When your sellers repeat a vendor claim, who carries the gap?

The customer's question was simple: "Your proposal says monitoring is round the clock. Is that in the contract?" The reseller's account manager had copied the line from the vendor's datasheet. Nobody on the call could answer, and the renewal that had looked certain went back to procurement for another month.

Partner sellers repeat vendor claims every day. That is part of the job. Distributors, resellers, managed service providers and training partners carry messages from many vendors to many customers, usually faster than anyone can check them. The risk is not that vendors write misleading material. It is that a sentence written for one context gets reused in another, and the partner who repeats it is the one the customer holds to it.

The skill that protects the partner is not knowing every product in depth. It is knowing where a claim's evidence stops, and saying only what it supports.

A vendor datasheet describes its managed detection service as "24/7". The service description, a separate document, says analysts work business hours in the customer's region, and that outside those hours the service sends automated alerts without analyst review.

Both documents are accurate. The datasheet is describing that the service watches all the time. The service description says when a person looks at what it finds. A customer reading "24/7 managed detection" in a proposal will usually assume a person is responding at 3 a.m.

What the evidence supports: continuous monitoring, with analyst review during business hours and automated alerts outside them.

Who should check before the claim is repeated: the partner's presales lead, against the current service description, and the vendor's partner manager if the documents disagree.

What the seller can safely say: "The service monitors continuously. Analysts review alerts during business hours; outside them you receive automated alerts. If you need analyst response overnight, we should look at the extended option before you decide."

A customer's security team asks for proof that the vendor's platform is managed securely. The partner sends the vendor's ISO 27001 certificate. The certificate is genuine and current. Its scope statement covers the vendor's corporate IT and one hosting region. The product being sold runs in a different region and was added after the last audit.

A certificate is only as wide as its scope. Customers' reviewers know this, and they read the scope line first. When they find that it does not cover the product, the problem is no longer the certificate. It is that the partner sent it as if it did.

What the evidence supports: an information security management system certified for the activities and locations named in the scope.

Who should check: whoever answers security questionnaires for the partner, before any certificate leaves the building, by reading the scope statement against the product, region and service being proposed.

What the seller can safely say: "This certificate covers the vendor's corporate operations and the named hosting region. The product we are proposing runs elsewhere, so I've asked the vendor for the assurance that covers it. I'll send it as soon as I have it."

An AI assistant is sold through the partner's catalogue. The vendor's marketing page says customer content is never used to train its models. The terms of service say this applies to the business plan. On the lower-priced plan, content may be used to improve the service unless the customer opts out.

The customer is buying the lower-priced plan.

What the evidence supports: a no-training commitment for business-plan customers, as stated in the current terms.

Who should check: the partner's commercial lead, against the terms for the plan actually being quoted, and the customer's data protection contact if they have raised the question.

What the seller can safely say: "The no-training commitment is in the business plan's terms. On the plan in this quote, content can be used to improve the service unless you opt out. If that matters for your data, we should price the business plan or confirm how the opt-out works before you sign."

In most partner-led deals, the customer's contract is with the partner, not the vendor. Commercially, the party that made the statement to the customer usually has to deal with it first, whatever the vendor's datasheet said. Back-to-back terms between vendor, distributor and reseller may move the cost later, but they rarely protect the relationship with the customer at the moment the gap is found.

That is why a partner's reputation depends less on how much it knows about each product and more on how carefully it repeats what it is told.

Most partner teams already have the documents they need. What is missing is the habit of reading them against the sentence about to go into a proposal. That habit can be practised: take three claims from live proposals this week, find the document that commits to each one, and rewrite any sentence that says more than its document does.

ASTRA's programmes build this kind of commercial judgement for people who sell, advise on or support cloud, security and AI, across any vendor's portfolio. The ASTRA Cybersecurity Sales Specialist programme is built for people selling security; the ASTRA Tech Sales Associate programme covers the wider cloud, security and AI sale.

Try a two-minute challenge at astraready.com/spot. The ASTRA beta is free until 5 November 2026.

Practical takeaways: quote the document that commits, not the one that describes; read scope, region, plan, hours and version first; give every claim an owner; and offer the bounded version rather than the confident one.