Trust and data security
You give us the supplier’s code and your own documents. Here is what leaves your computer, what we keep, and what Lemmaspor cannot promise.
In short
- The code is filtered in your browser before anything is sent.
- Once the report is made, we keep neither code, documents nor the report.
- You can use your own AI provider.
- You are the data controller for the material. We are the data processor.
What leaves your computer
Removed in the browser before anything is sent:
- installed libraries and other people’s code
- build files and generated files
- images and other binary files
Passwords and keys: The file is kept, but the values are replaced, so we can tell you that they exist without seeing them ourselves.
Sent: your own source code, lock files and the documents you choose to attach.
The report shows exactly how many files were removed and how many were kept. See the extended example (in Danish).
How data flows
- Your browserfilters the material.
- Lemmasporholds the code up against your documents.
- The AI providerassesses the findings: ours or your own.
- Your reportYou collect it. The material is deleted.
What we keep
Does not keep: code, documents and reports. The report is your only copy, so keep it. You need it for the next follow-up.
Keeps: your messages to us, for as long as we need them to answer you. See the privacy policy.
Who processes the material
Roles: You are the data controller for personal data in the material. Lemmaspor is the data processor and processes it on your behalf and on your instructions.
The AI provider: The one that analyses the material is ours, or your own if your organisation has an agreement with a particular provider and wants to use it. Then the material stays within the framework you have already approved.
What Lemmaspor cannot promise
- It is an indication. Not an audit and not a guarantee.
- Lemmaspor can say: “something looks off here, and here is why.” It cannot say that everything is fine.
- No findings in an area is not the same as the area being fine.
Lemmaspor has neither built the system nor sent the bill. That is the whole point of being independent.
Every finding in a report says how sure we are and what could make us wrong. The report also says what we have not looked at. See the examples.
A question from your lawyer?
Of course. It is also a good idea. We are happy to give your data protection officer the details of how data flows.