> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Paging
> How Pharus texts the person on call, how acknowledging stops the escalation, and what happens when nobody answers within 15 minutes.
**Plans:** Core and Plus, and the free trial. **Who:** any member pages on-call from an incident and acknowledges a page; owners and admins send test pages and cancel pages.
A page is a text message to the person on call, with a link to acknowledge it. If nobody acknowledges, Pharus texts the next person in the [rota](/on-call/rota): the backup after 15 minutes, then the final escalation. Pharus places no phone calls.
Being on call is the opt-in: switching off alert emails or the digest under **Settings → Notifications** doesn't stop pages.
## What starts a page
| Trigger | When |
| - | - |
| An exploited match opens an incident | At once, when an SBOM component matches a vulnerability on CISA KEV or flagged as exploited in EUVD. One page covers every incident opened in the same check. |
| A report is about to fall due | 4 hours before an unfiled 24-hour or 72-hour report is due: the CRA early warning and notification, the same reports under digitalsikkerhetsloven and GDPR, and DORA's intermediate report. 1 hour before DORA's initial notification. Once per report and deadline. |
| Someone selects **Page on-call** | On an open incident. |
| A test page | **Send test page** under **Settings → On-call**, or **Page on-call as part of the drill** when you start a [drill](/incidents/drills). |
Some things never page:
* A name-only match. It waits for a person to confirm it on the Vulnerabilities page, as described in [Vulnerabilities](/monitoring/vulnerabilities).
* An incident you declare by hand or open from a disclosure report. Page on-call yourself if it can't wait; otherwise the deadline warning pages 4 hours before its first report is due.
* A final-report warning. It goes out 72 hours ahead by email and in the notification bell, not by SMS.
* A deadline warning for an incident that an open page already covers.
* A drill. Its only page is the test page you can send when you start it.
* Anything in a read-only workspace (on Free, or closed): monitoring and the clocks are paused there. A page that was already under way still escalates.
Pharus starts at most 10 pages per workspace per hour. Escalations of a page already open don't count towards the limit.
## Page on-call from an incident
Open the incident in **Incidents**.
Select **Page on-call** next to the incident's title. The dialog, **Page the person on call?**, names who Pharus texts now and who it escalates to if nobody acknowledges.
Select **Send page**. A banner, **Paging on-call**, appears on the incident with who was texted, when, and when it escalates.
**Page on-call** isn't shown on a closed incident, on a drill, while a page for the incident is open, on Starter, or in a read-only workspace.
If nobody on call has a verified mobile number, the dialog says so: "Nobody on call has a verified mobile number right now, so owners and admins will be emailed instead." No text goes out, and owners and admins get an email, "Nobody on call could be paged".
## What the text says
The text names the incident, the vulnerability and the product family, the next deadline in Oslo time with the time left, and the acknowledgement link:
```text theme={null}
Pharus: INC-0042 actively exploited: CVE-2026-1234 in Gateway G3. Early warning due Sat 22:47 CEST, 23 h 59 min left. Ack: https://app.pharussecurity.com/ack/…
```
* A text sent after an earlier step went unacknowledged starts "Pharus, escalated:".
* A page someone sent from an incident names them: "Kari Nordmann paged you about INC-0042".
* A test page starts "Pharus TEST:" and asks for nothing: "Kari Nordmann sent a test page. No action needed."
* The text is in the recipient's language, set under **Settings → Your profile**, or the company's default language.
* It stays within 300 characters. When it would be longer, Pharus drops detail step by step, the CVE and product family before the deadline. The link is never cut.
**Channels.** Pages go out as SMS, or as RCS on phones and networks that support it. Where Pharus offers WhatsApp, a member can switch on **Page me on WhatsApp instead of SMS** under **Settings → Notifications** to get pages there instead. Phone verification codes always come by SMS.
## Acknowledge a page
Acknowledging tells your team you have it and stops the escalation. There are two ways:
Open the link in the text. The page shows the **Company**, the **Incident**, the **Vulnerability**, the **Product family**, who it was **Sent to**, when it was **Paged** and its **Status**, in Oslo time. Select **Acknowledge page**. You don't need to sign in.
Opening the link doesn't acknowledge anything on its own, so link previews and scanners on your phone or in your mail can't acknowledge for you. The link works for 24 hours and acknowledges in the name of the person it was sent to.
Select **Acknowledge page** on the incident's banner, or in the notification bell under **Open pages**. Any member can acknowledge, not only the person who was texted.
When you acknowledge:
* The escalation stops. Nobody else is texted about the page.
* The link page confirms it: "Acknowledged at 22:51 CEST. The escalation has stopped." If someone else got there first, it says who and when.
* The audit trail records who acknowledged and when, on every incident the page covers.
Acknowledging again changes nothing. A page whose escalation has ended can still be acknowledged. If the link has expired or was cut short, sign in to Pharus and acknowledge the page from the incident.
## How escalation works
Each page has a chain of up to three people, taken from the rota at the moment the page starts: the **Primary**, the **Backup** and the **Final escalation**. With the default times, and a backup and a final escalation set:
| Minutes after the page starts | If nobody has acknowledged |
| - | - |
| 0 | Pharus texts the primary. |
| 15 | Pharus texts the backup. |
| 120 | Pharus texts the final escalation. |
| 135 | The escalation ends, and owners and admins are emailed. |
The rules behind it:
* **Timing comes from the rota.** **Escalate to backup after** sets the 15 minutes; **Final escalation after** sets the 120, counted from the start of the page. Everyone texted gets at least the backup time before the next person is texted, and the escalation ends once the last person in the chain has had it too.
* **People are skipped** when nobody is assigned to a step, when the same person was already texted at an earlier step, or when they have no phone number or haven't verified it. If the primary is skipped, the first person who can be reached is texted at once. The incident's banner lists who was skipped and why, for example "Skipped: Jonas Berg (phone not verified)."
* **A text that fails moves on.** If a text can't be sent, or the network reports it undelivered, the page moves to the next person at the next minute instead of waiting out the 15 minutes.
* **A handoff doesn't change the chain.** A page that starts before a handoff keeps the people who were on call when it started.
So without a backup or a final escalation, the escalation ends 15 minutes after the primary was texted. Without a final escalation, it ends 15 minutes after the backup was texted. Without a backup, the final escalation is texted at its own time, 120 minutes after the start by default.
**When the escalation ends** without an acknowledgement, the incident's banner turns to **Nobody acknowledged the page**, and owners and admins with alert emails on get an email, "Nobody acknowledged the page for INC-0042". If none of them has alert emails on, every owner gets it. The banner and the bell keep showing the page for 24 hours, and anyone can still acknowledge it.
## Cancel a page
Owners and admins can stop a page that is still open, for example when the incident is already being handled in the office.
Open the incident with the **Paging on-call** banner.
Select **Cancel page**. Add a **Reason** if you want, then select **Cancel page** again. **Keep paging** closes the dialog without cancelling.
Nobody else is texted about the page, and the cancellation is logged on the incident with the reason. Someone who opens a link to a cancelled page sees "This page was cancelled".
## Send a test page
Owners and admins can check the rota end to end without an incident.
Go to **Settings → On-call**.
In the **Paging** card, select **Send test page**. The dialog names who Pharus texts: the first person on call with a verified number. Select **Send test page** again.
The text says it is a test. Until someone acknowledges, it escalates like a real page, so a test also shows whether the backup and the final escalation are reachable. If nobody acknowledges, owners and admins get an email that asks them to check the numbers on the rota.
## What is logged
* **Audit trail**, on each incident the page covers: "Paged on-call" (with who, and SMS or WhatsApp), "Escalated after 15 min" (with who), "Acknowledged page", "Escalation ended without acknowledgement" and "Cancelled page" (with the reason). A test page gets the same events without an incident. See [Audit trail](/reports/audit-trail).
* **Delivery problems**: owners and admins see texts that didn't arrive, with the reason given, under **Settings → Notifications**. See [Notifications](/notifications/overview#delivery-problems).
* **Board report**: pages sent, acknowledged, the median time to acknowledge, escalations and pages nobody acknowledged, per quarter. See [Board report](/reports/board-report).
A page that is already open can always be acknowledged or cancelled, also after a move to Starter or while the workspace is read-only.
## Related
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.