There is an old Dutch saying which goes: "Trust comes afoot and leaves on horseback". When you're in the compliance business you cannot fumble this ball, but you have.
> we built on an Apache 2.0 open-source repository, which explicitly permits commercial use, and significantly rebuilt it for compliance use cases
This framing is misleading. Apache 2.0 permits commercial use, but it also requires you to retain copyright/attribution notices, include the license, and add prominent notices to modified files.
Also hard to square “the allegations are fabricated” with simultaneously offering free re-audits, halting audit automation, and rebuilding the entire auditor network.
The problem with Apache 2 is it might not be completely clear how this works with a Saas product. Of course if you are distributing binaries or source to customers then you are going to run into issues with Apache Licensing. But if you are just running code on your servers then its not so straight forward. However, I guess its likely they were distributing javascript code so that could be a problem for them. Also, I guess regardless of the licensing issues not being honest with your customers when you are a compliance company is not going to be great for business.
I don’t understand the screenshot, the “attacker” sent that to customers? Or Delve created this screenshot as a dramatic reenactment? The post is not clear
their entire defense is "we are totally trustworthy! it's not our fault some 'bad client' opened and shared a spreadsheet we negligently used as a publicly accessible database of our fraud"
There are numerous contradictions in their messaging. They admit the data matches, but is being misconstrued, but they're going to rebuild their network and reaudit customers anyway. I can only assume they've received advice on this poorly thought out message delivery from the same place they received that awkward gesture and body language coaching. I'm sorry to say that the combination comes across as insincere.
It's important to note that pathological liars don't stop lying. In fact, when they're caught lying red-handed, they usually double down and lie even more.