Complacency startup Delve has been accused of misleading customers of convincing them they are compliant with privacy and security regulations, potentially exposing them to criminal liability under HIPAA and hefty fines under GDPR. An anonymous Substack post accused Delve of producing fake evidence and generating auditor conclusions on behalf of certification mills that rubber stamp reports, skipping major framework requirements while telling clients they have achieved 100% compliance. The post, credited to "DeepDelver," claimed that Delve provided customers with “fabricated evidence of board meetings, tests, and processes that never happened” and forced customers to adopt fake evidence. The startup attempted to refute the accusations on its blog, calling the Substack accusations "misleading" and stating that it does not issue compliance reports at all.