Delve Customers

Exposing Fake Compliance: The Delve Trust Page Problem

This database catalogs 278 companies that appear on Delve's trust pages with SOC 2 compliance claims that raise serious questions. Many of these audits are stale, undated, or lack verifiable evidence — yet they're presented as proof of security compliance to potential customers and partners.

What We Found

Our analysis of Delve-hosted trust pages reveals a troubling pattern:

• Stale Audits: A significant portion of listed SOC 2 Type 2 audits are 6–12+ months old, well past the point where they provide meaningful assurance.
• Unverifiable Claims: Many trust pages link to audit reports that cannot be independently verified or lack critical details like audit firm, scope, and period.
• Infrastructure Gaps: The data cross-references cloud infrastructure providers (AWS, GCP, Azure) against claimed compliance postures.

Why This Matters

Compliance theater — displaying trust badges and audit reports that don't reflect actual security posture — puts customers at risk. Buyers relying on these trust pages to make vendor security decisions deserve accurate, current information.

Methodology

We systematically crawled Delve's public trust pages, extracted audit metadata (type, date, staleness), and enriched each company with funding status and infrastructure data using the Extruct platform. Every entry includes the original trust page URL for independent verification.