> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Expert help
> Ask a partner consultant to review an incident through a read-only link, and read their notes on the incident's Overview tab.
**Plans:** Every plan. Included in Plus, with a partner review that opens by itself; on Starter, Core and the free trial, a fee per incident. **Who:** owners and admins ask for it and manage the partner's access; every member reads the notes.
Before you file, a second pair of eyes can help. An owner or admin asks for a partner consultant's review of an incident. The partner reads the incident through a signed, expiring, read-only link, without your contact details, and leaves notes that come back to you on the incident's **Overview** tab. The partner advises; you decide and file.
When expert help is available for your workspace, the **Overview** tab of every open incident shows an **Expert help** card: "A partner consultant reviews the incident within the deadline." Until then, the card isn't there.
## What it costs
| Plan | Expert help | Partner review |
| - | - | - |
| **Plus** | Included, no fee per incident | Opens by itself once the incident has something to file |
| **Starter and Core** | From 5 000 NOK excl. VAT per incident | Not included |
| **Free trial** | From 5 000 NOK excl. VAT per incident | Not included |
The trial includes every software feature, but not the services that are people's time, so expert help during the trial is billed like on Starter and Core.
On a billable request, Pharus bills the fee when you send the request: to the card on the company's subscription, or, without a card on file, by an invoice emailed with 14 days to pay. The invoice line reads "Expert review" with the request's reference (`EXP-0001`) and the incident's. The company's owners get an email about the request. See [billing](/workspace/billing).
## Ask for expert help
The incident must be open and not a drill. The **Expert help** card shows what the review costs on your plan. Owners and admins also see an offer on the **Determination**, **SRP pack** and **Notices** tabs: "Want a second opinion before you file?"
Under **What do you need help with?**, write what the partner should look at. They read this first. Use at least 10 characters.
Tick **I accept the fee: from 5 000 NOK excl. VAT for this incident**. On Plus, the dialog says "Included in your Plus plan." instead.
Select **Send request**. Pharus sends the read-only link to its partner desk. The card shows the request with its reference, who asked and when, and until when the link works.
An incident has one open request at a time. A closed request can be followed by a new one.
## What the partner sees
The partner opens the link in a browser. No Pharus account is needed, and the page is read-only apart from the partner's own notes. It shows one incident, in the company's language, with times in Oslo time:
* the deadlines, and the incident's facts: kind, status, awareness time and basis, product family and versions, vulnerability, member states, fix and summary;
* the determination and the DORA classification, with rationales, evidence and approvals;
* the regime triage, with statuses, recipients and reasons;
* the report packs, as drafts or as submitted, and the filings;
* your question, and the notes written so far.
Contact details are left out: no email addresses or phone numbers. The packs' contact fields show "Left out of the review". Opening the review is recorded in your [audit trail](/reports/audit-trail), and the card shows how many times the link was opened and when last.
While the request is open, the partner desk hears about each new report that falls due on the incident.
## Manage the partner's access
The link works for 14 days. Owners and admins manage it from the request on the **Expert help** card:
* **Send a new link** sends the partner desk a new link that works for 14 days. The one sent before stops working.
* **Revoke access** stops the link at once. You can send a new one later. Revoking also works in a read-only workspace.
* **Close request** ends the request: the link stops working and the partner can't add more notes. Their notes stay on the card and in the audit trail.
Pharus stops the link by itself when the incident is closed or the workspace becomes read-only, and the card says why. While a report is due on the incident, Pharus sends the partner desk a fresh link when the old one has expired or was stopped this way, once the incident is open and the workspace can be edited again. A link an owner or admin revoked stays revoked until one of them sends a new one.
If the email to the partner desk didn't go out, the card says so, and **Send a new link** tries again.
## Notes from the partner
The partner's notes appear under **Notes from the partner** on the incident's **Overview** tab, with their name and the time. Each note is also emailed to whoever asked for the help, or, for a partner review Pharus opened by itself, to the owners and admins. A request takes up to 50 notes. The notes are part of the incident's record and land in the audit trail.
## Partner review on Plus
On Plus, a partner review opens by itself once the incident has something to file: an approved determination makes it reportable, a notice regime or DORA is triggered, or a report is marked as submitted. The card shows it as **Partner review**, "Opened by Pharus", with no fee. You manage its link and read its notes like any other request.
## Related
What Plus includes, and what the trial leaves out.
Cards, invoices and VAT.
The determination the partner reviews.
Every request, link, view and note, in order.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.