What would work would be the reverse: making representations that there are no third-party data controllers involved, that none of the data leaves the first party and its known processors, and that various guarantees about the safety of its processing are enforced.