Really? Wow. I've never had a company claim they have a SAS70 type II (or whatever it's called now) but refuse to release the actual report ... that just seems so non-sensical. Not having a SAS70 isn't the end of the world, but lying about it certainly would be.