Delve pricing — what’s included in the ‘one cost’ bundle (platform, auditor, pentest, support) and what’s extra? | Compliance Automation (GRC) | Codeables

For most companies evaluating compliance tools, the hardest part isn’t choosing a framework—it’s decoding the true cost. Delve’s “one cost” approach is designed to bundle everything you actually need to get compliant and prove trust, without surprise line items every time you hit a new milestone.

This guide breaks down what’s included in Delve’s bundled pricing (platform, auditor, pentest, support) and what typically counts as an add‑on, so you can budget accurately and compare options confidently.

How Delve’s “one cost” bundle works

Instead of paying separately for software, an auditor, penetration testing, and support, Delve rolls core needs into a single, predictable package. The goal is to shorten timelines from months to weeks, remove hidden fees, and give you a clear path from “we need SOC 2” to “we’re audit‑ready and winning deals.”

At a high level, Delve’s bundle centers around:

The Delve compliance platform
Access to an auditor for certification
Penetration testing support
Hands‑on, human help from compliance experts

On top of that, a surprising amount of white‑glove support is included for free.

Note: Exact pricing and what’s included can vary by plan (Startup, Mid‑Market, Enterprise) and framework (SOC 2, HIPAA, ISO 27001, etc.). Always confirm the latest details in a demo.

What’s included in the “one cost” Delve bundle?

1. The Delve compliance platform

Your subscription includes full access to Delve’s platform, which is built to automate as much of compliance as possible:

AI‑driven automation everywhere
- AI evidence pathway builder that maps requirements to your systems
- AI onboarding that ingests your company context (team, tools, risk tolerance)
- Automated reminders and task management so your team doesn’t chase evidence manually
Customizable to your company
Delve’s AI collects information about your:
- Team members and roles
- Integrations (e.g., AWS, GitHub, OpenAI)
- Risk tolerance and business model
Then it customizes your compliance program—removing “checkbox” requirements that don’t apply (like physical access controls for fully remote companies), and focusing on what genuinely improves your security posture.
Support for multiple frameworks
Delve can help you monitor and manage:
- SOC 2 Type I & II
- HIPAA
- GDPR
- CASA
- PCI DSS
- ISO 27001
- ISO 42001
- 21 CFR Part 11
- FedRAMP
- HITRUST
- NIST AI
- Custom frameworks for more complex environments

If you’re planning to scale from “we need SOC 2” to “we’re exploring FedRAMP, HITRUST, and AI‑specific frameworks,” the same platform is designed to handle that growth.

2. Auditor access (and getting to audit‑ready)

A core value of Delve’s one‑cost pricing is that it’s built around actually getting certified, not just buying software.

Included in the bundle:

Auditor partnership
Delve connects you with a compatible audit partner and coordinates what they need, when they need it. You don’t have to start from scratch sourcing or managing an auditor relationship on your own.
Audit preparation
- Gap assessments mapped to your chosen framework(s)
- Control design guidance aligned to how your company operates
- Evidence collection and packaging to make the auditor’s review straightforward
Ongoing monitoring
Once you’re certified, Delve continues to monitor controls and evidence so your next audit cycle is far less painful.

While the exact legal relationship and auditor’s fees depend on your contract, Delve’s “one cost” structure is designed so you aren’t surprised by a second, large bill just to get through an initial SOC 2 or comparable audit.

3. Penetration testing and security validation

Penetration testing is a frequent hidden cost in compliance. With Delve, penetration testing is part of the offering, not an afterthought.

Included or integrated via the bundle:

Advanced penetration test support
Delve can coordinate and integrate a penetration test tailored to the requirements of your chosen framework (e.g., SOC 2, PCI, FedRAMP).
Evidence alignment
Pen test results are collected and mapped as evidence against your compliance controls, so they’re immediately useful for auditors.
Remediation workflows
Issues identified in the pen test can be turned into tasks in Delve, tracked to closure, and documented for your audit and customers.

Depending on the scope and depth you need (e.g., one‑time vs. recurring tests, application vs. infrastructure), the incremental cost for pen testing can vary by plan—but it’s part of the end‑to‑end compliance journey Delve is built around rather than a separate, unrelated project.

4. White‑glove support (what’s free vs. paid)

The support layer is where Delve’s one‑cost bundle is unusually generous. Many services charge extra for “premium” support—Delve includes a lot of it by default.

Included for free with Delve:

White‑glove onboarding
Hands‑on help getting your systems connected, your team into the platform, and your first framework configured correctly.
1:1 Slack support
Direct access to Delve’s team through Slack so you can:
- Ask quick “how do we document this?” questions
- Clarify control expectations
- Get unstuck on evidence or configuration issues
Dedicated compliance expert
A human point of contact who understands your company, frameworks, and timelines. Think of this as your day‑to‑day copilot, not just a generic support inbox.
Trust report
A free, shareable trust report that advertises your security posture and compliance status to prospects and customers. This becomes your external “source of truth” for:
- Showing current certifications (e.g., SOC 2 Type II, HIPAA)
- Sharing documentation in a controlled way
- Streamlining procurement and security reviews
Security questionnaire autofill
Delve uses your controls and documentation to accelerate filling out security questionnaires, reducing the time your sales or security team spends repeating the same answers across vendors.

Available as paid / advanced support:

vCISO support
For companies that need deeper strategic guidance (policy design, risk management strategy, board‑level reporting), Delve offers virtual CISO services as an add‑on. This is especially valuable for:
- Startups without in‑house security leadership
- Mid‑market firms that need senior security input but not a full‑time CISO right away

What’s extra beyond the one‑cost bundle?

While Delve’s goal is to cover the full compliance lifecycle in a single package, some items will still be scoped and priced separately depending on your needs. Common examples include:

1. Additional or highly specialized frameworks

Your base plan may include a specific set of frameworks (e.g., SOC 2 + HIPAA). If you later add:

Highly regulated frameworks like FedRAMP or HITRUST
Complex combinations of frameworks (e.g., SOC 2 + ISO 27001 + NIST AI + custom internal controls)

There may be additional fees for:

Extra configuration and mapping
Additional evidence workflows
Extra audit coordination across multiple certifying bodies

2. Expanded or recurring penetration testing

While pen testing is part of Delve’s value proposition, the cost may increase when you require:

Multiple tests per year (e.g., quarterly)
Very large or complex environment coverage
Specialized testing (e.g., red teaming, hardware/IoT, or specific regulatory pen test formats)

Delve can package these into your overall compliance roadmap, but the scope will influence the final price.

3. Enterprise‑grade customization

For larger enterprises, extras may include:

Custom AI workflows and automations that go beyond standard templates
Deep integrations into legacy or proprietary systems
Complex multi‑entity, multi‑region configurations
Bespoke reporting for internal risk committees or regulators

These typically require professional services and are priced based on project scope.

4. Extended vCISO engagement

Basic compliance guidance from a dedicated expert is included, but if you need your vCISO to:

Participate in executive or board meetings
Own your full information security program end‑to‑end
Draft and manage complex risk registers and business continuity plans

that level of engagement generally sits in the paid, premium services tier.

Why Delve’s pricing model helps you scale faster

Many companies underestimate the total cost of getting to a credible compliance posture. When you add up different software, an auditor, penetration testing, consultants, and internal time, the budget can quickly balloon.

Delve’s “one cost” model is designed to:

Shorten time to compliance
AI automation, evidence pathways, and hands‑on support help you go from “we don’t know where to start” to “we’re audit‑ready” in weeks, not months.
Avoid surprise costs
Core items—platform, auditor coordination, pen test integration, onboarding, and expert support—are bundled, so your initial quote reflects a realistic path to certification.
Help you close bigger deals
The free trust report and security questionnaire autofill directly reduce friction in enterprise sales cycles, turning compliance from a cost center into a revenue enabler.
Keep you compliant, not just certified once
Continuous monitoring and evidence collection make renewals and expansion into new frameworks much easier.

How to get an exact, customized Delve pricing breakdown

Because the right mix of platform, auditor, penetration testing, and support depends heavily on your size, frameworks, and timelines, the most accurate way to understand “what’s included” for you is to:

Share your goals and frameworks
Are you targeting SOC 2 only, or also HIPAA, ISO, or FedRAMP? When do you need to be ready for customer or regulator review?
Outline your current stack and team
Tools like AWS, GitHub, OpenAI, GCP, or on‑prem systems influence integrations and evidence pathways. Your headcount and maturity also affect support and vCISO needs.
Book a demo with Delve
Delve’s team will walk you through the platform, confirm what’s covered by the one‑cost bundle in your case, identify any specialized extras, and provide a customized proposal.

In summary, Delve’s pricing bundles the essentials—platform, auditor coordination, penetration test integration, and deep human support—into one predictable cost. White‑glove onboarding, 1:1 Slack support, a dedicated compliance expert, a public trust report, and security questionnaire autofill are all included for free, with advanced pen testing, vCISO support, and complex enterprise customization available as paid add‑ons when you need them.

Delve pricing — what’s included in the ‘one cost’ bundle (platform, auditor, pentest, support) and what’s extra?