Pharus
Sign in
Book a walkthrough

Trust center

What a security review or a procurement check needs to know about Pharus, in one place. Each answer links to the page it comes from.

Last updated 3 November 2026

Company

Pharus is made by Pharus Development AS, org. no. 935 144 582, in Sandvika, Norway. See the entry in the Brønnøysund Register.

Where data is stored

Customer data is stored in Stockholm, Sweden: the database with Supabase, and Pharus runs on Vercel in the same region.

A few sub-processors, such as those that send email and SMS, may process data in the USA, under a transfer mechanism in GDPR Chapter V. Where data lives has the details.

Sub-processors

The list of sub-processors says what each one does and where. We notify workspace administrators at least 30 days before adding one, so you can object.

Data processing agreement

The customer is the controller of the personal data in its workspace, and Pharus Development AS is the processor. The data processing agreement is part of the terms you accept when you create a workspace, and data processing sets out what we process and why. For a signed agreement, write to privacy@pharussecurity.com.

Security

  • Connections use TLS 1.2 or 1.3, and the database is encrypted at rest with AES-256.
  • Membership is checked on every request, and every query is limited to one workspace.
  • Owners and admins who sign in with a password must use two-step verification.
  • The decision record and the audit log are append-only.

Security has the full description.

Vulnerability disclosure policy

Report a vulnerability in Pharus to security@pharussecurity.com, in Norwegian or English. We confirm within 2 business days and give an initial assessment within 5 business days. We will not take legal action against security research done in good faith within the limits of the policy.

When something goes wrong

  • A personal data breach affecting your data: we notify you without undue delay, so you can report to Datatilsynet within the 72-hour deadline.
  • An actively exploited vulnerability in Pharus: we notify affected customers within 24 hours.
  • Service status: status.pharussecurity.com.

AI assistance

AI assistance is off until an owner or admin turns it on for the workspace. Where data lives says what leaves Pharus when it is on, and who handles it.

Keeping and deleting data

You can export your workspace data at any time. When the agreement ends says how long data is kept after a subscription ends or a workspace closes.

Contact