We indexed the Delve audit leak: 533 reports, 455 companies, 99.8% identical
trustcompliance.xyz
We indexed the Delve audit leak: 533 reports, 455 companies, 99.8% identical
1–10 of 83 posts
Re: We indexed the Delve audit leak: 533 reports, 455 companies, 99.8% identical
#2We analyzed the leaked Delve audit reports and found some wild patterns:
- The same auditor license number (PAC-FIRM-LIC-47383) appears in 487 out of 494 reports
- Every Type II report has identical page numbers: Section 4 at page 30, tests at page 59, Section 5 at page 82
- 220+ "No exceptions noted" per report, across every single client
- The system descriptions were copy-pasted from each company's marketing website
We built tools to check this data:
- Search by company name to see if they're in the leaked database
- Paste any SOC 2 report text to scan for 10 template fingerprints
- A swipe game where you try to tell real audit excerpts from the fakes (harder than you'd think)
455 companies indexed, all free, no signup needed.
I'm also curious what the HN community thinks about the fingerprint detection approach, are there patterns we're missing?
Re: We indexed the Delve audit leak: 533 reports, 455 companies, 99.8% identical
#3We analyzed the leaked Delve audit reports and found some wild patterns: - The same auditor license number (PAC-FIRM-LIC-47383) appears in 487 out of 494 reports - Every Type II report has identical page numbers: Section 4 at page 30, tests at page 59, Section 5 at page 82 - 220+ "No exceptions noted" per report, across every single client - The system descriptions were copy-pasted from each company's marketing websi…
The swipe game idea is new to me - you have internal testers or some team use that to go through it?
Re: We indexed the Delve audit leak: 533 reports, 455 companies, 99.8% identical
#4We analyzed the leaked Delve audit reports and found some wild patterns: - The same auditor license number (PAC-FIRM-LIC-47383) appears in 487 out of 494 reports - Every Type II report has identical page numbers: Section 4 at page 30, tests at page 59, Section 5 at page 82 - 220+ "No exceptions noted" per report, across every single client - The system descriptions were copy-pasted from each company's marketing websi…
Genuinely curious: if you just need an independent audit report to check a box, do you really care how good a job the auditor did?
Re: We indexed the Delve audit leak: 533 reports, 455 companies, 99.8% identical
#5Just know that alot of startups with all star founders are closer to delve than not.
Its mostly marketing, "look at this MIT genius that noticed something about legacy xyz industry that no one else did"
Truth is venture funds are allocating a limited pie of what is really societies capital to people that dont deserve it
Re: We indexed the Delve audit leak: 533 reports, 455 companies, 99.8% identical
#6Thanks for compiling this. Will get used to every sufficiently-interesting data dump being beautifully analyzed shortly after release.
Re: We indexed the Delve audit leak: 533 reports, 455 companies, 99.8% identical
#7The damage this will do to the reputation of the SOC2 Security Attestation is incalculable.
Re: We indexed the Delve audit leak: 533 reports, 455 companies, 99.8% identical
#8This has to result in jail time for multiple people… right?
Re: We indexed the Delve audit leak: 533 reports, 455 companies, 99.8% identical
#9what do you expect? if you’re “automating” an audit, it already means you don’t care. the LLM is there to blur the calculus of responsibility, take the blame if someone cares enough to look. happy customers, until someone “delves” a little too deep (like you did) and ruins the slumber party.
Re: We indexed the Delve audit leak: 533 reports, 455 companies, 99.8% identical
#10Is SOC 2 legit? I have this on my roadmap but now I’m wondering if it’s just security theatre?