False Compliance Claims: How to Vet a Compliance Vendor

Clinics, telehealth startups and online brands are under pressure to show they take privacy and security seriously. Enterprise customers ask for a SOC 2 report. Partners ask whether you are HIPAA compliant. A growing set of software vendors promise to get you there in days.

Some of those tools are genuinely useful. But a dashboard that says "100% compliant" is a vendor's claim, not a legal finding. If the claim turns out to be wrong, the business that relied on it still owns the problem. This guide looks at the allegations against compliance startup Delve, what certifications actually mean, and how to vet a vendor before you put your name on its output.

What Delve has been accused of

Delve is a Y Combinator-backed compliance automation startup. TechCrunch reported that it announced a $32 million Series A at a $300 million valuation in July 2025.

In March 2026, an anonymous Substack author using the name "DeepDelver," who said they worked at a former Delve client, published a long post accusing the company of misleading customers. As TechCrunch reported on March 22, 2026, the post alleged that Delve:

Produced fabricated evidence, such as records of board meetings and tests that never happened
Generated auditor conclusions and final reports before any independent review
Routed most clients to two audit firms the author described as rubber stamps
Told clients they had reached 100% compliance while skipping major framework requirements
Published public trust pages listing security measures that were not in place

These are allegations from an anonymous source. Delve called the post misleading and inaccurate. It said it does not issue compliance reports, that final reports and opinions come only from independent licensed auditors, that customers can choose their own auditor, and that its documents are templates rather than pre-filled evidence.

On April 4, 2026, TechCrunch reported that Delve had "parted ways" with Y Combinator, citing a post from Delve's COO. Delve's founders said an attacker had become a customer under false pretenses, stolen internal data and run a smear campaign. The company also said it was removing audit firms that did not meet its standards and offering free re-audits to active customers. As of late October 2026, we found no public court ruling or regulatory finding on the allegations.

Whatever the outcome, the episode is a useful prompt to ask how much of your own compliance story rests on a vendor's word.

What a certification or report actually tells you

HIPAA has no official certification

HHS does not run or recognize a HIPAA certification program. HIPAA Journal quotes HHS directly: "There is no HIPAA Certification process." A training certificate or a "HIPAA compliant" seal from a vendor may show that someone completed a course or a review. It does not stop HHS from finding a violation later, and it does not move responsibility off the covered entity or business associate.

What HIPAA does require of a vendor that handles protected health information on your behalf is a business associate agreement (BAA). A vendor that describes itself as "HIPAA compliant" but will not sign a BAA is a red flag.

SOC 2 is an attestation by a CPA, at a point in time or over a period

SOC 2 is an examination framework from the AICPA. A CPA firm examines a service organization's controls against the trust services criteria for security, availability, processing integrity, confidentiality and privacy. Two types matter:

Type 1 looks at whether controls are designed properly as of a specific date.
Type 2 also tests whether the controls actually operated effectively over a period of time.

The value of a SOC 2 report depends on the independence and rigor of the auditor. Reports produced quickly from templates, with little real testing, are exactly what the Delve allegations describe. A Type 1 report from a firm you have never heard of tells a buyer much less than a Type 2 report covering a meaningful period.

Vendors' compliance claims are advertising

The FTC treats compliance and security claims like any other marketing claim: they have to be true and backed by evidence. Two cases show how this plays out.

accessiBe (final order April 2025). The FTC alleged that accessiBe claimed its AI widget could make any website compliant with the Web Content Accessibility Guidelines (WCAG) when it could not, and that it formatted articles and reviews to look independent without disclosing its ties to the reviewers. The final order requires a $1 million payment and bars unsupported claims that its automated products can make sites WCAG compliant.
GoodRx (February 1, 2023). Among other charges, the FTC alleged that GoodRx displayed a seal on its telehealth homepage that falsely suggested it complied with HIPAA. GoodRx agreed to a $1.5 million civil penalty, mainly for violating the Health Breach Notification Rule by sharing health data with advertising platforms.

The lesson cuts both ways. Vendors that oversell compliance can face FTC action, and so can a business that puts a "HIPAA compliant" badge on its own website without the substance behind it.

Warning signs when evaluating a vendor

Promises of a SOC 2 report or "full compliance" in days, with little work on your side
"HIPAA certified" language, or reluctance to sign a BAA
An auditor chosen and paid through the vendor, with no option to bring your own
Policies and evidence that arrive pre-written and describe practices you do not actually follow
A trust page listing controls nobody at your company can point to
Contract terms that disclaim all responsibility for the accuracy of compliance outputs

A vendor vetting checklist

Businesses often work through these questions before signing:

Ask what the product actually does. Is it a tool for collecting evidence and tracking tasks, or does it claim to make you compliant? Get the answer in writing.
Separate the tool from the auditor. Who performs the audit? Can you choose an independent firm? Check that the firm is a licensed CPA firm through your state board of accountancy.
Read the auditor's report, not the summary. For SOC 2, note whether it is Type 1 or Type 2, the period covered, the scope, and any exceptions.
Review the vendor's own security. Ask for the vendor's SOC 2 Type 2 report and bridge letter, and read it the same way.
Get a BAA where PHI is involved. If the vendor will store, process or transmit protected health information, a BAA should be in place before any data goes in.
Check that templates match reality. Every policy the platform generates should describe what your team really does. Edit or delete anything that does not.
Keep your own evidence. Screenshots, logs and records should live in systems you control, not only inside the vendor's platform.
Read the contract. Look at warranties, limitation of liability and what happens to your data if you leave.
Watch your own claims. Before you add a badge or "HIPAA compliant" wording to your website or sales deck, confirm you can support it.
Recheck after news. If a vendor or its audit firm comes under scrutiny, ask counsel and your customers' security teams whether a fresh, independent review is warranted.

Compliance automation can save real time on evidence collection and reminders. The risk is treating the software's output as the finish line. Counsel and an independent auditor are still the people who can tell you where you stand.

Where NutriCove fits

NutriCove builds AI automation, websites, ad creative and outreach systems for practices and brands. We do not audit compliance, issue certifications or provide legal advice. If you are mapping out which tools your business runs on and want to understand what the automation and website side involves, see an overview of our services.

Sources

This article is general information, not legal or medical advice. Talk to a qualified attorney or licensed professional about your situation.