They have the data. They know your past usage, they have access to PVWATTS, they may even have their own customized PV model.
If it was your company what would you do? Maybe run an audit every once in awhile and compare usage against agreement. Use a threshold to trigger weekly or daily audits...