The Compliance Startup That Broke Compliance

Opening

Dear reader, let me start with an ironic story. There was a startup that promised to complete security certifications like SOC 2¹​, HIPAA²​, and GDPR³​ “in days, with AI.” A company valued at $300 million, with a $32 million Series A, a Forbes 30 Under 30 nod, and a “top startup” label from YC’s own president. Yet allegations have surfaced that this very company failed to comply with the most basic form of compliance of all: open-source licensing.

On April 4, 2026, YC asked Delve to leave its community. Expulsions of portfolio companies are extremely rare in YC’s history. This incident is more than a startup scandal — it simultaneously reveals the ethical boundaries of open-source forking⁴​, the trust architecture of accelerator networks, and the structural trap facing AI startups that sell “speed” as their core value.

A 17-Month Timeline: From Rocket Ship to Crash

Laying out Delve’s trajectory chronologically makes vividly clear how a “growth narrative” gets built in Silicon Valley — and how it can collapse.

2023: While still students at MIT, Karun Kaushik and Selin Kocalar started with a medical AI scribe. After personally suffering through the pain of HIPAA certification, they pivoted⁵​ to compliance automation.

Early 2024: They’re accepted into the YC Winter 2024 batch. Their pitch: AI agents that automatically handle evidence collection, report drafting, and gap monitoring.

January 2025: They raise a $3.3 million seed round from General Catalyst and others.

April–May 2025: This is where the pivotal event occurs. Delve becomes a customer of fellow YC alum Sim.ai, paying $15,000 for SOC 2 and HIPAA certification. At the same time, internally, work was reportedly underway to port Sim.ai’s open-source product, SimStudio, into Delve’s own product, “Pathways.” According to an internal whistleblower, an internal Notion document titled “Sim Studio Port Plan” specifically listed the folders to be copied — Blocks, Components, Executor, Tools, and the database schema.

July 2025: They raise a $32 million Series A led by Insight Partners, at a $300 million valuation.

September 2025: YC CEO Garry Tan retweets a post about Kaushik’s MIT talk, calling Delve a “top YC startup.” The post racks up 175,000 views.

December 2025: A Google spreadsheet containing draft SOC 2 audit reports for hundreds of client companies leaks, left publicly accessible. Kaushik emails customers stating “no external party accessed the database.” That same month, both co-founders are named to the Forbes 30 Under 30 list in the AI category.

March 18, 2026: An anonymous Substack account, ‘DeepDelver,’ publishes Part I. The core claim: of 494 SOC 2 reports, 493 are 99.8% identical — a bombshell article. It alleges rubber-stamp audits conducted through an India-based certification body, and a process built not on AI but on pre-written templates and manual labor.

March 20, 2026: Delve pushes back in a blog post: “Delve does not issue compliance reports. Final reports are issued by independent auditors.” Patio11, a well-known Hacker News commentator, calls the statement “a textbook non-denial denial⁶​ — one that concedes the core allegation while denying all responsibility.”

March 23, 2026: Insight Partners removes its blog post about the Delve investment from its website.

March 30, 2026: DeepDelver publishes Part II. A new allegation: Delve forked Sim.ai’s Apache 2.0-licensed⁷​ open-source product, SimStudio, and sold it to enterprise customers under the name “Pathways” for $50,000 to over $200,000. Sim.ai CEO Emir Karabeg confirms to TechCrunch that no licensing agreement ever existed.

April 1, 2026: TechCrunch reports on the open-source license violation allegations. The story trends on X (formerly Twitter).

April 4, 2026: YC asks Delve to leave its community. An internal Bookface⁸​ message from Garry Tan leaks: “YC is a community, not just an accelerator. Founders in our community must trust each other, and we must trust them. When that trust breaks, there is only one thing we can do.”