Our website is maintained by a state service provider. There is no access to customer information through the site nor is the service provider able to access any customer information through the website. Do they have to have a SAS 70 done if the service provider does not come into contact with any customer information?

I don't see why they should have to have one.