The compliance startup, Delve, is facing yet another blow following the disclosure of a major security incident at Context AI. The breach led to data being exposed at Vercel, the popular app and website hosting giant, after an employee downloaded an app made by Context AI and linked it to their corporate account.

Vercel’s statement highlights the vulnerabilities within even certified systems: an internal system break-in, enabled through a single misstep in employee actions. It underscores that security certifications don’t guarantee safety; they’re merely checks on compliance with protocols, which can still be circumvented by human error or intentional breaches.

Delve has been at the center of scrutiny since March, following claims of fake customer data and rubber-stamped audits. These latest events add a new layer to Delve’s troubles: a security breach at one of its own customers, LiteLLM, and now another client, Context AI, is distancing itself from the startup.

The incident has prompted further questions about the effectiveness of compliance services in the tech industry. As Vercel and others continue to navigate the fallout, it raises concerns about how much confidence can be placed in such services given their inherent limitations.