You are bound by the GPL to distribute source yourself, either with the product or on request. This only applies to GPL'd parts, but most are, anyway.
Pointing to upstream (ie. us) is not allowed. Where would your clients get the source if we went under?
Note that you only need to make source available to clients who have the binaries. If your competitor asks you without having one, you need not give the sources to them.