That's strange - they won't send you a document from their auditors certifying that they've undergone some sort of SOC2-type audit? I don't really get why you'd withhold that, it's what you paid for.