Is Your SOC 2 Real? What Buyers Will Check Now

David Rago has spent decades looking at American pottery, and in a short clip from Antiques Roadshow he takes about a minute to explain why a vase someone bought at auction for $350 isn’t the Tiffany piece it claims to be. The shape is close. The glaze is right. The mark on the bottom has everything you’d want to see, the LCT for Louis Comfort Tiffany and the Favrile name for handmade work.

“While it has all the bells and whistles of Louis Comfort Tiffany’s mark, it’s not the mark we normally see.”

David Rago, appraising a fake Tiffany vase on Antiques Roadshow

The mark gave it away, but what settled it was the material. Tiffany cut its mark into the wet clay with a sharp tool, and this one was painted on. And, as Rago says, “the clay is brown and Tiffany clay was white.”

That’s the whole lesson of this post, and the compliance industry spent the spring learning it the hard way. A SOC 2 report has a mark too: a logo on a trust page, a PDF with an auditor’s name on the opinion, a line in your security questionnaire that says “SOC 2 Type II, current.” For years, most buyers checked the mark. After March, the careful ones started checking the clay.

This post covers what happened, what the accountants have said about it since, what a real SOC 2 actually is, and the checks your customers’ security teams are starting to run. It ends with what to do if you’re the one who has to prove your report holds up. Each section stands on its own if you want to skip ahead.

494 reports, one template

On March 19, 2026, an anonymous author writing as DeepDelver published a Substack post titled “Delve - Fake Compliance as a Service - Part I.” Delve is a compliance automation startup backed by Y Combinator, and the previous summer it had raised a $32 million Series A led by Insight Partners at a $300 million valuation (Insight Partners, July 2025; TechCrunch, March 2026). Its SOC 2 page promises customers they can “get SOC 2 compliant in days, not months,” with an audit stage of “1-3 weeks” (Delve).

The post’s evidence came from what it described as “a Google spreadsheet that was publicly accessible,” which, the author said, held links to draft reports Delve had produced for its customers. By the author’s count there were 575 files: 81 were ISO 27001 documents, which left 494 SOC 2 reports, 259 of them Type II (DeepDelver, March 2026). Security research firm IANS summarized the core finding as “nearly identical boilerplate language” in 493 of the 494 SOC 2 reports (IANS, March 2026).

The details were what made it land. “When Delve delivers a ‘draft’ SOC 2 report, the auditor’s conclusion is already written,” the author wrote. Every draft allegedly arrived with the license ID of Delve’s preferred audit partner “pre-embedded so it can be signed without modification.” And according to the post, the Type II reports didn’t just share language, they shared an outcome: “259 out of 259 Type II reports had this conclusion, including the missing word (‘because there no security incidents’).” The post also alleged that Delve’s “‘US-based’ auditors are actually cheap Indian certification mills” operating through U.S. entities, and according to TechCrunch, the author claimed that virtually all of Delve’s clients went through two audit firms, Accorp and Gradient, which it described as “part of the same operation.”

The summary that spread fastest came from an account called Ryan, the same day the Substack went up.

Delve, a YC-backed compliance startup that raised $32 million, has been accused of systematically faking SOC 2, ISO 27001, HIPAA, and GDPR compliance reports for hundreds of clients.

Ryan (@ohryansbelt) · March 19, 2026

It’s important to be precise about what is and isn’t established. The allegations above come from an anonymous author working from leaked material. Delve’s response was immediate and categorical: “Final reports and opinions are issued solely by independent, licensed auditors, not Delve” (Delve, March 20, 2026). Four days later it wrote, “Delve does not fake evidence nor do we sign audit reports or certifications,” and offered every customer a free re-audit with an independent, peer-reviewed auditor, a free penetration test, and engagement letters from its auditors on request (Delve, March 24, 2026). As of this writing I haven’t found a public finding by a regulator, a state board of accountancy or the AICPA that resolves the allegations either way.

What happened next was a market verdict, not a legal one. Customers began announcing new audits. Scape posted that its auditor had been Accorp and that it was commissioning “a fresh, independent review” with an additional firm (Scape, March 2026). LiteLLM, which TechCrunch reported had used Delve, wrote that it was “partnering with Vanta to recertify LiteLLM’s compliance for SOC 2 Type 2 and ISO 27001” and “identifying independent auditors to validate and verify our compliance posture” (LiteLLM, March 30, 2026; TechCrunch, March 30, 2026). Its own post didn’t name Delve, and it came days after a malware incident affected LiteLLM’s open-source package. On April 3, Delve’s CEO posted his side.

That said, we grew too fast and fell short of our own standard. To our customers, we deeply apologize for the inconveniences caused.

We take these allegations seriously and have made changes: a new auditor network, free re-audits and pentests for all customers, enhanced transparency in audit communications, and more.

Karun Kaushik (@karunkaushik_) · April 3, 2026

The next day, TechCrunch reported that Delve was no longer listed in Y Combinator’s directory and quoted its COO, Selin Kocalar: “YC and Delve have parted ways” (TechCrunch, April 4, 2026).

The best one-line reaction I’ve seen came from Zack Korman, in a video that argues against the people who used the scandal to dunk on SOC 2 itself. His point is about the tables at the back of the report.

He’s right, and it matters for everyone who didn’t buy from Delve. The reason this story is useful is that it showed buyers exactly where to look. A fake SOC 2 doesn’t fail on the cover page. It fails in the parts nobody reads.

The accountants saw it coming

The most interesting part of the record is that the profession was worried before the leak.

On February 1, six weeks before DeepDelver, the AICPA’s Journal of Accountancy ran a piece called “Promises of ‘fast and easy’ threaten SOC credibility.” It quoted Sean Linton, an audit partner at EisnerAmper who chairs the AICPA’s SOC 2 Working Group: “[SOC] professionals are seeing indications that ‘fast and easy’ may come at the expense of quality and objectivity.” On the tool vendors, he was blunter: “These companies are trying to dictate the way [a SOC examination] is performed without an understanding of the professional standards that [SOC examiners] must adhere to.” The red flags the article listed read like a summary of the leak that followed: completion timelines measured in weeks or hours, boilerplate templates, testing that leans on asking the client instead of examining evidence, marketing built on speed and price, and small firms producing a high volume of reports with few examiners (Journal of Accountancy, February 2026).

After the leak, the AICPA posted a notice on its SOC landing page that is worth quoting in full, because it’s the closest thing to an official position:

“The AICPA is looking into allegations published anonymously about the business practices of a compliance vendor that offers Systems and Organization Control (SOC) services. If auditors involved in these matters are found to have not performed audits in accordance with professional standards, not been enrolled in peer review, and/or are unlicensed, the AICPA will take action with respect to its members.”

The AICPA’s SOC landing page, which adds that it assists regulators, “including referrals to state boards of accountancy”

Then came the guidance. On April 6, the AICPA’s Professional Ethics Division staff published “SOC engagements: Ethics risks with tool providers.” It says auditors “should consider whether any payments to or from the tool provider are, in substance, referral fees that require written disclosure to the attest client.” It lists advertising that guarantees outcomes, naming “‘clean audit,’ ‘100% pass rate’” as examples, among practices that may be prohibited by the AICPA’s code. And it flags contract terms that should make any founder look twice: non-disparagement clauses, provisions that make you pay to access your own evidence, and language that lets the tool provider participate in audit procedures (Journal of Accountancy, April 2026).

On April 30, Amy Pawlicki, the AICPA’s vice president for assurance and advisory innovation, put the problem in one sentence on the Journal of Accountancy podcast: “The biggest problem we’ve seen in the marketplace is technology vendors allegedly promising clean opinions and drafting boilerplate reports that are signed off on by a CPA who did not have any involvement and did not actually perform a SOC engagement.” She was just as clear about the stakes: “Licensed CPAs who are not enrolled in peer review or unlicensed signatories representing themselves as CPAs signing off on fraudulent reports are actually violating state law” (Journal of Accountancy podcast, April 2026).

And in May, the AICPA turned the lesson into enforcement machinery. Its Peer Review Board warned the reviewers who inspect audit firms about SOC 2 work that isn’t designed for each client’s risks, “resulting in engagements that have identical reports, risk assessments, sample sizes, and testing procedures,” which reviewers will likely conclude are “nonconforming.” The AICPA said that starting June 1, its staff would identify scheduled peer reviews of firms doing SOC 2 work and reach out to the review teams directly. Carl Mayes of the AICPA explained why: “Some firms are leaning too heavily on third-party SOC platforms without applying the professional judgment required by our standards” (Journal of Accountancy, May 2026).

If you only remember one thing from this section, remember the peer reviewers’ test, because it’s the same test your buyers are about to run. Identical reports across different companies is the tell.

This isn’t the first time auditors have been caught signing paper. In 2024 the SEC charged the audit firm BF Borgers and its owner with fraud affecting more than 1,500 SEC filings, fined them $12 million and $2 million, and permanently suspended both from appearing and practicing before the Commission as accountants. The SEC’s enforcement director called it “one of the largest wholesale failures by gatekeepers” (SEC, May 2024). That was public-company auditing, not SOC 2, but the shape is the same: a signature that looks like assurance, with nothing behind it.

What a real SOC 2 is

Most founders meet SOC 2 as a line item in a procurement checklist, so it helps to restate what it is. (If you want the long version, start with What Even Is a SOC 2?.)

A SOC 2 is an examination performed by a licensed CPA firm under the AICPA’s attestation standards. The AICPA’s own definition is that SOC is “a suite of service offerings CPAs may provide.” Pawlicki put it more sharply: “SOC 2 is not a certification. It’s actually an examination-level attestation engagement signed off on by a licensed CPA,” and “these engagements are required under state law to be performed by licensed CPAs in accordance with what’s called the UAA, or Uniform Accountancy Act, definition of attest.”

Three requirements follow from that, and each one gives a buyer something to check.

A licensed firm. The opinion has to come from a CPA firm licensed by a state board of accountancy. Readiness consultants, compliance platforms and firms like mine can help you get ready. None of us can issue the report.

Peer review. Firms that perform attestation work must enroll in the AICPA’s peer review program and be reviewed “once every three years,” and SOC 1 and SOC 2 examinations are named “must select engagements,” meaning reviewers are required to look at them (AICPA). A firm doing SOC 2 work without peer review is the situation the AICPA’s notice describes.

Independence. The auditor has to design its own tests and reach its own conclusions. DeepDelver’s post leaned on AT-C Section 205, which “requires practitioners to maintain independence in both fact and appearance throughout the engagement.” That is the specific thing a pre-written conclusion violates.

Then there’s the report itself, which has four parts. The richest information sits at the back, and that’s where most readers stop.

Richey May, a CPA firm, has a short explainer that makes the same point from the auditor’s side of the table. Their IT audit director starts by calling out the most common misconception.

Check the signature first

Clarence Chio, the CEO of Coverbase, wrote the best reframe of the whole episode in May: “The question ‘Does this vendor have a SOC 2?’ was always the wrong question. The right question is ‘Does this vendor actually do what their SOC 2 claims?’” (Corporate Compliance Insights, May 2026). Getting from the first question to the second takes about twenty minutes per vendor, and the first five are spent on the signature.

Find the firm. Open section 1, the independent service auditor’s report, and write down the name of the CPA firm that signed the opinion, the city it’s signed from, and the date. If the report doesn’t clearly name a firm, stop there.

Look up the license. CPAverify.org is “a CPA lookup tool populated by official state regulatory data,” covering CPAs and CPA firms from 55 boards of accountancy, and it shows “markers of enforcement, non-compliance or disciplinary action” (CPAverify). If the firm isn’t there, check the board of the state it claims to be licensed in directly. Some states also require out-of-state firms to register before doing attest work for clients there; California is one (California Board of Accountancy).

Look up the peer review. The AICPA Peer Review Public File shows whether a firm is enrolled, “the date of acceptance and the period covered by the firm’s most recently accepted peer review,” and “whether the firm’s enrollment in the program was terminated or dropped” (FICPA). Detailed results are public only for some firms, so treat it as proof of enrollment rather than a grade. When a vendor’s trust page says its auditor is peer reviewed, this is where you confirm it, and it takes about two minutes.

Ask about the relationship. This is the one most buyers skip. IANS faculty told Delve customers to get written confirmation that auditors “designed and executed their own tests,” to ask their platform “What does your auditor access, and at what stage?”, and to vet the audit firm’s standing, its physical U.S. presence, its business relationships with the platform and its annual audit volume (IANS, March 2026). As IANS faculty member Jeff Brown put it, “Pre-generated conclusions undermine the credibility of the entire report.” For a vendor you’re about to trust with production data, it’s fair to ask whether the audit firm was chosen through their compliance platform and whether any money moves between the two. Since April, AICPA ethics staff have told auditors to consider whether that money is a referral fee that has to be disclosed.

None of this tells you a report is good. It tells you whether the report could be real, which is the question the Delve customers’ buyers were suddenly asking.

Then read the clay

The signature checks take five minutes. The rest of the twenty goes to the parts of the report that are hard to fake at scale, because faking them means doing the work.

The system description should be specific. Section 3 is the vendor’s description of its own system, and it’s required to describe this company: its infrastructure, its software, its people, its data and the vendors it relies on. When you read it, you should learn something about how the company actually works. If you could swap the company name for a competitor’s and nothing else would need to change, you’ve found boilerplate.

Subservice organizations should be named. Almost every startup runs on someone else’s cloud. Schellman’s guidance is plain: “regardless of whether you choose the carve-out or inclusive method, you must disclose the existence of any services provided by any subservice organizations in your report.” Under the carve-out method, the cloud provider’s controls are excluded and you’re expected to read that provider’s own report (Schellman). The vendor’s report should also list the complementary subservice organization controls it relies on that provider for, and the complementary user entity controls, the CUECs, it assumes you’re running. A report with no subservice organizations and no CUECs describes a company that doesn’t exist.

The tests in section 4 should vary. Each control should have its own test procedure, written for what that control does: inspecting a sample of access reviews is a different procedure from observing a backup restore. Sample sizes should fit how often the control runs, larger for something that happens every day and smaller for something that happens once a quarter. There’s no single mandated number, which is exactly why the AICPA’s peer reviewers flag identical sample sizes and procedures across different clients. Uniformity is the signal.

The dates should make sense. For a Type 2, check the observation period and the report date. If the period ended more than a few months ago, ask for the bridge letter, and remember who wrote it. A bridge letter “is on the service organization’s letterhead and signed by the service organization, not the service auditor,” and “most bridge letters typically cover a period of no more than three months” (Linford & Co). It’s the vendor’s word, not the auditor’s.

Spot-check a few controls. IANS recommended that Delve customers randomly verify five to ten controls to confirm the evidence behind them exists and is current. As a buyer you can do a lighter version for any critical vendor: pick three controls from section 4 that matter to you, such as access reviews, offboarding and vulnerability remediation, and ask the vendor to walk you through the most recent instance of each. A vendor with a real program will find this boring. A vendor with a template will find it hard.

Yash Kosaraju, the CISO of a16z, made a related point when he was on the show in September, talking about AI tools: the questionnaire and the report are the starting line, not the review. He runs the vendor due diligence everybody runs, he said, and “the bigger challenge with AI tools is not your vendor due diligence of, like, do you have a pentest or do you have a SOC 2.” The bigger questions are what data the tool can reach, how, and whether it can write.

Exceptions are a good sign

This is the part founders find counterintuitive, so it’s worth its own section. A report with findings in it is usually more believable than a report without them.

Auditors are paid to find things. When testing turns up an exception, the auditor typically pulls more samples to see whether the control is really operating, and “if it is determined that a key control needed to support a control objective is not operating effectively, the opinion within the auditor’s report must be modified” (A-LIGN). Richey May’s explainer above makes the companion point that an unmodified opinion, the “passing grade,” can still include minor exceptions and deviations. The opinion types run from unmodified, to qualified, an except-for opinion on specific areas, to adverse, when problems are material and pervasive, to a disclaimer, when the auditor couldn’t get enough evidence to give an opinion at all (Keiter).

A clean report from a well-run company isn’t suspicious. What’s suspicious is a report that is clean in exactly the same way as hundreds of others. The leaked Type II reports didn’t just lack exceptions. According to the investigation, every one of them reached the same conclusion that nothing happened during the period that the auditor could test, because there were no security incidents, no personnel changes and no customer terminations. Across 259 different startups, each over its own observation window, that doesn’t look like a clean record. It looks like a pasted paragraph.

So when you read a vendor’s section 4, look for the exceptions and read the management responses next to them. A vendor that missed two quarterly access reviews, explains why, and shows what changed is telling you something true about how it runs. That’s worth more than a page of “no exceptions noted.”

How to pick an auditor who will hold up

If you’re the founder buying the audit rather than the buyer reading one, the lesson runs the other way. Your report is only as credible as the firm that signed it, and after this year your customers will look the firm up.

Drata, a compliance platform with every reason to defend platforms, published a useful test in January, before the leak: if your SOC 2 process “feels too easy,” with minimal evidence review or auditor interaction, look harder, because “the moment a platform influences audit outcomes, trust is compromised” (Drata, January 2026). A compliance platform is a good way to collect evidence. It shouldn’t be the reason you ended up with a particular auditor, and it should never be the author of the auditor’s conclusions.

Before you sign an engagement letter, ask the firm these questions, and get the answers in writing.

• Where are you licensed, and who signs? Get the firm’s state of licensure and the name of the partner who will sign, then check both on CPAverify.org yourself.
• When was your last peer review? Then check the Public File. A firm doing SOC 2 work should be enrolled, with a recent accepted review.
• Who designs the tests and writes the opinion? The answer should be “we do,” with your platform’s role limited to collecting and organizing evidence.
• How did we find each other, and does money move between you and our platform? Referral arrangements aren’t automatically disqualifying, but the AICPA’s ethics staff say they require written disclosure, and you want to know about them before your buyer does.
• What does fieldwork look like? You should expect walkthroughs with your people, requests for evidence across the period, and follow-up questions. If nobody is going to ask your engineers anything, ask why.
• What happens if you find exceptions? A good firm will tell you plainly that it reports them. A firm that promises you won’t have any is promising something the AICPA says it can’t.

Be wary of anything that promises a certification, a guaranteed clean opinion or a fixed timeline that ignores your scope. A Type 2 requires an observation window, commonly three to twelve months, that nobody can compress. The readiness work before it can move fast, and that’s where good help earns its keep. The audit itself should take the time the evidence takes.

How to prove your report holds up

If your enterprise deals depend on a SOC 2, assume the buyer’s security team will run the checks above, and make them easy. Most of this costs nothing.

Put the auditor’s name where buyers can see it. On your trust page, name the CPA firm that issued your report, the type and period, and link to the firm’s public listing. Buyers will look it up anyway, and showing you expect them to says a lot.

Have the engagement letter ready. Delve’s own fix list included making auditors’ engagement letters available to customers. That’s a good idea for everyone. When a buyer asks who did your audit and under what terms, send it under NDA without a fight.

Stop saying “certified.” Say you have a SOC 2 Type 2 report from a named firm covering a named period. The AICPA’s language is “examination” and “opinion,” and the vendors whose language now reads as a red flag are the ones that promised certificates and pass rates.

Show your exceptions with your responses. If section 4 lists exceptions, don’t hide them. Walk the buyer through what happened and what changed. Buyers’ security teams are people, and they trust a team that tells them about the two missed access reviews.

Offer the walkthrough before you’re asked. For your largest prospects, offer to walk their reviewer through three controls of their choosing, live. If your program is real, it’s the cheapest trust you’ll ever buy, and it’s the same spot-check IANS told Delve customers to run on themselves.

Back the report with evidence it can’t give. A SOC 2 says your controls were designed and operated over a period. It doesn’t say your application can’t be broken into. A recent penetration test from a reputable firm answers the question the report can’t, which is why so many buyers ask for both. What they’ll expect from that test in 2027 is its own story, and I wrote it up in Pentest Once a Year? Another is a secrets program a buyer’s engineer can check, and The .env File Is Your First Security Program builds one in an hour, down to the questionnaire answer.

If you have doubts about your own report, act first. If your report came from a firm you can’t verify, ask it for its engagement letter and for written confirmation that it designed and performed its own tests, spot-check your own controls, and if the answers aren’t solid, commission a new examination with a licensed, peer-reviewed firm you choose yourself. Then tell your largest customers what you’re doing and when the new report will land. A customer who hears about a problem from you is in a very different mood from one who reads about it first.

The rule worth stealing: check the signature, not the badge

The vase was a beautiful object with everything on the bottom you’d hope to see. It was worth about what someone believed it was worth, right up until a person who knew what Tiffany clay looks like turned it over.

A SOC 2 is the same kind of object. Its value comes entirely from the independent person who examined the work and signed their name to it. When that person is real, licensed, peer reviewed and independent, the report is one of the most useful documents in enterprise sales. When they aren’t, it’s a painted mark.

The rule worth stealing: check the signature, not the badge. As a buyer, spend the five minutes it takes to verify the firm and the twenty minutes it takes to read the clay. As a founder, choose an auditor your buyer’s security team will recognize, and make the checking easy.

If you’re getting ready for your first SOC 2, or your next one with a different auditor, our SOC 2 Type 2 team runs the program end to end and helps you choose an independent, peer-reviewed audit firm your buyers can look up. Our penetration testing answers the question a SOC 2 can’t, and when a customer’s security team starts asking hard questions, our sales support team helps you answer them with evidence. Book your free 15-minute security strategy call, and if you’re a startup, your first 8 hours are free.

When it’s time to show your board where you stand, the audit firm, the window dates and the report go in the last row of the security slide your board deck is missing.

Once your own report holds up, the next test is the week after it lands. The Week After Your SOC 2 Report Lands walks through the six questions buyers ask next, with a seven-day plan and free templates.

For the longer conversation about what a security review should actually ask, listen to Yash Kosaraju on episode 104.