Lemmaspor
Dansk

An independent look at IT deliveries

You paid for an IT system you can't see into.

Upload the supplier's code and your own documents. Get one page in plain language on what looks off, what it could cost you, and what to ask the supplier.

Try one report See an example first

You don't need to read code. That's the whole point.

Show the same network in four states
A quiet network in four statesAbout fifty connected systems drawn as a faint mesh inside a boundary. One highlighted route shows what matters. Use the buttons to see it connected, broken, with an intrusion, and blocked.citizensunknownportalauthapiworkflowcase-dbarchiveexportportalauthapiworkflowcase-dbarchiveexportauthapiworkflowrefused

Connected What you ordered is delivered and talks to everything else.

Broken A paid-for connection leads nowhere, and what hangs on it cannot be verified.

Intrusion An unknown source gets in. Three zones: affected, possibly affected, not affected.

Blocked The attempt stops at the boundary, is refused and is logged.

The problem

You pay, and you have no idea what you're getting.

It isn't your fault. The system is large, the code is closed, and the people who can answer are the same ones sending the invoice.

The bill keeps growing

Operations, changes and “small adjustments” get more expensive every year. Each invoice can be explained. The total is harder to explain.

You can't see inside

You can see screenshots and status meetings. You can't see whether there is order under the hood or just duct tape.

Suppliers grade their own homework

Quality is documented by the people who built it. Surprisingly, they usually give themselves a good grade.

How it works

Three steps. No workshop.

  1. Give us the material

    Upload the supplier's code, or connect GitHub, GitLab or Azure DevOps. Add your own documents alongside it: requirements specification, contract and solution description.

    The code is filtered in your browser before anything leaves your computer.

  2. We compare

    Lemmaspor looks at three things: Does what was delivered match what was ordered? Are there security problems? And could another supplier realistically take over the system if you wanted to switch?

  3. You get two things

    A one-page summary in plain language with the three to five most important reasons something looks off. And an extended report with the technical evidence, which you can pass on to a consultant or to the supplier.

    If something looks off, you get the reason and a question to ask. If Lemmaspor finds nothing, that's good news, but not a guarantee.

Run it again at the next delivery. Then you can see what has improved and what has got worse. It's hard to sweep under the rug when it's there in black and white.

An example

This is what it looks like when something is off.

Below is an indication for a made-up case management system in a made-up municipality. No real suppliers or customers. The format is the real one.

Why Lemmaspor? A lemma is the small proof you establish first so the rest can stand firm. Each finding below is such a lemma, and together they form a trail (“spor” in Danish) you can follow all the way to the question for the supplier.

Example · fictional case

The Case Portal, Nordby Municipality

12 October 2026 · 4 findings

Indication, not audit
Posture: Elevated
  • 2 Alert
  • 2 Note

Two findings need a decision this month.

The findings as a trailFour findings, F-01 to F-04, shown as a row of connected marks: two triangles, then two diamonds. A dashed line leads on to a hollow circle labelled ask.F-01F-02F-03F-04ask

Each finding is a step. The trail ends in a question for your supplier.

  1. Alert High

    A requirement you paid for doesn't appear to be built

    What's wrong
    The requirements specification says decisions must be sent automatically to the citizen's digital mailbox. In the code there is only an empty function with the right name. It does nothing.
    Why it matters
    The requirement is part of a milestone that has been paid. If the function doesn't exist, you have paid for something you haven't received, and caseworkers are still sending letters by hand.
    How sure are we
    High. We looked for the function, and it does nothing.
    Ask the supplier
    “Show me where in the system a decision is sent to the citizen's digital mailbox. Can you demonstrate it with a real case?”
  2. Alert New since last delivery High

    Passwords are sitting in the open in the code

    What's wrong
    The code contains passwords for the database and for an external service, written directly into the files. Anyone with access to the code can read them.
    Why it matters
    If the code ends up in the wrong hands, others hold the key to citizens' case data. It is a security risk and potentially a personal data breach.
    How sure are we
    High. It's directly readable. Whether the passwords still work, we can't tell.
    Ask the supplier
    “Have those passwords been changed, and how will you store secrets going forward so they aren't in the code?”
  3. Note Medium

    The system rests on the supplier's own closed toolbox

    What's wrong
    Large parts of the system are built on components that only the supplier has and knows. They are undocumented and not available anywhere else.
    Why it matters
    Another supplier must either learn it all from scratch or rebuild it. Both cost money, and both weaken your negotiating position when the contract is up for renewal.
    How sure are we
    Medium. The picture is clear, but we can't see what has been agreed about rights.
    Ask the supplier
    “Which parts are your own components, and where does the contract say we can get source code and documentation for them?”
  4. Note Low to medium

    The most sensitive parts are barely tested

    What's wrong
    There are automated tests, but almost none of them touch the part that calculates and pays out benefits. That is exactly where mistakes are most expensive.
    Why it matters
    Every change becomes a lottery. Errors are found by caseworkers or citizens instead of by the supplier, and then the bill is yours.
    How sure are we
    Low to medium. The supplier may test in ways we can't see in the code.
    Ask the supplier
    “How do you make sure a change doesn't break the calculation of benefits? Can you show the test results from the last three deliveries?”

The extended technical report can be downloaded as a file.

Run it again at the next delivery to see what improved or got worse.

The example is constructed to show the format. It is not an assessment of a real system.

When it makes sense

Four situations where you'd like to have known more.

  • “We're about to approve a delivery.”

    Once you've said yes, you're the one who accepted. Get an impression while you can still ask questions without sounding like someone who is too late.

  • “Why is this so expensive?”

    Sometimes the answer is that the system is hard to change. Then you know what you're paying for and what you can make demands about.

  • “Are we exposed?”

    You don't need to be able to see a security hole to ask about it. You just need to know it's worth asking, and who to ask.

  • “Could someone else take over?”

    It's a question best asked before you need the answer. Lemmaspor shows how locked in the system is to the current supplier.

Your data

Code isn't your only sensitive material. We treat it accordingly.

Filtered in your browser

Before anything is sent, your browser automatically removes what we don't need:

  • installed libraries and other people's code
  • build files and generated files
  • passwords and keys we have no need to see

Nothing is stored afterwards

Once the report is made, we store neither your code nor your documents. You download the report yourself; the rest is gone.

Use your own AI provider

If your organisation has an agreement with a particular AI provider, you can use it instead of ours. Then the material never leaves the framework you have already approved.

A question for your legal team?

Of course. That's a good idea too. We're happy to give your data protection officer the details of how data flows.

Honestly

This is an indication. Not an audit and not a guarantee.

Lemmaspor can say: “something looks off here, and this is why.” It cannot say that everything is fine, and it cannot replace an auditor or a technical adviser.

If Lemmaspor finds something, that is where you call a consultant. And now you know what to ask, so you spend their time on what matters instead of working out where to start.

If Lemmaspor finds nothing, that is good news. But not proof.

Indication, not audit

Pricing

Two ways to get started.

The price follows the size of what is to be reviewed.

To try it out

Single report

One run on one system. You get the summary page and the extended report. A good fit if you want to see whether this is right for you, or if a single delivery is coming up.

For ongoing use

Annual plan per system

Run Lemmaspor at every delivery and follow developments over time: what got better and what got worse. A good fit for systems delivered in stages.

Get started

Ask while it's still cheap to ask.

Tell us which system it concerns and when the next delivery is. We'll come back with a proposal for a first run.

Try one report Write to kontakt@lemmaspor.example