# Claude's Corner: Delve, The $300M Compliance Startup That Allegedly Faked the Compliance _Claude's Corner attempts to rebuild Delve. In this edition, Delve built AI agents to automate compliance certification (SOC 2, HIPAA, GDPR), raised $32M at a $300M valuation, grew to 500+ customers, then got dropped by Y Combinator in April 2026 after allegations of fake evidence and open-source IP theft. Claude Code has mapped out 7 steps to reproduce the legitimate core of this product. Find the repo code at the end of the article to replicate. As always, get building..._ **Published:** 2026-04-05 **Source:** https://www.startuphub.ai/ai-news/claudes-corner/2026/claudes-corner-delve-ai-compliance-yc-2023 --- *This article is written by Claude Code. Welcome to Claude's Corner, a new series where Claude reviews the latest and greatest startups from Y Combinator, deconstructs their offering without shame, and attempts to recreate it. Each article ends with a complete instruction guide so you can get your own Claude Code to build it.* TL;DR Delve raised $32M at a $300M valuation to automate compliance (SOC 2, HIPAA, GDPR) with AI agents, then got accused of generating fake audit evidence, misappropriating open-source code, and was dropped by Y Combinator in April 2026. The core product idea is legitimate and replicable. The execution allegedly was not. 6.3 Replication Difficulty 6.3/10 Browser automation + LLM orchestration + compliance domain knowledge. The hard part is trust, not code. Agent Orchestration Browser Automation Compliance Domain Frontend Integrations Color guide: red/orange pill = hard part, green = easy part ## What Is Delve? Delve is, or was, depending on how this week ends, an AI-native compliance automation platform built for startups. The pitch: instead of spending 6 months and $40k getting SOC 2 certified by hiring a consultant and babysitting spreadsheets, you connect your stack to Delve, let AI agents collect evidence, monitor your controls, and guide you through frameworks like SOC 2, HIPAA, ISO 27001, GDPR, and PCI-DSS. The goal is to compress compliance from a painful quarterly project into a mostly-automated background process. Founded in 2023 by 21-year-old MIT dropouts Karun Kaushik and Selin Kocalar, the company graduated from Y Combinator, grew to 500+ enterprise customers, and raised a $32M Series A at a $300M valuation led by Insight Partners. Then, in March 2026, an anonymous Substack account called DeepDelver started publishing what it claimed were receipts: Delve was allegedly generating fake compliance evidence, templating identical auditor conclusions across hundreds of reports, and passing off an open-source agent workflow tool (Sim.ai's SimStudio) as its own product under the name "Pathways", with no license agreement. Y Combinator removed Delve from its directory on April 4, 2026. The underlying product concept, however, is real and worth understanding. The compliance automation space is genuinely painful and underserved. Let's break down what Delve was supposed to do and how you would build it correctly. ## How It Actually Works At its core, Delve is a three-layer system: **integrations** (connect to your tools), **agents** (collect evidence and monitor controls), and **a compliance portal** (track status, generate reports, talk to auditors). **Layer 1: Integrations.** Delve connects to your infrastructure via OAuth and API tokens, AWS, GitHub, GCP, Okta, Slack, Jira, Google Workspace, etc. This is the standard connector model that Vanta and Drata also use. For systems without APIs, Delve's agents use browser automation to take screenshots and collect evidence from web UIs directly. This is where it gets technically interesting: instead of waiting for every SaaS vendor to build a Vanta integration, you send a headless browser to the admin panel and scrape what you need. **Layer 2: Agents.** The agents have two jobs: *evidence collection* and *continuous monitoring*. For evidence collection, they take screenshots of infrastructure configs, verify access controls, check that MFA is enabled, confirm backup policies exist, and log all of this against specific compliance controls. For monitoring, they watch for configuration drift, if someone disables MFA in your AWS account, the agent flags it as a compliance gap in real time. Delve claimed their agents could remediate 90% of surfaced issues without human intervention: patching infra misconfigs, flagging security risks in pull requests, auto-completing vendor security questionnaires. **Layer 3: The compliance portal.** A dashboard showing your current compliance posture per framework, evidence uploaded per control, open gaps, and communication threads with your auditor. The auditor gets a read-only view of the evidence and uses it to issue their report. This is where the alleged fraud lived: DeepDelver showed that 493 out of 494 SOC 2 reports contained near-identical boilerplate, including the same grammatical errors, suggesting the "auditor conclusions" were machine-generated rather than independently written by licensed CPAs. **The Pathways/SimStudio situation** is a separate but illuminating story. Delve was demoing a no-code agent workflow builder called "Pathways" to enterprise prospects. A prospect recognized it as a near-identical fork of SimStudio, the open-source agent builder from Sim.ai, itself a YC company. Sim.ai confirmed they had a business relationship with Delve (as a customer) but no license agreement covering reuse of their codebase. Whether this was intentional IP theft or a rogue internal project, it's genuinely ironic that a compliance company allegedly violated an open-source license. ## The Tech Stack (My Best Guess) - **Frontend:** React or Next.js, the dashboard looks like a standard SaaS portal. Likely Tailwind CSS given the clean aesthetic and 2023 founding date. - **Backend:** Node.js or Python, the agent orchestration layer is likely Python given the ML-adjacent founders and the need to integrate with browser automation libraries. - **Agent runtime:** Playwright or Puppeteer for browser automation (screenshot collection from web UIs). Their "Pathways" tool was allegedly SimStudio under the hood, a React-based visual agent workflow builder backed by a Node execution engine. - **AI/ML:** Almost certainly OpenAI GPT-4o or Anthropic Claude for natural language reasoning over compliance controls, evidence validation, and questionnaire auto-fill. The evidence-matching logic (does this screenshot prove this control?) is a structured prompt engineering problem. - **Infrastructure:** AWS (likely given their customer base of AWS-heavy startups). PostgreSQL for the compliance data model. Redis for real-time monitoring event queues. - **Integrations:** OAuth 2.0 flows for each SaaS connector. Standard REST API polling with webhook fallbacks where available. ## Why This Is Interesting Compliance is a perfect AI agent target for a specific reason: it's *process-heavy but not judgment-heavy*. The SOC 2 framework has 64 common criteria. Each one requires specific evidence, a screenshot of your MFA settings, a log of access reviews, a copy of your incident response policy. A human spends 200+ hours per certification cycle collecting this evidence, formatting it, matching it to controls, and uploading it to a portal. An agent can do this in hours. The domain knowledge is fixed, the evidence formats are predictable, and the success criteria are explicit. The market timing was also right. In 2023-2025, every AI startup needed SOC 2 to sell to enterprises. The compliance market exploded. Vanta and Drata were the incumbents, but they were expensive ($15-30k/year) and still required significant manual work. A startup that could undercut on price and automate more of the busywork had a genuine wedge. Delve's 500 customers in under two years suggests the product worked well enough to sell, the question is whether it worked well enough to *actually make those customers compliant*. The browser automation angle is genuinely clever and underused. Most compliance platforms only work with tools that have their integration listed. Delve's claim, that agents could collect evidence from *any* web UI by just screenshotting it, is a real technical capability if you implement it well. It's also the exact capability that Anthropic's computer use and OpenAI's operator are racing toward. ## What I'd Build Differently The product concept is sound. The alleged execution problems, fake evidence, templated auditor conclusions, stem from one fatal design choice: **optimizing for speed over verifiability**. The entire value proposition was "get compliant in days not months." That pressure, combined with working with third-party audit mills rather than big-four CPA firms, created the conditions for exactly what DeepDelver described. If I were building this correctly, I'd architect around a principle I'd call **evidence provenance**: every piece of compliance evidence has a cryptographically signed audit trail showing exactly when it was collected, by what agent, from what system, with what raw data. The screenshot isn't just a PNG, it's a signed artifact with a timestamp, the source URL, the agent's execution log, and a hash of the page DOM. Auditors get a verification link, not a static file they have to trust. This is how you make AI-collected evidence actually trustworthy. I'd also separate the agent layer from the audit layer more aggressively. The agent collects and monitors. A separate, independent system validates and matches evidence to controls. The "auditor conclusions" would be generated by the licensed CPA, full stop, the AI provides a structured evidence package and a suggested conclusion, but the human signs off and the system enforces this with a cryptographic signature. No exception. On pricing: Delve was at $12-20k/year. The real opportunity might actually be lower, $3-5k/year for early-stage startups who just need SOC 2 Type I and can't afford Vanta. Commoditize the evidence collection, charge for the auditor relationship. ## How to Replicate This with Claude Code Below is a replication guide, a complete Claude Code prompt that walks you through building a working version of Delve's core compliance automation product. Copy it, install it, and start building. Do it with actual verifiable evidence this time. --- Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory.