An anonymous Substack post published this week accuses compliance startup Delve of “falsely” convincing “hundreds of customers they were compliant” with privacy and security regulations, potentially exposing those customers to “criminal liability under HIPAA and hefty fines under GDPR.”
Delve is a Y Combinator-backed startup that last year announced raising a $32 million Series A at a $300 million valuation. (The round was led by Insight Partners.) On Friday, the startup attempted to refute the accusations on its blog, calling the Substack post “misleading” and saying it “contains a number of inaccurate claims.”
The Substack post is credited to “DeepDelver,” who described themselves as working at a (now former) Delve client.
DeepDelver recounted receiving an email in December claiming the startup had “leaked a spreadsheet with confidential client reports.” While Delve CEO Karun Kaushik apparently assured customers in a subsequent email that they were in compliance and that no external party gained access to sensitive data, DeepDelver said they and other customers had become suspicious.
“Having the shared experience of being underwhelmed with the Delve experience, and having the overall sense that something fishy was going on, we decided to pool resources and investigate together,” they wrote.
Their conclusion? That Delve “achieves its claim of being the fastest platform by producing fake evidence, generating auditor conclusions on behalf of certification mills that rubber stamp reports, and skipping major framework requirements while telling clients they have achieved 100% compliance.”
DeepDelver went into considerable detail about those claims, accusing the startup of providing customers with “fabricated evidence of board meetings, tests, and processes that never happened,” then forcing those customers to “choose between adopting fake evidence or performing mostly manual work with little real automation or AI.”
Techcrunch event
San Francisco, CA
|
October 13-15, 2026
DeepDelver also claimed that virtually all of Delve’s clients seem to have gone through two audit firms, Accorp and Gradient, which they described as “part of the same operation,” one that operates primarily in India, with only a nominal presence in the United States.
Those firms, they said, are just rubber-stamping reports that were generated by Delve. As a result, DeepDelver said the startup “inverts” the normal compliance structure: “By generating auditor conclusions, test procedures, and final reports before any independent review occurs, Delve places itself in the role of both implementer and examiner. This is not a technicality. It is a structural fraud that invalidates the entire attestation.”
In addition to accusing Delve of misleading its customers, DeepDelver said the startup is helping those customers “mislead the public by hosting trust pages that contain security measures that were never implemented.”
DeepDelver said that while their company was discussing its issues with Delve, the startup “sent us multiple boxes of donuts already to keep us happy.” Nonetheless, DeepDelver’s employer supposedly unpublished its trust page and no longer relies on the startup for compliance.
Delve responded to the accusations by saying it does not issue compliance reports at all. Instead, it’s an “automation platform” that ingests information about compliance, then provides auditors with access to that information.
“Final reports and opinions are issued solely by independent, licensed auditors, not Delve,” the company said.
Delve also said that its customers “can opt to work with an auditor of their choosing or opt to work with one from Delve’s network of independent, accredited third-party audit firms.” Those auditors, the startup said, are “established firms used broadly across the industry, including by other compliance platforms.”
In response to the accusation that it’s providing customers with “fake evidence,” Delve countered that it’s simply offering “templates to help teams document their processes in accordance with compliance requirements, as do other compliance platforms.”
“Draft templates are not the same as ‘pre-filled evidence,” the company said.
Delve added that it is “actively investigating any leaks” and is “still reviewing the Substack.”
Following the initial Substack post, an X user named James Zhou said they were able to gain access to sensitive information from Delve such as employee background checks and equity vesting schedules. Dvuln founder Jamieson O’Reilly shared more details from what O’Reilly said was a conversation with Zhou about “several gaping security holes in Delve’s external attack surface.”
TechCrunch sent an email seeking additional comment to the media contact address listed on Delve’s website. The email bounced, but I subsequently received a calendar invite for a “Delve demo” later this week. TechCrunch has also reached out to DeepDelver for additional comment.
This post has been updated with additional information about purported security vulnerabilities provided by Jamieson O’Reilly, and additional details about Delve’s response to TechCrunch.
Source link
#Delve #accused #misleading #customers #fake #compliance #TechCrunch
![Masochistic YouTuber Punishes Himself by Writing a First Person Shooter Entirely in COBOL
So: masochism. You might know that it takes its name from 19th-century Austrian nobleman and writer Leopold Ritter von Sacher-Masoch—and specifically from the content of his famous work, Venus in Furs, which catalogued the narrator’s submissive nature and fondness for experiencing pain and humiliation. Masoch himself was apparently not amused by the fact that his name became attached to such predilections—probably fair, given that the term was first used in a book entitled Psychopathia Sexualis, which also pioneered negging by speculating that Masoch himself “would have achieved real greatness had he been actuated by normally sexual feelings.” Happily, modern attitudes to the “S” part of BDSM are significantly more enlightened than they were in the 1880s and 1890s. In entirely unrelated news, a YouTuber by the name of icitry—whose bio on the site reads simply “try now, suffer later”—has written a whole first-person shooter in freaking COBOL. If you’ve never had to deal with COBOL, well, good for you, and you should probably keep it that way. The language is amongst the oldest computer languages, and was developed in the 1960s for managing business mainframes. It’s probably what drove poor Ginsberg in Mad Men out of his mind. COBOL remains in use today, largely in such legacy mainframes and other places where it’s not feasible to replace existing systems that, for all their foibles, still work.
One purpose for which it absolutely does not remain in use—and, in fact, has never been used—is programming first-person shooters. So why in the name of all that is good and holy would anyone do this to themselves? [embed]https://www.youtube.com/watch?v=qzpZQe7JT-o[/embed] In his video, icitry explains that the project started with him wondering, “What’s the dumbest but still technically possible language for writing a small FPS style game?” The answer was, yes, COBOL, and because the laws of the universe dictate that anything that can happen must happen, icitry got to work. Long, painstaking, tedious hours of work.
As he points out, COBOL is “old, verbose, missing most features even the shittiest modern languages have … and is definitely not created for game development.” All of this is true, although in fairness to COBOL, it was created at a time when people were still figuring out how programming should work and what a programming language should aim to be. Its earliest standard predated the idea of structured programming, although it soon attracted criticism from advocates of that concept— Edsger Dijkstra, in particular, famously hated the language and said its use “cripples the mind.” To modern eyes, just trying to parse a COBOL program is enough to induce a headache, let alone trying to write a game in it—but, miraculously, icitry manages to get his Wolfenstein 3D-esque project to work. He dodges COBOL’s complete lack of graphical functions by basically treating the game as what he calls a “frame generator”: his code computes the contents of each frame and uses a standard output function to write the results into a simple image format. This is rendered by ffplay—which, yes, is probably cheating, but not even old Leopold would try to write an entire graphics API from scratch in COBOL.
Elsewhere, icitry dodges COBOL’s lack of input management by using the console to input single characters to his game. He doesn’t so much dodge COBOL’s lack of any vector math functions—which are kind of important for a game where the entire gameplay loop revolves around calculating and manipulating 2D movement vectors—as he does just work around them by kinda writing them himself. And then, as if this wasn’t all enough self-punishment, he goes the extra mile by implementing DOOM engine functions like variable ceiling height. The whole project is a testament to mankind’s ingenuity, resourcefulness, and ability to withstand all manner of self-inflicted punishment. Watching the game run, you’d never guess it was written in a language so manifestly unsuited for the task at hand. Still! At least it’s not FORTRAN, right? Right?? *smash cut to an Austrian aristocrat at his desk with a copy of The Fortran Automatic Coding System for the IBM 704 and the DOOM source code* #Masochistic #YouTuber #Punishes #Writing #Person #Shooter #COBOLCOBOL,Doom,Wolfenstein 3D Masochistic YouTuber Punishes Himself by Writing a First Person Shooter Entirely in COBOL
So: masochism. You might know that it takes its name from 19th-century Austrian nobleman and writer Leopold Ritter von Sacher-Masoch—and specifically from the content of his famous work, Venus in Furs, which catalogued the narrator’s submissive nature and fondness for experiencing pain and humiliation. Masoch himself was apparently not amused by the fact that his name became attached to such predilections—probably fair, given that the term was first used in a book entitled Psychopathia Sexualis, which also pioneered negging by speculating that Masoch himself “would have achieved real greatness had he been actuated by normally sexual feelings.” Happily, modern attitudes to the “S” part of BDSM are significantly more enlightened than they were in the 1880s and 1890s. In entirely unrelated news, a YouTuber by the name of icitry—whose bio on the site reads simply “try now, suffer later”—has written a whole first-person shooter in freaking COBOL. If you’ve never had to deal with COBOL, well, good for you, and you should probably keep it that way. The language is amongst the oldest computer languages, and was developed in the 1960s for managing business mainframes. It’s probably what drove poor Ginsberg in Mad Men out of his mind. COBOL remains in use today, largely in such legacy mainframes and other places where it’s not feasible to replace existing systems that, for all their foibles, still work.
One purpose for which it absolutely does not remain in use—and, in fact, has never been used—is programming first-person shooters. So why in the name of all that is good and holy would anyone do this to themselves? [embed]https://www.youtube.com/watch?v=qzpZQe7JT-o[/embed] In his video, icitry explains that the project started with him wondering, “What’s the dumbest but still technically possible language for writing a small FPS style game?” The answer was, yes, COBOL, and because the laws of the universe dictate that anything that can happen must happen, icitry got to work. Long, painstaking, tedious hours of work.
As he points out, COBOL is “old, verbose, missing most features even the shittiest modern languages have … and is definitely not created for game development.” All of this is true, although in fairness to COBOL, it was created at a time when people were still figuring out how programming should work and what a programming language should aim to be. Its earliest standard predated the idea of structured programming, although it soon attracted criticism from advocates of that concept— Edsger Dijkstra, in particular, famously hated the language and said its use “cripples the mind.” To modern eyes, just trying to parse a COBOL program is enough to induce a headache, let alone trying to write a game in it—but, miraculously, icitry manages to get his Wolfenstein 3D-esque project to work. He dodges COBOL’s complete lack of graphical functions by basically treating the game as what he calls a “frame generator”: his code computes the contents of each frame and uses a standard output function to write the results into a simple image format. This is rendered by ffplay—which, yes, is probably cheating, but not even old Leopold would try to write an entire graphics API from scratch in COBOL.
Elsewhere, icitry dodges COBOL’s lack of input management by using the console to input single characters to his game. He doesn’t so much dodge COBOL’s lack of any vector math functions—which are kind of important for a game where the entire gameplay loop revolves around calculating and manipulating 2D movement vectors—as he does just work around them by kinda writing them himself. And then, as if this wasn’t all enough self-punishment, he goes the extra mile by implementing DOOM engine functions like variable ceiling height. The whole project is a testament to mankind’s ingenuity, resourcefulness, and ability to withstand all manner of self-inflicted punishment. Watching the game run, you’d never guess it was written in a language so manifestly unsuited for the task at hand. Still! At least it’s not FORTRAN, right? Right?? *smash cut to an Austrian aristocrat at his desk with a copy of The Fortran Automatic Coding System for the IBM 704 and the DOOM source code* #Masochistic #YouTuber #Punishes #Writing #Person #Shooter #COBOLCOBOL,Doom,Wolfenstein 3D](https://gizmodo.com/app/uploads/2026/06/cobol-fps-1280x853.png)

Post Comment