> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FAQ

> Answers to the questions customers ask most about reporting, SBOMs, plans, data and support.

## Reporting

<AccordionGroup>
  <Accordion title="Does Pharus file the CRA report for us?">
    No. ENISA's Single Reporting Platform has no API, so reports are pasted in by hand. Pharus prepares each stage as a [paste pack](/incidents/srp-pack), filled in from the incident wherever it has the answer. You paste it into the SRP, mark the stage as submitted and record the receipt, and Pharus keeps the record.
  </Accordion>

  <Accordion title="Where does a Norwegian manufacturer send its CRA report?">
    To an EU CSIRT, through the SRP. The CRA is not yet part of the EEA Agreement, so Nkom can't receive CRA reports. Article 14(7) decides which member state's CSIRT coordinates your report, and Pharus shows the route on each incident. See [routing](/incidents/routing) and [reporting from Norway](https://www.pharussecurity.com/en/reporting-from-norway).
  </Accordion>

  <Accordion title="When does the 24-hour clock start?">
    When you become aware of the actively exploited vulnerability or the severe incident, not when the investigation is done. For an incident that Pharus opens from an exploited match, awareness is the time Pharus first saw the match as exploited. An owner or admin can correct it. See [clocks](/incidents/clocks).
  </Accordion>

  <Accordion title="We are a small company. Does the 24-hour deadline apply to us?">
    The early warning is required from every manufacturer. Micro and small enterprises are not fined for missing the 24-hour early-warning deadline (CRA Art. 64(10)), but that exemption doesn't cover the 72-hour notification or the final report.
  </Accordion>

  <Accordion title="Do GDPR, digitalsikkerhetsloven and DORA run on the same incident?">
    Yes. On Core and Plus, Pharus assesses GDPR and digitalsikkerhetsloven next to the CRA, each with its own awareness time and deadlines, and drafts the Norwegian notices for Datatilsynet and NSM. DORA triage is part of Plus and an add-on on Starter and Core. See [Norwegian notices](/incidents/norwegian-notices) and [DORA](/incidents/dora).
  </Accordion>

  <Accordion title="Does Pharus give legal advice?">
    No. Pharus applies the rules as the regulations write them and shows its reasoning, but the determination and the filing are yours. On Starter and Core you can ask a partner consultant to review an incident for a fee per incident; Plus includes it. See [expert help](/incidents/expert-review).
  </Accordion>
</AccordionGroup>

## SBOMs and monitoring

<AccordionGroup>
  <Accordion title="Which SBOM formats does Pharus read?">
    CycloneDX JSON 1.4 to 1.7 and SPDX JSON 2.2 to 2.3, up to 50 000 components. XML, tag-value and SPDX 3 files aren't read. See [SBOMs](/monitoring/sboms).
  </Accordion>

  <Accordion title="Do we have to replace Dependency-Track?">
    No. Dependency-Track can send each processed BOM to Pharus with a webhook alert, and Pharus adds the clocks, routing and records on top. See [Dependency-Track](/api-reference/dependency-track).
  </Accordion>

  <Accordion title="How quickly do we hear about a new exploited vulnerability?">
    Matching starts within seconds of an SBOM arriving. After that, Pharus syncs CISA KEV and EUVD every 30 minutes and re-checks every product family against them, and refreshes each component's OSV.dev lookup every 6 hours. A new exact match on an exploited vulnerability opens an incident and, on Core and Plus, pages whoever is on call. See [vulnerabilities](/monitoring/vulnerabilities).
  </Accordion>

  <Accordion title="What do OSV.dev and other outside services learn about us?">
    OSV.dev receives the identifiers (purls) of your components, never your company's name. See the [data processing page](https://www.pharussecurity.com/en/data-processing) for every sub-processor.
  </Accordion>
</AccordionGroup>

## Plans and billing

<AccordionGroup>
  <Accordion title="How does the free trial work?">
    Every new workspace gets 14 days of every software feature, with no card and no limit on product families. If an owner subscribes during the trial, the card is charged when the 14 days are up. See [plans](/plans) and [billing](/workspace/billing).
  </Accordion>

  <Accordion title="What happens if we don't subscribe?">
    The workspace moves to Free. Vulnerability reports keep arriving and you can answer them, while monitoring, the CRA clocks and SRP packs pause. Nothing is deleted, and subscribing opens everything again. A Free workspace that nobody signs in to for 12 months is deleted.
  </Accordion>

  <Accordion title="Do we pay per user?">
    No. Pharus is priced per product family, so bring the whole team.
  </Accordion>

  <Accordion title="How do we get Plus, or pay by invoice?">
    Plus is set up together with us. [Contact us](https://www.pharussecurity.com/en/contact) and we set up the subscription for your workspace.
  </Accordion>
</AccordionGroup>

## Data and account

<AccordionGroup>
  <Accordion title="Which languages does Pharus support?">
    The app is in Norwegian (bokmål) and English. Companies in Sweden, Denmark and Finland use it in English. The notices for NSM and Datatilsynet are drafted in Norwegian; SRP packs and the DORA reporting template for Finanstilsynet are in English, as those forms are. This documentation is in English.
  </Accordion>

  <Accordion title="Can we take our data with us?">
    Yes. Owners and admins can download everything the company has in Pharus as one file, at any time, also when the workspace is read-only. See [data and deletion](/workspace/data-and-deletion).
  </Accordion>

  <Accordion title="Can one person work for several companies?">
    Yes. One account can be a member of several workspaces, and you switch between them in the sidebar. See [companies](/workspace/companies).
  </Accordion>

  <Accordion title="How do we get help?">
    Use **Contact support** in the app's sidebar, or the [contact page](https://www.pharussecurity.com/en/contact).
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.