Embattled startup Delve has ‘parted ways’ with Y Combinator: Startups

Compliance startup Delve has officially severed ties with prominent accelerator Y Combinator, a move announced by Delve's COO Selin Kocalar on X today. This separation marks a significant blow to the embattled company, which has been grappling with a wave of anonymous allegations regarding its compliance practices and data handling.

Y Combinator has removed Delve from its official directory of portfolio companies, and the startup's dedicated page on the YC website is no longer accessible. Kocalar's post expressed gratitude for the community and founder relationships forged during their time with the accelerator, reflecting on their YC interview at MIT.

This isn't the first time an investor has distanced itself from Delve amidst the swirling controversy. Earlier, Insight Partners appeared to delete social media posts about its investment in Delve, although its main blog entry on the investment was later reinstated. These actions collectively highlight the serious nature of the accusations facing the compliance firm.

Unpacking the Allegations

Delve has been at the center of a storm since an anonymous Substack user, identifying as "DeepDelver" and a former customer, published claims that the startup misled clients. The whistleblower alleged that Delve falsely assured customers of compliance with privacy and security regulations, purportedly by skipping crucial requirements and using "certification mills" that "rubber stamp" auto-generated reports. DeepDelver further bolstered these claims with what they presented as internal Slack messages and video posts, and even accused Delve of using an open-source tool without proper attribution or agreement. Adding to the company's woes, a security researcher claimed to have accessed sensitive Delve data. The startup also found itself in a related controversy when malware was discovered in an open-source project by its customer, LiteLLM, for which Delve provided security compliance.

Delve's Defense and Apology

In response to the escalating crisis, Delve's COO Selin Kocalar and CEO Karun Kaushik issued a blog post titled "Delve Sets the Record Straight on Anonymous Attacks," asserting their belief that the "evidence points to a malicious attack rather than a genuine whistleblower." They alleged that an attacker gained access to Delve under false pretenses, maliciously exfiltrated company data, and subsequently launched a "coordinated smear campaign." A screenshot was included in their post, purportedly showing the attacker exfiltrating an audit tracking spreadsheet via file.io.

The executives characterized DeepDelver's criticisms as a "mix of fabricated claims, cherry-picked screenshots, and data taken out of context." Regarding the open-source tool, Delve stated it "built on an Apache 2.0 open-source repository, which explicitly permits commercial use," and significantly re-engineered it for compliance applications.

Steps Towards Rebuilding Trust

Despite their counter-claims, Delve's leadership also acknowledged shortcomings and outlined steps to rebuild customer trust. These measures include "cleaning up the company’s network to remove auditing firms that don’t meet our standards," providing "complimentary re-audits and penetration tests to all active customers," and clarifying that Delve's templates are intended as "starting points only."

CEO Karun Kaushik took to X to echo these points, adding a direct apology: "[W]e grew too fast and fell short of our own standard. To our customers, we deeply apologize for the inconveniences caused." TechCrunch has reached out to both Y Combinator and DeepDelver for their comments on Delve's latest statements.

FAQ

Q: Why did Delve and Y Combinator part ways? A: The separation occurred amidst a significant and ongoing controversy surrounding Delve, where the compliance startup faces anonymous allegations of misleading clients with fake compliance reports, misrepresenting open-source tools, and experiencing data exfiltration. Y Combinator has removed Delve from its official listings.

Q: What are the main allegations against Delve? A: Anonymous claims, primarily from "DeepDelver," accuse Delve of telling clients they were compliant while allegedly skipping important requirements, using "certification mills" for rubber-stamped reports, passing off an open-source tool as its own, and having sensitive data accessible to a security researcher.

Q: How has Delve responded to these accusations? A: Delve's leadership has asserted that the allegations stem from a "malicious attack" rather than a genuine whistleblower, claiming an attacker exfiltrated data to orchestrate a smear campaign. They describe the criticisms as fabricated or taken out of context, and have apologized for falling short, announcing steps like removing sub-standard auditing firms and offering re-audits to customers.