> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Support periods

> Record until when each release line gets security updates, copy the sentence for the point of sale, and tell users when support ends.

<Info>
  **Plans:** Every plan. **Who:** owners and admins add and change support periods and record end-of-support notices; every member can see them.
</Info>

A support period says until when a release line of a product family gets security updates. Under CRA Art. 13(8) it is at least five years, unless the product is expected to be in use for less. Under Art. 13(19), buyers must be told the end date, at least the month and year. Pharus keeps one support period per release line, gives you the sentence for the point of sale, and reminds you before a period ends.

## Release lines

A family can have several release lines, each with its own support period. A line covers the versions from its **From version** up to the next line's. Leave **From version** empty for the first line: it covers every version below the next one. A family with a single line and no **From version** covers all versions.

For example, with a first line and a line from `2.0`, the first covers "Versions before 2.0" and the second "Version 2.0 and later". Pharus treats `1.0` and `1.0.0` as the same version, so they can't start two lines.

## Add a support period

<Steps>
  <Step title="Open the product family">
    Go to **Settings → Product families** and open the family. Find the **Support period** card.
  </Step>

  <Step title="Add a release line">
    Select **Add a release line**.
  </Step>

  <Step title="Fill in the period">
    * **From version**: the first version this line covers, or empty for the first line.
    * **Placed on the market**: the month and year, as YYYY-MM.
    * **Security updates until**: the last month of support, as YYYY-MM. Support runs to the end of that month, and it has to be after the month the product was placed on the market.
    * **What the support period is based on**: expected time in use, user expectations, the nature of the product, the support periods of key third-party components (Art. 13(8)).
    * **Why it is shorter than five years**: shown when the period is under five years.
  </Step>

  <Step title="Save">
    Select **Save support period**.
  </Step>
</Steps>

To change a line later, select **Edit** on it. To remove one, select **Remove**: the register and the technical file no longer show it, but signed editions of the technical file keep what they recorded.

A line that lacks something for the technical file says so, for example "Say what the period is based on." Point 4 of the [technical documentation](/reports/technical-file) reads the support period from here: the line that covers the family's current version, or else the latest line.

## See where each line stands

Each line shows its versions, its period (for example "June 2026 – June 2031 (5 years)") and its state:

| State | Meaning |
| - | - |
| Supported | More than 90 days of support left |
| Ending within 90 days | Support ends within 90 days |
| Support ended | The last month of support has passed |

The families list under **Settings → Product families** shows the line for each family's current version in the **Security updates** column, such as "Until June 2031". It says "Not set" when the family has no support period, and "No line covers this version" when none of its lines covers the current version.

On incidents, affected versions whose support ends soon or has ended are tagged "Support ends …" or "Support ended …". Pharus keeps monitoring those versions after support ends.

## Copy the sentence for the point of sale

Each line has a ready sentence under **For the product information and at the point of sale**, for example:

```text theme={null}
Gateway G3, version 2.0 and later, receives security updates until the end of June 2031.
```

Select **Copy** and put it where buyers see it before they buy: on the product page, in the shop, in the product information. Art. 13(19) and Annex II ask for the end date, at least month and year. With a single line for all versions, the sentence leaves the versions out.

## The reminder before support ends

Pharus emails the workspace's owners and admins twice for each line:

* 90 days before support ends, with the subject "security support for … ends in …";
* when support has ended, with the subject "security support for … ended in …".

The first email asks you to extend the period under **Settings → Product families** if you will support the line for longer, or else make sure buyers and users know the date. If you change the end month, Pharus reminds you again for the new date. An end more than 30 days in the past gets no reminder, so entering an old line doesn't send one. Archived families and read-only workspaces get no reminders.

The [weekly digest](/monitoring/weekly-digest) also lists, under **Housekeeping**, the lines whose support ends within 90 days or ended in the last 30.

## Tell users that support ends

Users should know when their product stops getting security updates. Pharus drafts the notice; you send it through your own channels and record it.

<Steps>
  <Step title="Open the notice">
    On the line in the **Support period** card, select **Tell users**.
  </Step>

  <Step title="Edit the text">
    Choose the **Language** (Norwegian or English) and **Who to tell** (**All users** or **The impacted users**). Edit the **Subject**, **What happened** and **What users can do**. Pharus adds your company name and security contact at the end.
  </Step>

  <Step title="Send it yourself">
    Copy the whole message, or select **Open in email** to open your email program with the subject and text and no recipients. Add your customers there, as Bcc. Pharus sends nothing.
  </Step>

  <Step title="Record it">
    Set **Users informed at** and tick **How**: Email, Security advisory, Website, In the product or Other. Select **Record users informed**.
  </Step>
</Steps>

The line then shows "Users told" with the date. Pharus keeps the message as it read, with when and how users were told, and the record can't be changed afterwards.

## Related

<CardGroup cols={2}>
  <Card title="Product families" icon="cpu" href="/monitoring/product-families" />

  <Card title="Technical documentation" icon="file-check" href="/reports/technical-file" />

  <Card title="Inform users" icon="megaphone" href="/incidents/inform-users" />

  <Card title="Weekly digest" icon="mail" href="/monitoring/weekly-digest" />
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.