Drata

Matia Launches on Snowflake Marketplace

Matia, a unified data operations platform, announced at Snowflake Summit 26 that it has launched on Snowflake Marketplace. The listing lets joint customers deploy Matia’s ETL, reverse ETL, observability, and catalog capabilities directly within their Snowflake AI Data Cloud environments, simplifying procurement and accelerating time-to-value. Matia said customers can consolidate data tooling, accelerate AI readiness for Snowflake Cortex AI, and reduce infrastructure costs (the company cites up to 61% lower data infrastructure spend for some customers). Named customers include Ramp, Drata, HoneyBook, and Lemonade. Benjamin Segal, Matia co-founder and CEO, is quoted on the Marketplace listing removing friction for customers.

SOC 2 End-to-End Guide (Big 4 Style)

This guide explains SOC 2 from a Big‑4 auditor perspective, walking through why SOC 2 matters for client trust and deal flow, the Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy), and the differences between Type I (point‑in‑time) and Type II (3–12 months). It outlines a practical SOC 2 engagement lifecycle: scoping/readiness, control design and implementation, documentation, audit testing (tests of design and effectiveness), evidence collection, and final report components (auditor opinion, system description, control matrix, exceptions). The post lists common control failures, example controls and tools (ServiceNow, Jira, Okta, Azure AD, AWS, GCP, Vanta, Drata), and career skills for IT audit/risk professionals. The tone is instructional, emphasizing documentation, consistent evidence, and controls that demonstrably mitigate risk.

Investigation: Delve Allegedly Faked SOC 2 Certifications

A Substack investigation alleges that Delve, a compliance automation platform, systematically manufactured false SOC 2 and ISO 27001 certifications by pre-populating audit evidence, generating test procedures internally, and sending finished packages to auditing firms that allegedly rubber-stamped results without independent verification. Named auditors in the report include Accorp, Gradient Certification, Glocert, and DKPC. The report says multiple companies — including venture-backed startups and at least one NASDAQ-listed firm — received these certifications, collectively handling millions of customer records. The article warns that automated compliance can become misleading when evidence is fabricated, and it outlines verification steps for buyers: request full SOC 2 Type II reports under NDA, verify the auditor on the AICPA directory, prefer Type II over Type I, look for exceptions in reports, and evaluate security independently. It also lists other compliance automation vendors (Vanta, Drata, Secureframe, Thoropass) and frames the issue as a systemic trust risk for developer tools.