Delve's security certifications failed to prevent breaches at multiple customers

TechCrunch has confirmed through direct reporting that Delve, a compliance startup under investigation for allegedly faking audits, performed security certifications for Context AI. That confirmation matters because Context AI was subsequently identified as the vector in a Vercel breach: an employee downloaded a Context AI app, granted it access to a corporate Google account, and attackers exploited that access to reach Vercel's internal systems.

The pattern is not isolated. LiteLLM, another Delve customer, suffered a malware injection into its open-source code following a hacker attack. Lovable, which held a Delve certification but left the vendor in late 2025, later admitted to inadvertently exposing customer chat data due to misconfiguration. Neither company's Delve certification prevented or detected these incidents.

In March 2026, an anonymous whistleblower known as DeepDelver alleged that Delve was fabricating customer data and relying on inadequate auditors to rubber-stamp compliance claims. Delve denied the allegations, but the resulting reputational damage prompted multiple customers to exit and seek alternative certifiers. Context AI confirmed it had switched to Vanta and hired Insight Assurance for re-examination. LiteLLM and Lovable similarly announced they were transitioning away from Delve.

Y Combinator, which had backed Delve, terminated its association with the startup. Separately, the whistleblower published allegations that Delve was denying customer refunds while funding an offsite trip to Hawaii, claims TechCrunch said it could partially verify through receipts but could not fully corroborate.

Security certifications are not guarantees against breach; they verify that a company has documented policies and controls in place. However, the concurrent failures at multiple certified customers raise questions about whether Delve's audits were substantive or whether the startup's own reported shortcomings in audit methodology left customers exposed.