Delve

• LiteLLM and Context AI, both identified as Delve customers by third parties rather than by Delve, said after the March 2026 allegations that they were moving their compliance work to Vanta. Their departures establish Vanta as a substitute and weaken Delve's public retention evidence.
• In April 2026 Delve said it had halted automation that interacts with audit workflows. No reviewed source states which advertised capabilities that pause covers or whether it is still in effect, so a buyer cannot tell the current automation scope from the public record.
• The reviewed product pages disclose no base price, so a buyer cannot compare its cost against alternatives without entering a sales conversation.
• The reviewed sources give dated customer-count floors rather than exact counts: about 100 in January 2025, over 500 by July 2025, more than 1,700 in Delve's March 2026 post, and 1,500+ on the archived homepage, so the reviewed record does not establish Delve's current customer scale.
• The reviewed pages link to no public documentation site, so a technical buyer checking integration coverage works from Delve's marketing pages and a competitor's comparison page.

Delve sells to companies that need a security certification before a customer will sign. Its pages address startups getting a first SOC 2, midmarket teams automating manual compliance work, and enterprise programs, and the regime list runs from SOC 2 and HIPAA to ISO 27001, GDPR, PCI DSS, and ISO 42001. The homepage states the problem as compliance busywork that keeps teams checking boxes instead of closing deals.

The size of that pain comes from Delve rather than from an outside measure. A Business Insider article carries the cofounder's framing that compliance is an industry waiting for its revolution, and a TechCrunch article carries the founders' account of hitting HIPAA costs while building a medical scribe and then building tools so other companies could get compliant faster. Neither puts a number on what the work costs a company.

An IANS Research post turns from the problem to the remedy: it says the case highlights growing risk in compliance automation where speed outpaces independent verification, and quotes an IANS faculty member saying a SOC 2 Type II report was never meant to be a security guarantee. For Delve, that scrutiny makes independent audit verification a diligence item alongside price and speed. [s1, s7, s18, s8, s16]

Delve's agents do collection work a compliance team would otherwise do by hand. The homepage describes autonomous agents that take screenshots, write reports, and validate evidence, daily infrastructure scanning for compliance issues, and a code check on every pull request. The enterprise page adds questionnaire autofill that draws answers from a customer's policies and technical setup, and vendor-review analysis that highlights gaps.

Detailed technical capability evidence comes from pages Delve wrote, and the independent coverage in the record describes the product at a high level without validating its implementation. The reviewed pages link to no public documentation site, so the detail a technical buyer would check lives on marketing pages.

Delve and its anonymous accuser give different integration counts. Delve's March 2026 post says the platform supports more than 120 automated integrations and subservices, against the 14 the anonymous post alleged. A Vanta comparison page, published by a competitor, says Delve uses AI agents for evidence collection but supports significantly fewer integrations, and that its support for only six compliance regimes limits flexibility, a count that conflicts with the larger framework grid on Delve's own homepage. No independent count appears in the reviewed sources. [s1, s7, s26, s3, s24, s17]

Vanta places Delve alongside Drata on its own comparison page, while LiteLLM and Context AI independently demonstrate Vanta as a purchasing substitute. Vanta publishes a three-way comparison page naming Delve, which describes Delve as an AI-first compliance platform for startups pursuing their first SOC 2. That is a competitor's characterization of Delve, and the announced moves by LiteLLM and Context AI are what establish Vanta as a purchasing substitute.

LiteLLM and Context AI both said they were replacing Delve with Vanta. A TechCrunch article records LiteLLM's chief technology officer saying the company would use Vanta to re-certify and find its own independent third-party auditor. A later TechCrunch article records Context AI confirming it moved its compliance program to Vanta and engaged Insight Assurance for new examinations. Both moves came within weeks of the March 2026 allegations.

Delve's own differentiation claim is speed plus service. Its homepage promises compliance in days, one-to-one Slack support with security experts, and a free trust report customers can share with their own buyers. [s24, s13, s15, s1]

Outside reporting documents Delve's customer growth through mid-2025. A TechCrunch article puts the base at over 500 in July 2025, up from the 100 the company reported in January, and names Lovable, Bland, and Wispr Flow among them. A Business Insider article from January 2025 names 11x and Bland and carries Delve's own claim of a revenue run rate of several million dollars.

The counts since then come from Delve and from one secondhand figure. Its March 2026 post claims more than 1,700 customers, its homepage says more than 1,500, and a Channel Insider article says the company reportedly has over 1,000 clients in 50 countries. Because the figures come from different dates and sources, the reviewed record does not establish Delve's current customer count.

The most recent independent traction evidence records departures. LiteLLM and Context AI both said they were re-certifying with Vanta, and a TechCrunch article says Lovable had already left in late 2025. The archived independent sources document three named departures: LiteLLM, Context AI, and Lovable. They do not establish Delve's current customer-reference list. Delve's April 2026 post says a significant number of customers were already working with it to complete re-audits and penetration tests, and no source independent of Delve tests that count. [s8, s18, s3, s1, s17, s13, s15]

Karun Kaushik and Selin Kocalar founded Delve after meeting as MIT freshmen and dropping out in their sophomore year in 2023. Neither has a prior security or audit product in the reviewed record. Their public recognition is media and list-based, including a 2026 Forbes 30 under 30 induction and a 2025 New York Times feature that an article in The Tech records.

The institutional record in 2026 is mixed. As of April 2026 Delve no longer appeared in Y Combinator's directory, and a TechCrunch article records the chief operating officer saying on X that the two had parted ways. The same article says Insight Partners appears to have removed posts about its investment, and notes its primary blog post was later restored.

Kaushik has publicly criticized the company's growth pace in his own words. A TechCrunch article quotes him saying the company grew too fast and fell short of its own standard, and Delve's blog says it moved quickly to scale and fell short of the standard it holds itself to. Delve also says it hired cybersecurity firms and believes the episode was a malicious attack, and the reviewed sources do not settle whether it was an attack or a whistleblower disclosure. [s8, s20, s22, s14, s4, s19]

Delve publishes a trust center at trust.delve.co listing SOC 2 Type II as compliant, with a SOC 2 report request and a penetration-test resource listed alongside its controls and subprocessors. Delve offers its customers, free per its homepage, the same kind of trust report it publishes for itself.

The security of Delve's own environment came up during the March 2026 coverage. A TechCrunch article records an X user named James Zhou saying they were able to gain access to sensitive Delve information such as employee background checks and equity vesting schedules. The reviewed record contains no verification of that claim and no Delve response to it. Separately, in an April 2026 post responding to the anonymous allegations, Delve said an attacker bought the product under false pretenses and exfiltrated internal company data, including its audit tracking spreadsheet. The reviewed record does not independently establish who took the data or how.

Delve announced changes to its audit work, and the reviewed sources do not independently establish their current implementation. In March and April 2026 its posts said it was rebuilding the auditor network, removing firms that do not meet its standards, and halting automation that interacts with audit workflows. The same posts offered active customers complimentary re-audits and penetration tests, with auditor communication moving into the customer's own Slack channel or a shared email thread. The independent press coverage in the reviewed record ends in April 2026 and does not establish the current state. [s6, s9, s4, s5, s1, s23]

Add analyzed competitors to compare them side by side with Delve.

Delve segments by company size and sells one platform to each band. Its product pages split into startup, midmarket, and enterprise, with the startup pitch built on getting compliant fast to close first enterprise deals and the enterprise pitch built on replacing manual processes so a team can focus on strategy. The customers named in the reviewed record are predominantly software and AI startups, and separate reviewed accounts describe unnamed clients handling protected health information.

Delve's homepage frames compliance as a condition for closing deals and does not identify the buyer's job title or budget owner, so the reviewed pitch does not settle who owns the purchase. Delve frames compliance as the thing standing between a company and closed revenue, and its homepage frames the cost of non-compliance as lost revenue rather than a security incident. That framing addresses the revenue consequence of compliance rather than the security one.

The regime list reaches further than the evidenced buyer. Delve's homepage offers SOC 2, HIPAA, GDPR, PCI DSS, ISO 27001, and ISO 42001 in its navigation, and its certification grid adds FedRAMP, HITRUST, and NIST AI. No customer in a regulated sector is named in the reviewed sources, though IANS and The Tech both describe Delve clients that handle protected health information without naming them.

Delve's claimed advantage is autonomous agents doing the evidence work. Its homepage describes autonomous agents that take screenshots, write reports, and validate evidence, plus daily infrastructure scanning and a code check on every pull request. The enterprise page adds questionnaire autofill drawn from a customer's own policies and technical setup.

Delve ingests the customer's own data, and its trust center names an outside model supplier. Delve says it ingests team members and technical integrations to customize a control set, and its trust center lists Anthropic among its subprocessors for AI services. No proprietary corpus and no cross-customer data asset appears in the reviewed sources, so they do not establish an exclusive data advantage for Delve.

How much of that automation ran is disputed in the record. Delve's March 2026 post says the platform supports more than 120 automated integrations and subservices, against the 14 the anonymous post alleged. Delve's April 2026 post says it halted any automation that interacts with audit workflows, and the reviewed record does not say which advertised capabilities that covers.

Delve routes purchase inquiries to a demo booking. The product pages and the press page carry Book a Demo, and existing customers reach the application through a login link. The reviewed pages show no self-service signup and no free tier.

Founder-fronted communication is what the record shows. The founders front the public communication, including the April 2026 statement over both their names.

Named customers left in 2026, which weakens Delve's public retention evidence. LiteLLM's chief technology officer said the company would re-certify with Vanta and find its own independent auditor, Context AI confirmed it moved its compliance program to Vanta and engaged Insight Assurance, and a TechCrunch article says Lovable had already left in late 2025. Delve had announced free re-audits and penetration tests for active customers on 24 March, before either announcement. Delve's April 2026 post says a significant number of customers were already working with it to complete re-audits and penetration tests, and no source independent of Delve tests that count.

No base-platform price or paid dollar amount appears on the reviewed Delve pages. The site sends pricing conversations to its team, and the reviewed pages link to no pricing page, so a buyer cannot compare cost against alternatives without entering a sales conversation.

What Delve does publish is the shape of the package. Its homepage lists white-glove onboarding, one-to-one Slack support, a dedicated compliance expert, a trust report, and security questionnaire autofill as free, with an advanced penetration test and vCISO support as add-ons. No reviewed source states what is charged for or at what price.

The speed and service claims around that package are Delve's own, so a buyer has to test them in the sales process.

Delve runs as a hosted service that reaches into the customer's stack. A Channel Insider article says its agents plug into systems such as AWS, GitHub, and Slack to collect evidence automatically, and Delve's own pages show connections to AWS and GitHub. The customer keeps operating its own systems, and Delve says customers fully build and manage their own codebases, infrastructure, and day-to-day security operations.

Delve said in March 2026 that audit communication would run in the customer's own channels. Delve says communication with auditors happens directly in the customer's Slack channel or a shared email thread, a change it made after the March 2026 allegations. Customers can request a formal engagement letter from the auditor at no cost.

Operational documentation is thin in the public record. The reviewed pages link to no documentation site, so an engineering team estimating deployment effort works from marketing pages and a competitor's comparison.

Delve publishes a trust center listing SOC 2 Type II as compliant, with a SOC 2 report request and a penetration-test resource listed alongside its controls and subprocessors. Delve offers its customers, free per its homepage, the same kind of trust report it publishes for itself.

Delve's own environment came under public scrutiny in 2026. A TechCrunch article records an X user named James Zhou saying they were able to gain access to sensitive Delve information such as employee background checks and equity vesting schedules. The reviewed record contains no verification of that claim and no Delve response to it. Separately, in an April 2026 post responding to the anonymous allegations, Delve said an attacker bought the product under false pretenses, took internal company data including its audit tracking spreadsheet, and used it against the company. The reviewed record does not independently establish who took the data or how.

The remediation Delve announced is specific and checkable. In March and April 2026 it said it was rebuilding its auditor network, removing firms that do not meet its standards, and halting automation that interacts with audit workflows. It also said it was connecting customers to an AICPA-accredited SOC 2 auditor for a free re-audit and a free grey-box penetration test. The independent press coverage in the reviewed record ends in April 2026 and does not establish the current state. A buyer can ask for the engagement letter Delve says those auditors will provide.

Delve calls itself a partner rather than a platform, and its product surface matches that. The homepage groups evidence-collection agents, questionnaire autofill, code scanning, infrastructure scanning, and a policy assistant into one product a customer configures. Nothing in the reviewed record depends on Delve at runtime.

Its agents read from AWS, GitHub, and Slack, and its trust center lists Anthropic among the subprocessors providing AI and ML services. Those are reproducible inputs, and separately the reviewed sources name no exclusive Delve asset created from them.

The trust report is the one place Delve's output reaches beyond its own customer. Delve gives customers a free report they can share with their buyers, which puts its work in front of people who never bought it. The reviewed sources show no way in which one customer's report improves another customer's, so the reach is distribution rather than a compounding network.

Delve is founder-run. No independently verified current headcount appears in the reviewed record, so Delve's present staffing depth cannot be assessed from public sources. The San Francisco Standard described an eight-person company in February 2025 that had moved from an apartment in Mission Bay to a Financial District office. The careers page says Delve is hiring across all roles.

The founders' record before Delve is academic, and a TechCrunch article notes Kaushik had scaled a COVID diagnostic system to thousands of users during the pandemic. Karun Kaushik and Selin Kocalar met as MIT freshmen, dropped out in their sophomore year in 2023, and carry a 2026 Forbes 30 under 30 induction and a 2025 New York Times feature. Neither has a prior security or audit product in the reviewed record.

The institutional record in 2026 is mixed. As of April 2026 Delve no longer appeared in Y Combinator's directory, and its chief operating officer said the two had parted ways. Insight Partners appears to have removed posts about its investment before its main blog post was restored. Kaushik said publicly that the company grew too fast and fell short of its own standard. Delve says it brought in cybersecurity firms and believes the episode was a malicious attack, and the reviewed sources do not settle whether it was an attack or a whistleblower disclosure.