[FinnKuhn]

I think companies like Deel showed that SOC2 is more show than anything else.

For context, this is how easy it is to get a SOC2: https://deepdelver.substack.com/p/delve-fake-compliance-as-a...

[nerdsniper]

Delve. Not Deel. Very different startups.

[FinnKuhn]

Yes, you are right and I mixed them up. Too late to edit or delete the comment now though.

Deel is the ycombinator startup that allegedly spied on their competition while Delve is the ycombinator startup that allegedly fakes SOC2 compliance.

[paulryanrogers]

Hasn't Deel been run out of business though?

IME SOC2 is still quite involved for any company, especially smaller ones without specialized security personnel.

[nerdsniper]

I think both of you meant “Delve”, not “Deel”. Deel is a pretty successful HR startup that’s still growing at a good rate and AFAIK free of major scandals.

Again, Deel is HR, not SOC2. Delve was the SOC2 company described in the article linked above.

[FinnKuhn]

Yes, you are right and I mixed them up. Too late to edit or delete the comment now though.

Deel is the ycombinator startup that allegedly spied on their competition while Delve is the ycombinator startup that allegedly fakes SOC2 compliance.

[LoganDark]

Major scandals except that one time they stole Rippling trade secrets

[paulryanrogers]

Right, Delve was the company I was thinking of. Thanks for pointing that out.

[FinnKuhn]

Their website is still up, but I have a hunch you can find some other certificate mill that will give you a SOC2 certificate just as easily.

[a-priori]

A SOC2's quality entirely depends on how much you trust the auditing firm.

Delve used an audit mill they paid to rubber-stamp the cookie-cutter and AI slop reports it authored. I hope it ends up in fraud charges.

But I wouldn't assume that's the case for all SOC2 reports. Any decent auditing firm should be far more rigorous.

[FinnKuhn]

These audits for Apple were done by EY.

As a German I remember that they were banned from doing certain audits in Germany until earlier this year due to their involvement in the wirecard scandal. So at least my personal believe that their audits are done rigorously is nonexistent.

https://edition.cnn.com/2023/04/03/business/wirecard-ey-ban-...

[tptacek]

Not really. The more expensive the auditor, the more they'll work with you to craft something that will avoid exceptions. There's no real "rigor" involved in SOC2! The "audit" here is in audit in the accounting sense: "do your records square up?". SOC2 auditors are generally not technical people.