# Trust center Source: https://www.pharussecurity.com/en/trust · Last updated 2026-11-03 What a security review or a procurement check needs to know about Pharus, in one place. Each answer links to the page it comes from. ## Company Pharus is made by Pharus Development AS, org. no. 935 144 582, in Sandvika, Norway. See the [entry in the Brønnøysund Register](https://virksomhet.brreg.no/nb/oppslag/enheter/935144582). ## Where data is stored Customer data is stored in Stockholm, Sweden: the database with Supabase, and Pharus runs on Vercel in the same region. A few sub-processors, such as those that send email and SMS, may process data in the USA, under a transfer mechanism in GDPR Chapter V. [Where data lives](https://www.pharussecurity.com/en/data-processing#where-data-lives) has the details. ## Sub-processors The [list of sub-processors](https://www.pharussecurity.com/en/data-processing#sub-processors) says what each one does and where. We notify workspace administrators at least 30 days before adding one, so you can object. ## Data processing agreement The customer is the controller of the personal data in its workspace, and Pharus Development AS is the processor. The data processing agreement is part of the [terms](https://www.pharussecurity.com/en/terms) you accept when you create a workspace, and [data processing](https://www.pharussecurity.com/en/data-processing) sets out what we process and why. For a signed agreement, write to [privacy@pharussecurity.com](mailto:privacy@pharussecurity.com). ## Security - Connections use TLS 1.2 or 1.3, and the database is encrypted at rest with AES-256. - Membership is checked on every request, and every query is limited to one workspace. - Owners and admins who sign in with a password must use two-step verification. - The decision record and the audit log are append-only. [Security](https://www.pharussecurity.com/en/security) has the full description. ## Vulnerability disclosure policy Report a vulnerability in Pharus to [security@pharussecurity.com](mailto:security@pharussecurity.com), in Norwegian or English. We confirm within **2 business days** and give an initial assessment within **5 business days**. We will not take legal action against security research done in good faith within the limits of the policy. - [The disclosure policy](https://www.pharussecurity.com/en/security#report-a-vulnerability) - [security.txt](https://www.pharussecurity.com/.well-known/security.txt), per RFC 9116 - [Security advisories in CSAF](https://www.pharussecurity.com/en/security#security-advisories-csaf) ## When something goes wrong - **A personal data breach affecting your data:** we notify you without undue delay, so you can report to Datatilsynet within the 72-hour deadline. - **An actively exploited vulnerability in Pharus:** we notify affected customers within 24 hours. - **Service status:** [status.pharussecurity.com](https://status.pharussecurity.com). ## AI assistance AI assistance is off until an owner or admin turns it on for the workspace. [Where data lives](https://www.pharussecurity.com/en/data-processing#where-data-lives) says what leaves Pharus when it is on, and who handles it. ## Keeping and deleting data You can export your workspace data at any time. [When the agreement ends](https://www.pharussecurity.com/en/data-processing#when-the-agreement-ends) says how long data is kept after a subscription ends or a workspace closes. ## Contact - **Security:** [security@pharussecurity.com](mailto:security@pharussecurity.com) - **Data protection:** [privacy@pharussecurity.com](mailto:privacy@pharussecurity.com) - **Support:** [support@pharussecurity.com](mailto:support@pharussecurity.com) - **Everything else:** [hello@pharussecurity.com](mailto:hello@pharussecurity.com) # Security Source: https://www.pharussecurity.com/en/security · Last updated 2026-11-03 Pharus holds information about vulnerabilities in your products that may not be fixed yet, so we protect it accordingly. Here is how your data is encrypted and kept apart, who can reach it, and how to report a vulnerability in Pharus. ## Where your data lives Your workspace data is stored in Stockholm, Sweden, with our database provider Supabase, and Pharus runs on Vercel in the same region. A few sub-processors, such as those that send email and SMS, may process data in the USA. [Data processing](https://www.pharussecurity.com/en/data-processing) lists them all. ## Encryption ### In transit - Connections to Pharus use HTTPS with TLS 1.2 or 1.3, and browsers are told to use nothing else (HSTS). - The connection between Pharus and its database is encrypted with TLS. - Alerts to Slack, Microsoft Teams and your webhooks, tickets in Azure DevOps, Jira and GitHub, and text sent for AI assistance leave Pharus over HTTPS only. ### At rest - The database is encrypted at rest with AES-256 by our database provider. - Files you upload, such as SBOMs, VEX documents and technical documentation, are stored in the same database with the same encryption. - The addresses and access tokens for the services you connect are encrypted a second time by Pharus, with AES-256-GCM, before they are stored. The key is kept with our hosting provider, apart from the database, so a copy of the database alone can’t open them. - Passwords are stored only as salted hashes (scrypt), API tokens only as hashes, and the secrets for two-step verification encrypted. ## Workspaces are kept apart Each company’s data lives in its own workspace. Pharus keeps workspaces apart in three ways: 1. **Membership is checked on every request.** Before Pharus reads or changes anything, it checks that you are a member of the workspace and what your role allows. 2. **Every query is limited to one workspace.** Every table that holds workspace data carries the workspace’s id, and every query filters on it. 3. **Files are served only to members.** Uploaded files are downloaded through Pharus after the same checks. There are no open links to them. As a second barrier, row-level security is switched on for every table, so the data can’t be read through the database provider’s web API. Outside the workspace, only what its members choose to share can be seen: the advisories you publish, and time-limited links, such as the read-only link we use to review one incident. ## Sign-in and access - Email addresses are confirmed before an account can be used, and passwords must be at least 12 characters. - Owners and admins who sign in with a password must use two-step verification with an authenticator app, and anyone else with a password can turn it on. - Sign-in attempts are rate-limited, and sign-up has a bot check. - Three roles, owner, admin and member, decide what each person can do in the workspace. - The decision record and the audit log are append-only: entries can’t be changed afterwards. ## How Pharus is built - Every page of the app has a strict Content Security Policy, HSTS and protection against being framed by other sites. - Every input is validated on the server. - Webhooks Pharus sends can only reach public HTTPS addresses, never internal networks. - Webhooks Pharus receives from our payment and email providers are checked for a valid signature. - Error reports are stripped of contact details and database values before they leave Pharus. - AI assistance is off until an owner or admin turns it on. When it is on, the AI providers keep nothing and train on nothing. See [data processing](https://www.pharussecurity.com/en/data-processing). ## Operations - Production and testing use separate databases. - The database is backed up every day, with point-in-time recovery. - Only Pharus staff who need it have access to production data. - We monitor the service and its scheduled jobs, and are alerted when one fails. ## Report a vulnerability Email [security@pharussecurity.com](mailto:security@pharussecurity.com). Describe what is affected, how to reproduce it, and the impact you observed. We accept reports in Norwegian and English. The contact details are also in our [security.txt](https://www.pharussecurity.com/.well-known/security.txt), per RFC 9116. ## What to expect - Confirmation that we received your report within **2 business days**. - An initial assessment within **5 business days**. - Regular updates until the vulnerability is fixed or declined, with our reasoning. - Credit in the advisory, if you want it. ## Testing guidelines We will not take legal action against security research done in good faith and within these limits: - Test only against accounts and data you own, or have explicit permission to use. - Do not view, change or delete other people’s data. Stop and report if you come across it. - No denial of service, social engineering or physical attacks. - Give us reasonable time to fix the issue before you publish. We are happy to agree a date with you. ## Security advisories (CSAF) When we fix a vulnerability in Pharus that may affect customers, we publish an advisory in CSAF 2.0 format with VEX status for each affected component. Advisories are published here and sent straight to the administrators of affected workspaces. > No advisories have been published yet. ## Actively exploited vulnerabilities If we become aware that a vulnerability in Pharus is being actively exploited, we notify affected customers within 24 hours — the same clock we help you keep. # Data processing Source: https://www.pharussecurity.com/en/data-processing · Last updated 2026-11-02 How Pharus processes data on behalf of our customers, where it is stored, and which sub-processors we use. ## Roles When you use Pharus, you are the controller of the personal data in your workspace and Pharus Development AS (org. no. 935 144 582) is the processor. Processing is governed by the data processing agreement, which is part of the [terms](https://www.pharussecurity.com/en/terms) you accept when you create a workspace. For visits to this website, enquiries to us and billing, we are the controller. That is covered by our [privacy notice](https://www.pharussecurity.com/en/privacy). ## What we process - **Users:** name, work email, role and sign-in history. - **On-call:** phone numbers and rotas for the people who get paged. - **Vulnerability work:** SBOMs, matches, decisions with rationale, approvals and receipts. - **Inbox:** reports from security researchers, which may include names and contact details. SBOMs and vulnerability data are generally not personal data, but get the same level of protection. ## Purpose We process the data only to provide Pharus to you: matching components against vulnerability sources, paging the right people, keeping the decision record, producing reports and, if your workspace turns on AI assistance, drafting text for you to review. We do not use customer data for marketing, and neither we nor our sub-processors train machine-learning models on it. ## Where data lives Customer data is stored in the EU/EEA. Where a sub-processor below processes data outside the EU/EEA, the transfer happens only with a valid transfer mechanism under GDPR Chapter V, and you are told in advance of any new one. AI assistance is off until an owner or admin turns it on for the workspace. When it is on, the text a draft is made from goes through Opper’s AI gateway in Stockholm to the model, Claude, on Amazon Bedrock in the EU. Neither keeps the prompts or the answers, and nobody trains on them. Pharus sends no member, reporter or contact details, and removes email addresses and phone numbers from text people wrote. ## Sub-processors These sub-processors process customer data on our behalf: - **Supabase** — database and authentication data. Stockholm, Sweden. - **Vercel** — hosting and scheduled jobs. Stockholm, Sweden. - **Opper** — the AI gateway that passes text to the AI model (Claude, by Anthropic, on Amazon Bedrock), only for workspaces that turn on AI assistance. Stockholm, Sweden; the model runs in the EU. Zero data retention: no prompts or answers are kept. - **Resend** — sending email (alerts, invitations, digests) and receiving vulnerability reports sent by email. May process data in the USA. - **Twilio** — SMS messages to the people on call. May process data in the USA. - **Sentry** — error reports, which carry internal ids rather than contact details. May process data in the USA. - **Cloudflare Turnstile** — the bot check at sign-up. May process data in the USA. We notify workspace administrators at least 30 days before adding a sub-processor, so you can object. ## Services you connect When you connect Slack, Microsoft Teams, your own webhook or an issue tracker (Azure DevOps, Jira or GitHub), Pharus sends data to that service on your instruction. You choose these services, and your own agreement with each provider covers what it does with the data. Alerts and remediation tickets carry identifiers, titles, deadlines, component facts and links back to Pharus, never a reporter’s details, decisions or anyone’s name. Pharus stores the addresses and access tokens for these services encrypted. ## Security - All traffic is encrypted with TLS, and data is encrypted at rest. - Access to production data is limited to staff who need it. - The decision record is append-only: entries cannot be changed afterwards. ## Breaches If we discover a personal data breach affecting your data, we notify you without undue delay so you can report to Datatilsynet within the 72-hour deadline. ## When the agreement ends You can export your workspace data at any time. When a subscription ends, the workspace moves to the Free plan and its data is kept while the workspace is in use. A workspace on the Free plan that no member has signed in to for 12 months is deleted, after notice to its owners 30 and 7 days before. When an owner closes the workspace, customer data is deleted 90 days after its last paid period ends. In both cases the law may require us to keep some data longer. ## Contact Questions about data processing, or a signed data processing agreement: [privacy@pharussecurity.com](mailto:privacy@pharussecurity.com). # Privacy notice Source: https://www.pharussecurity.com/en/privacy · Last updated 2026-10-16 Which personal data we collect when you visit this website, book a walkthrough, contact us, create an account or subscribe — and what we do with it. ## Who we are Pharus Development AS (org. no. 935 144 582) is the controller for the personal data described here. Data you put into a Pharus workspace we process as your processor — see [data processing](https://www.pharussecurity.com/en/data-processing). ## What we collect - **When you book a walkthrough:** work email and language. - **When you use the contact form:** name, work email, company (optional), topic and your message. - **When you create an account:** name, work email, company name, country and organisation number. - **When your company subscribes:** the billing contact’s name and email, and the company’s billing address and VAT number. Card details are entered on our payment provider’s pages; Pharus does not receive or store card numbers. - **When you visit the website:** technical logs such as IP address, browser and time, for operations and security. - **If you accept analytics cookies:** which pages you visit, where you came from, and your device, browser and approximate location, through Google Analytics. ## Cookies We use necessary cookies for language choice and sign-in. They need no consent. With your consent, we also use Google Analytics, from Google Ireland Limited, to see how this website and the app’s sign-in, sign-up and forgotten-password pages are used. Google Analytics does not run on any other page of the app. It sets cookies whose names start with `_ga`, which last up to 2 years. Google Analytics does not store your IP address, and we do not use its advertising features. You can withdraw consent at any time under Cookie settings at the bottom of the page; the analytics cookies are then deleted. Your choice is stored for 12 months in the cookie `pharus-consent`, which this website and the app share. ## Why, and on what basis - **Providing the service** (GDPR Art. 6(1)(b)): account and company details are needed to create and run your workspace. - **Billing** (Art. 6(1)(b) and (c)): billing details are needed to charge for the service and to meet bookkeeping rules. - **Answering enquiries** (Art. 6(1)(f)): we use the details you give us to arrange a walkthrough or reply to your message. - **Operations and security** (Art. 6(1)(f)): logs are used to detect errors and abuse. - **Website analytics** (Art. 6(1)(a)): with your consent, to understand how the website and the sign-in pages are used and improve them. ## How long we keep it - Walkthrough requests and contact form messages: up to 12 months after last contact. - Account details: while the account is active. You can delete your account yourself under Settings → Your profile. When a workspace is deleted, the accounts of members who belong to no other workspace are deleted with it. An account that belongs to no workspace is deleted on request. - Accounting records, including billing records: for as long as Norwegian bookkeeping law requires. - Technical logs: up to 30 days. - Google Analytics data: up to 14 months. ## Sharing We do not sell personal data. Apart from billing and payment (see below), we share it only with sub-processors that help us run the service. Some of them may process data outside the EU/EEA, in the USA; such transfers rely on a transfer mechanism under GDPR Chapter V, such as the EU–US Data Privacy Framework or the EU’s standard contractual clauses. See [data processing](https://www.pharussecurity.com/en/data-processing) for the list and where each one processes data. Billing and payment are handled through Stripe, for card payments and invoices alike. Stripe receives the billing details above and any payment details entered at checkout, and may process them outside the EU/EEA under its own transfer safeguards. If you accept analytics cookies, Google receives the analytics data as our processor and may process it in the USA under the EU–US Data Privacy Framework. ## Your rights You can ask for access, rectification, erasure, restriction and portability, and you can object to processing based on legitimate interest. If you disagree with how we handle your data, you can complain to [Datatilsynet](https://www.datatilsynet.no/en/). ## Contact Write to [privacy@pharussecurity.com](mailto:privacy@pharussecurity.com). We reply within 30 days. # Terms of service Source: https://www.pharussecurity.com/en/terms · Last updated 2026-11-05 The agreement between Pharus Development AS and the organisation that creates a workspace. It applies from the moment the workspace is created. ## The agreement These terms apply between Pharus Development AS (org. no. 935 144 582, “Pharus”) and the organisation that creates a workspace (“the customer”). Whoever accepts the terms confirms they can bind the organisation. The [data processing agreement](https://www.pharussecurity.com/en/data-processing) is part of the agreement. ## The service Pharus helps the customer detect, assess and report vulnerabilities under CRA Article 14 and related rules: SBOM matching, Article 14(7) routing, the decision record, on-call paging, ready-to-paste SRP text and, if the customer turns it on, AI drafts of text. On the paid plans, the customer can ask the Pharus team to review an incident’s drafts before submission. The review is a professional read-through with comments, and the customer decides what to submit. > Pharus does not submit reports on the customer’s behalf and does not give legal advice. The customer is the manufacturer under the CRA and remains responsible for decisions, submissions and deadlines. AI drafts are suggestions. The customer reads and edits them before use and remains responsible for what is decided, filed and sent. ## Accounts The customer is responsible for the users in its workspace and for keeping sign-in details secret. If you suspect unauthorised access, tell us immediately. ## Free trial and the Free plan A new workspace can be used free of charge for 14 days, without entering payment details. If no subscription has been started when the trial ends, or when a subscription ends, the workspace moves to the Free plan at no charge. On the Free plan, vulnerability reports sent through the customer’s disclosure page, security.txt and disclosure inbox are still received, and the inbox, the disclosure settings and the company details can still be used. Everything else is read-only and monitoring is paused until a subscription is started. A workspace on the Free plan is kept while it is in use. One that no member has signed in to for 12 months is deleted, after notice to its owners 30 and 7 days before. ## Pricing and payment Pricing is per product family, in NOK excluding VAT, according to the current price list. Paying yearly costs the same as ten months. Each period, a month or a year, is billed when it starts, and the subscription renews automatically until cancelled. If the subscription is started during the trial, the first paid period begins when the trial ends. Payments and invoices are handled through Stripe. - **Starter** is paid by card. - **Core** is paid by card. On yearly billing, an owner can order Core by invoice instead, under Settings → Billing. - **Plus** is set up by agreement with us and can be paid by invoice on yearly billing. When paying by invoice, the invoice is emailed when the period starts, with 14 days to pay, and the workspace’s owners get a reminder before the due date. The workspace has full access from the invoice date. If the invoice is still unpaid 7 days after the due date, the workspace becomes read-only, as on the Free plan, until it is paid: vulnerability reports are still received, but monitoring is paused. The invoice must be paid even while the workspace is read-only. Late payment accrues interest under the Norwegian Late Payment Interest Act (forsinkelsesrenteloven). Review before submission costs a fixed one-off fee per incident, according to the current price list. The customer accepts the fee when sending the request, and it is invoiced afterwards with 14 days to pay. Plus includes 4 incidents in any 12 months. Beyond that, the same fee applies as on the other plans. Price changes are announced at least 30 days ahead and apply from the first renewal after the notice period. ## Customer data The customer owns the data in its workspace. Pharus uses it only to provide the service, as set out in the data processing agreement. The customer can export its data at any time. ## Availability We run Pharus to be available around the clock. Planned maintenance is announced in advance and scheduled outside working hours where possible. ## Liability Pharus is not liable for indirect losses, such as lost profit, lost data or penalties imposed by authorities. Total liability is limited to the fees the customer paid for the service in the 12 months before the event giving rise to the claim. ## Termination The customer can cancel the subscription at any time, whether it is paid by card or by invoice. An owner does this under Settings → Billing. The subscription then runs to the end of the period already paid or invoiced, for yearly billing to the end of the year, and does not renew. The workspace then moves to the Free plan. To avoid the invoice for the next period, cancel before the renewal date shown under Settings → Billing. Amounts for a period that has started are not refunded, and an invoice for that period must be paid even if the subscription has been cancelled. Pharus can terminate a subscription with at least 90 days’ notice to the end of a paid period. Either party can terminate immediately for material breach. An invoice still unpaid 30 days after its due date is a material breach. Amounts that have fallen due must be paid even after the agreement ends. An owner can close the workspace under Settings → Company: it then stops receiving vulnerability reports, the agreement ends when no paid or invoiced period is left, and customer data is deleted 90 days after that unless the law requires us to keep it longer. The agreement also ends when a workspace on the Free plan is deleted after 12 months without use. ## Changes Material changes to these terms are announced to administrators at least 30 days before they take effect. ## Governing law and venue The agreement is governed by Norwegian law. Disputes that cannot be settled amicably are decided by Oslo District Court (Oslo tingrett).