second whistleblower, an internal employee, came forward with corroborating material. The company's 'Pathways' product was alleged to be an unattributed fork of Sim.ai's open-source SimStudio (Sim.ai's CEO confirmed no license agreement existed), and Delve scrubbed it from its website. LiteLLM publicly switched to competitor Vanta. Insight Partners scrubbed its investment announcement, Y Combinator publicly parted ways with the company, and TechCrunch later reported a security incident at another Delve customer. CEO Kaushik has denied fraud — at one point attributing the leaks to a 'targeted cyberattack' rather than a whistleblower — admitted the company 'grew too fast and fell short,' and began offering complimentary re-audits. As of mid-2026, Delve had suspended demos and frozen its sales pipeline. It had not formally shut down, and no regulatory findings had been published.
Note on numbers: external estimates put Delve at ~$2.6M revenue with ~24 employees (Getlatka, October 2025) — hard to reconcile with the claimed 500-1,000+ customers at a ~$15K ACV. That discrepancy is itself part of the record.
Delve was one of 2025's fastest-rising compliance startups — $32M Series A at a $300M valuation, 21-year-old MIT-dropout founders, 500+ customers in under two years. Then whistleblowers alleged its core promise was substantially fake: pre-generated audit evidence, rubber-stamp audit firms, and a competitor's open-source code shipped unattributed. The company denies fraud and has not formally shut down, but Y Combinator distanced itself and named customers defected — making Delve the reference case for trust risk in AI compliance tooling.
Browse: Home | Blog | About | All Startups A-Z | View full profile on StartupWiki